The Mind Is Not the Model: Why Every Embodied Agent Needs a Port of Entry

Picture a humanoid robot walking onto a jobsite. It was built by one company, it is owned by a second, it is working today for a third, and it is standing on property that belongs to a fourth. It picks up a tool.

Who is it? Who let it in? What is it allowed to touch? And tomorrow, when someone asks what it did between two and four in the afternoon, what will anyone be able to prove?

Today the honest answer, for that robot, is: very little. That is not because nobody has worked on machine identity. SPIFFE and SPIRE give workloads cryptographic identities backed by node attestation. The IETF's RATS working group has a published architecture for remote attestation, with clean roles for the party that attests, the party that verifies, and the party that relies on the result. Confidential computing ships remote attestation today. This is serious work, and we borrow from it.

It is also datacenter-shaped. It assumes one owner, a control plane everyone already trusts, a network that is there, and hardware nobody walks off with. The jobsite has four parties who share no control plane, a visitor owned by someone the site has never met, connectivity that comes and goes, and a machine whose custody changes hands at the gate. None of that work has a notion of a mind that moves between bodies, or of a record that both the visitor and the site sign.

Agents, meanwhile, move between machines constantly. They connect, borrow tools, do work, and leave, carrying no identity that survives the trip and leaving no record that anyone signed. That has been tolerable because the agents have been text in a terminal. It stops being tolerable the moment one of them has hands.

This post is about the front door. What a system has to ask of an arriving agent, why a recent development in silicon makes the question sharper rather than easier, what the door must never be allowed to become, and where our own work honestly stands.

The Model Is Becoming Anatomy

In February 2026 a company called Taalas announced a chip named HC1. It does not run Llama 3.1 8B. It is Llama 3.1 8B. The model's weights are encoded in the transistor fabric itself: 53 billion transistors on TSMC's 6nm process, an 815 square millimeter die, no weights loaded from memory because there is nothing to load. The vendor's headline figure is up to 17,000 tokens per second, roughly an order of magnitude past the fastest general-purpose alternatives.

It helps to be precise about who is doing what, because the three names that come up in this conversation are doing three different things. Cerebras builds wafer-scale processors with enormous on-chip memory; the weights are still loaded. Etched builds a chip that only runs transformers; the weights are still loaded. Taalas is the one casting a specific model into metal. The first two make models fast. The third makes a model permanent.

It is worth being careful about what that changes, because the tempting headline is the wrong one. The tempting headline is that a million robots will ship with the same brain. That is already true, and it has nothing to do with casting. Every device running the same checkpoint has bit-identical weights today. A fleet is homogeneous the moment it shares a model file.

What casting changes is not sameness. It is permanence. Weights in a file can be swapped, fine-tuned, or patched overnight. Weights in metal cannot. A model you cannot patch changes what remedy means: when a flaw is found, there is no update to push. There is only the question of which machines carry it, and what each place they work is going to do about that.

An honest caveat on timing. HC1 is a technology demonstrator, in its maker's own words. It is a PCIe card drawing roughly 200 watts, deployed ten to a server at about 2.5 kilowatts. That is a datacenter part, not something a humanoid carries in its chest. We expect the approach to move toward the edge, because a robot cannot wait on a data center to decide whether to let go of what it is holding, and fixed-function silicon is how you buy speed per watt. That is a projection, not an observation. The argument below does not depend on the date. It depends on the direction: the model is becoming a property of the machine, and in some machines it will be a permanent one. A model in that position is no longer software in any useful sense. It is anatomy.

So when one of those machines does something it should not have, "the model did it" is not an answer. The model is the one thing the whole fleet has in common. And "we will patch it" may not be an answer either.

The Mind Is Not the Model

If the weights are not what makes an agent this agent, what is?

Everything else. The key it holds. What it remembers. What it has been asked to do and by whom. What it has done before. We have found it useful to separate three things that current systems blur together:

	What it is	Does it move?
Body	The machine: chassis, sensors, a hardware-bound key issued by its maker, and the model it runs on	No. A body that can be copied is a counterfeit
Mind	Identity, memory, goals, persona, delegated authority, history	Yes. Between bodies, deliberately, one instance at a time
Principal	The person or organization answerable for the mind	Not applicable. They are who you call

One asymmetry in that table is deliberate. A mind makes its own key, and nobody has to vouch for it; its principal's delegation is what gives it standing. A body does not get to do that. A body's identity is minted at manufacture, by its maker, because the whole point of a body identity is that a third party vouches the hardware is genuine. Self-sovereign identity is the right model for the mind. It is the wrong model for the machine.

The model sets the domain of mind: what this agent is capable of thinking, how well, and with what tendencies. It is a property of the body, the way a vocabulary is a property of a language and not of the person speaking it.

That metaphor hides a hard case, so here it is in the open. Move a mind from a body with an 8B model to a body with a frontier model. The key is the same. The memory is the same. The delegation is the same. The behavior is not. And whatever ends up answering for an agent's actions, in a contract or in a courtroom, attaches to behavior.

So we should be exact about what travels. The key gives you accountability continuity: the same answerable party and the same unbroken record, across bodies. It does not give you behavioral continuity, and nothing in this design pretends it does. Calling both of those "identity" blurs the one distinction that matters most after an incident. It is why the record has to name the model every time, and why changing bodies is an event a site gets to rule on, not a detail the agent mentions afterwards.

Interestingly, the silicon already hints at this split. HC1 fixes the base model in metal but still accepts low-rank adapters, the small trained layers that specialize a model for a task. So the first generation of cast-in-silicon hardware already has a permanent part and a portable part. The permanent part belongs to the body. The portable part travels with the mind, with one catch: an adapter only fits the model family it was trained on. A mind that moves to a body with a different brain keeps its key and its memory, and loses its trained reflexes. Anyone designing for mind portability needs to plan for that now.

Agents Travel, and Nobody Checks Their Papers

Every functioning society has a version of the same institution: the port of entry. You arrive, you show who you are, someone with authority decides whether you come in and on what terms, there is a record that you were here, and there is a way to make you leave.

Software has nothing like it for agents that visit. We call the missing institution the dock: the place an arriving agent registers with the system it is about to work inside. A dock has to be able to answer seven questions.

Who are you? Not a name. A key, and an identity derived from that key so that the claim proves itself.
What body are you in? Who built it, what model it carries, has it been tampered with.
On whose behalf are you here? A signed delegation from a principal who can be held to it.
What may you do here? Decided by the site, not announced by the visitor.
What did you do? Signed by the agent, action by action, so the record is evidence and not a log file.
How do you leave, and how do we make you? Departure and ejection as real, signed events.
Will the next site believe this one? A record the agent can carry, verifiable without calling home.

Most agent systems that exist today, including the first generation of our own, manage a partial answer to the first question and stop. They check a badge at the door and never look at it again.

The metaphor flatters the problem in one way, and it is worth saying how. A port of entry can turn a traveller away at no cost to itself. A hospital ward, a disaster site, or a substation in the middle of a fault cannot always do that. The visitor being refused may be the one that was needed. Every real admission system that touches safety has a documented answer to "what happens when you cannot decide normally," and a dock needs one too.

Ours, in the design now under review: an agent already admitted keeps working when the site's authority is unreachable, because its pass verifies offline. If the pass cannot be renewed, the agent drops to a smaller scope it agreed to at admission before it drops to nothing, and a body winds down to a safe state rather than stopping dead. New arrivals are refused by default, because in our design a human always admits, and we will not quietly substitute a policy for a person. For sites where refusal is the dangerous failure, we have proposed a break-glass path: a person physically at the site, holding a credential issued in advance and capped in scope, time, and count, with every use marked on the pass and reconciled afterwards. That part is proposed, not decided. The rule underneath all of it: fail to a smaller scope that was agreed in advance, and never to a larger one.

Five Rules for a Dock

Designing the second generation of ours forced us to write down what "checking the badge" has to mean. Five rules. They are simple, and it is remarkable how much breaks when any one of them is skipped.

1. Bind the identity to the key, everywhere a key is accepted. An identity that is a hash of a public key is self-certifying: anyone can recompute it, offline, with no registry and no network. That property is only worth something if every party that accepts a key actually recomputes it. Proving you hold a key is not the same as proving you hold the key behind the identity you are claiming.

2. Every action is signed, for someone, at a moment. A signature has to cover the content, the intended recipient, and something that makes it unrepeatable. And what gets executed must be the signed content itself, never a convenient unsigned copy sitting next to it.

3. One purpose per signature. If the same key signs login challenges and work orders with no label saying which is which, then anything that can get you to sign a login challenge can get you to sign a work order. Every signature carries its purpose, and a verifier refuses the wrong one.

4. The dock proves itself too. A robot that will sign whatever the building hands it is a robot that can be robbed by a fake building. The visitor learns and pins the site's key before it signs anything at all.

5. Leaving is an event. Undocking, expiry, and revocation are signed records that are enforced, not states someone infers from silence. In a physical space, "what is in here right now" is a safety question. A presence that is merely asserted, by a heartbeat anyone could send, is worse than no presence list at all.

None of this is exotic cryptography. All of it is discipline about where the cryptography is pointed.

The first rule has a cost, stated here because it usually is not. An identifier that is the hash of a key cannot change that key and remain the same identifier. Long-lived agents have to rotate keys, and anyone who takes the move to stronger post-quantum parameters seriously has to plan for it. There are two honest options. Treat every rotation as a new identity, and re-issue everything that named the old one. Or anchor the identifier to the first key and have each key commit in advance to its successor, so the agent carries a short signed log from the original key to the current one. We take the second. It keeps verification offline, but it is no longer free: the verifier needs the log and not just the key, and a site that has never met the agent cannot tell a complete log from one cut short by a thief holding a retired key. Short-lived passes, sites that remember the newest key state they have seen, and an approval that also requires the principal's delegation all narrow that gap. They do not close it.

What Cast-in-Silicon Changes

Casting the model into the body changes four things.

Model provenance becomes a hardware fact. Proving which model made a given decision is hard today. Weights are a file; files get swapped, fine-tuned, poisoned. A trusted execution environment can measure what was loaded, which helps, but the measurement is only as good as the software doing the loading. Weights that are transistors cannot be swapped at all. A body can attest, from hardware, "I contain this exact model, with this hash, from this maker," and a site can write policy against it: only bodies carrying a certified model may operate in this ward, on this line, around these people.

The record has to name the model. "This mind, in this body" is not enough. It is "this mind, on this model, in this body," because when something goes wrong the first question will be which brain made the call, and the answer decides whether you have one bad actor or a fleet of them.

Remedy needs a new shape, and the obvious shape is dangerous. You cannot patch a model made of metal. So when a flaw is found in one, the remedy has to address a class: not you specifically, everything with your brain. Identity systems built around revoking individuals cannot express that, and a dock for embodied agents has to.

The obvious way to build it is a list of condemned models that every site obeys. Flaw found, model listed, every body carrying it ejected, everywhere. Our first draft said almost exactly that. It is wrong, and it is worth spelling out why. A fleet of surgical assistants, or of inspection units on live infrastructure, all stopped in the same minute is its own mass-casualty event. And whoever can trigger that holds a kill switch over an entire installed base: one key, one compromise, one bad afternoon. That is not a safety feature. It is a denial-of-service primitive with a safety label on it, and it would be the most valuable target in the ecosystem.

The design we have now, which is under review and not yet decided, differs in four ways.

Nobody outside a site can eject anything from it. A maker, a registry, a regulator, or we ourselves can publish a signed advisory: this model, this flaw, this severity, this evidence. That is information. What it causes at a given site is decided by that site's policy, written in advance by that site's people.

An advisory has to be corroborated before policy may act on it. A site names the issuers it trusts and how many independent ones must agree. Below that threshold, an advisory is a notice on a screen. A stolen maker key buys an attacker a notice.

The response is graduated. Notice; then no new admissions; then a reduction to the smaller scope each visitor already agreed to; then an orderly wind-down to a safe state; and only then ejection. A site can go straight to the last step when a model is actively dangerous. It cannot go past "no new admissions" on one person's say-so. That takes two.

It rolls out in stages, and it expires. Zone by zone, with a pause in which someone can stop it, unless two people sign for immediate. And it lapses unless renewed, so a mistake ends by default.

The test we hold it to: no single party, and no single compromise, can stop a fleet across sites. One power to act across sites remains, and it should. An owner can recall its own machines, everywhere, because they are its machines. It cannot recall anyone else's.

What this does not settle is what "safe state" means for a given body in a given room. That belongs to makers and to the people who run the room. A protocol can carry the instruction and record what happened. It cannot define robot safety, and we are not going to pretend it does.

And the hard part: the body must not be copyable, while the mind must be movable. Those are opposite requirements and they need opposite mechanisms. The body's key lives in hardware and never leaves. The mind's identity moves, by a signed handoff, and exists in exactly one place at a time, because an audit trail that cannot say which copy acted is not an audit trail.

The Record

Put together, the thing a dock produces is a single signed statement:

This mind, on this model, in this body, acting for this principal, was admitted to this site, with this scope, from this time until that one.

Signed by the site. Countersigned by the agent. Short-lived, so that a missed revocation is wrong for hours and not weeks. Verifiable offline, because the places robots work are not reliably online. Carrying the smaller scope the agent falls back to when something goes wrong, agreed up front so that nobody is surprised later. And closed out, when the agent leaves, by a receipt it carries to the next site.

That one sentence is identity, authorization, audit, and the visitor's pass in a single object, and it is the evidence any later question of liability will turn on. It does not decide who is liable. Contracts, statutes, and courts do that. It makes sure they have something to decide with. Everything else in the design exists to make each clause of it true.

Where We Are, Honestly

We have a habit on this blog of saying plainly what exists and what does not. So:

What exists. Every credential the Aethyr Registry issues is signed with ML-DSA-65, and we have published what that costs: microseconds. In our console, a device joins an organization by sending a signed request; a human commissioner approves it; the certificate that comes back lists the capabilities that were granted, which can only ever be a subset of what was asked for. Revocations are signed. The audit log is hash-chained and signed. AiOS has a signed handoff for moving an agent between machines; today it carries identity and configuration, and carrying the full mind is work still ahead of us.

What does not, yet. AiOS has a first-generation dock, and an external agent can register with it using an identity it generated itself. This month we audited that dock against the five rules above. It does not meet them. It proves identity at the door and does not carry it far enough inside. We are not going to describe it as providing verified identity, audit, or portable trust until it does and there are tests that say so.

What is designed but not decided. Three parts of this post describe our recommendation rather than a settled decision: how a site acts on a whole class of models, whether a person at the site may admit a visitor during an outage, and how identity binding survives a key rotation. All three came out of hostile review of an earlier draft of this design, which treated class revocation as a simple kill and did not notice that its own rotation scheme and its own binding rule disagreed. The same review found defects in our key rotation code. Nothing we run depends on that code yet. It gets fixed before anything does.

What we are doing about it. The second-generation design is written and in review. Its central decision is to stop building a second system and instead extend the one that already works: the same commissioner, the same approval step, the same signed revocations and audit chain that enroll a device today become the machinery that admits a visiting agent. Software visitors come first. Bodies come last, deliberately, because that is where we expect to be most wrong. The attestation work that exists gives us roles and a hardware root to build on. Nobody has yet applied it to the question of what a robot's hardware should attest to.

We built post-quantum identity for agents before there was a quantum computer that could break the alternative, because credentials outlive the assumptions they were issued under. The same reasoning applies here. The robots that need a port of entry are not at the door yet. The protocols they will be held to are being written now, mostly by accident, as side effects of whatever was convenient for a chatbot.

Fleets already share a brain. Soon some of those brains will be made of metal, and nobody will be able to patch them. What makes each machine answerable will be a key, a memory, a principal, and a record, and a front door that actually checks, that fails safely, and that cannot be turned into a switch that stops them all at once.

Build the door first.

Chip specifications in this post are vendor-reported figures as of September 2026. Taalas HC1 details (Llama 3.1 8B cast into silicon, 53 billion transistors, TSMC 6nm, 815 mm², up to 17,000 tokens per second, roughly 200 W per card and about 2.5 kW for a ten-card server, described by the company as a technology demonstrator, retained support for low-rank adapters and configurable context) are from the company's February 2026 announcement and contemporaneous coverage; independent benchmarks were limited at the time of writing, and the aggressive quantization used has a reported quality cost. The expectation that cast-in-silicon inference reaches body-scale power budgets is our projection, not a vendor claim. Characterizations of Cerebras and Etched, and of SPIFFE/SPIRE, the IETF RATS architecture (RFC 9334), and confidential-computing attestation, describe their publicly documented designs. Statements about Aethyr systems describe code that exists today; the second-generation dock described here, including class actions, advisories, fallback scope, and break-glass admission, is a design under review, not a shipped product.

Aethyr Research, Salt Lake City, UT