# Model and agent workloads

Availability: **Proposed specification**  
Documentation: **1.1** | Updated: **19 September 2026**

[Documentation home](../README.md)

AI workloads require a workload-specific acceptance method. Deterministic retrieval can be replayed exactly under its published rules. Generative inference may vary with sampling, hardware, numerical precision and engine behavior, even when a seed is recorded.

## Model execution profile

| Profile element | Required record |
| --- | --- |
| Model identity | Model name, immutable weight reference or provider version, and usage rights |
| Runtime | Engine version, artifact digest, precision and quantization |
| Request | Input reference, prompt-template digest and sampling configuration |
| Tools | Allowed tools, argument constraints, authorization scope and budget |
| Evaluation | Dataset version, method, thresholds, adjudication and failure handling |
| External service | Provider request identifier, model version and reconcilable usage |

AI-01 Freeze acceptance criteria before execution. Evaluate output structure, business quality and execution provenance separately. Exact string equality is appropriate only where the workload profile justifies it. An external model response remains inside the external provider's trust boundary.

## Agent authorization

Agent-generated content MUST NOT expand tool permissions. Treat prompts, retrieved documents and model outputs as untrusted data. A tool gateway enforces allowed operations, destinations, data scope and spending limits independently of the model. High-impact external actions require the workflow's explicit authorization and reconciliation policy.

## Confidential and verifiable execution

TEE attestation and zero-knowledge proofs are possible extensions, not guarantees of this release. Any extension must identify the code or computation covered, input binding, hardware or cryptographic trust assumptions, verifier behavior, freshness and failure handling.

Ritual's current documentation explains replicated and delegated execution and the handling of asynchronous work. Ocean6 uses this as a reference for documenting execution boundaries; it does not claim Ritual integration or inherit its deployed mechanisms. [R4](https://docs.ritualfoundation.org/)

For physical equipment, local safety systems retain authority over interlocks, emergency stops and manual takeover. A software task result must distinguish command receipt from observed completion.

[Previous](./delivery-verification.md) | [Next](./security.md)