ThreeGate/docs/execution_backends.md

Execution Backends in ThreeGate

ThreeGate deliberately separates reasoning from execution and further subdivides execution into two distinct backends with different risk profiles.

This document explains when and why each backend exists, and how escalation decisions should be made.

---

Overview

Backend	Purpose	Risk Level	Default
Monty (TOOL-EXEC-Lite)	Pure compute, data transforms	Low	✅ Yes
ERA (TOOL-EXEC-Heavy)	General execution in microVM	Higher	❌ No

---

Monty (TOOL-EXEC-Lite)

What Monty Is

Monty is a restricted Python-subset interpreter designed for agentic toolchains. It provides programmability without host access.

Capabilities

• Arithmetic and control flow
• Lists, dicts, loops
• Deterministic transformations over provided inputs
• Captured stdout / return value

Explicitly Not Allowed

• Filesystem access
• Network access
• Environment variables
• Subprocesses
• Dynamic imports
• External functions (unless explicitly added by policy)

Intended Use Cases

• Ranking or scoring items
• JSON or CSV-like data transformations
• Parsing and normalization
• Small algorithms that would otherwise require custom code

Why Monty Is the Default

• Minimal blast radius
• No persistence
• No I/O side effects
• Fast startup
• Designed specifically to avoid “agent escape hatches”

Security Note

Monty is not a sandbox replacement for arbitrary Python. It is a capability-limited interpreter. Any addition of external functions is a security boundary change.

---

ERA (TOOL-EXEC-Heavy)

What ERA Is

ERA executes tasks inside a microVM with strong isolation guarantees.

Capabilities

• Full Python or binary execution
• File I/O via explicit mounts
• Larger memory and runtime allowances
• Future support for specialized tools

When ERA Is Justified

Use ERA only when:

• The task cannot be expressed in Monty’s subset
• File-based artifacts are required
• External binaries are unavoidable
• The operator explicitly approves escalation

Why ERA Is Not the Default

• Larger attack surface
• More complex lifecycle
• Higher operational cost
• More difficult to audit than pure compute

ERA exists as an escape hatch, not a baseline.

---

Escalation Rules (Non-Negotiable)

1. Attempt Monty first
2. If Monty cannot express the task, document why
3. Require explicit human approval for ERA
4. Treat ERA outputs as untrusted data on return
5. Never allow ERA to initiate further execution or retrieval

---

Anti-Patterns

🚫 Automatically choosing ERA
🚫 Allowing Monty to access files or network
🚫 Re-running execution results as instructions
🚫 Chaining execution backends without human approval

---

Summary

ThreeGate’s execution model is deliberately asymmetric:

• Monty provides safe programmability
• ERA provides controlled power
• CORE never executes
• FETCH never executes
• No backend is autonomous

This separation is foundational to ThreeGate’s security model.