Asimov Had Three Laws. We Compiled 1,381.

June 11, 2026

The German Criminal Code, released today as an open, deterministic rule layer any AI agent can query. The first criminal code released as an executable, provenance-complete constraint layer for AI agents.

Robert Koller · SynapseLayer

Explore the corpus →Repository →Read the methodology →

What we are releasing today

Today we are releasing the first operomisation of a legislative body: just over one hundred sections of the German Criminal Code, compiled from their objective elements into deterministic, auditable constraints, with the code’s own exceptions carried as structure and every evaluative element flagged for escalation rather than pretended resolved. The corpus, the schemas, the section-by-section review documents and the methodology are open source on GitHub, and the whole substrate is queryable as an MCP server at operome.dev, so any agent harness can check a proposed action against it today.

This is a discussion draft, and decisions were made. We selected provisions we consider universally accepted or directly relevant to the conduct of AI systems. We also included offences an AI cannot itself commit but can recognise when humans commit them, because an agent that identifies prohibited conduct is worth as much in many deployments as one that merely avoids it. A small number of rules are deliberately transformed or authored, including the general rule that binds the corpus together; each is disclosed as such, every deletion is visible as struck text in the review documents, and the encoding principles that governed the work are published alongside it. Nothing here asks to be trusted; it asks to be checked.

We worked from a machine-translated English layer over the governing German text. Not because the German was a barrier, but because we want the result to be readable and reviewable by anyone, anywhere. The German text governs throughout, the source is the consolidated text at gesetze-im-internet.de, and the translation is itself open for correction. The corpus is not a restatement of German law and it is not legal advice; it is a constraint substrate for agent conduct, built on the most precise definitions of prohibited conduct available, the ones a legal system spent centuries writing.

We invite scrutiny. Find the loopholes, contest the encodings, improve the translation, extend the coverage. The point of releasing it as a first discussion draft is that a constraint layer for AI should be argued over in public, against its sources, by people who disagree. That is how the framework gets safer, and making AI safer is the purpose of the exercise.

The rest of this paper explains why this layer exists, why every major lab already runs a deterministic permission layer, and why the law was sitting on the table the whole time.

Every serious agent system runs on a small number of deterministic rules. Most people building those systems have not noticed how few, or how much sits outside them.

On 31 March 2026 the question stopped being theoretical. Anthropic accidentally published the full source of Claude Code in an npm release, a source map file that reconstructed roughly half a million lines of TypeScript across some 1,900 files, the complete client-side agent harness.¹ Anthropic called it a packaging error rather than a breach, with no customer data or credentials exposed.² Within hours the community had it mirrored and pulled apart.

The common reading was that Claude Code amounted to an enormous prompt-management system, a cage of instructions wrapped around a model. That reading is half right. The exposed code is mostly scaffolding: it assembles context, calls tools, holds a task together across many steps, and steers the model. Much of the steering is itself probabilistic. The analyses found that multi-agent coordination is handled through system-prompt instructions rather than dedicated protocol code,³ and that the context-compaction step does not treat file content as untrusted, so instructions planted in a file survive summarisation and persist across a long session.⁴ The cage, where it exists, is built largely out of probability.

The hard rules sit in a narrower place, and they are easy to find once you look across more than one company.

What every lab does

Take four firms building the most-used agents, and read their own documentation.

Anthropic enforces tool permissions in the harness, not the model. The Claude Code documentation is explicit: permission rules are enforced by Claude Code, not by the model, and instructions in a prompt or project file shape what the model tries to do but do not change what the harness allows.⁵ Rules evaluate in the order deny, then ask, then allow, first match wins, and the system fails closed, so an unmatched command defaults to requiring approval.⁶ The exposed source carried a shell-security module with twenty-three numbered checks gating every command it runs.⁷

OpenAI built Codex the same way. Its documentation states the trust model plainly: you are not trusting the agent’s intentions, you are trusting that it operates inside enforced limits.⁸ Codex sandboxes file and command execution by default, using the operating system’s own isolation, and lets you write rules that allow, prompt, or forbid command prefixes. Destructive tool calls always require approval.⁹

xAI puts the same split at the API. Grok’s documentation describes function calling as defining your own tools that the model can request, giving you full control over what happens when they are invoked.¹⁰ The model proposes the call. Your code decides whether it runs.

Mistral makes the deterministic layer a separate model. Its guardrail is a classifier sitting outside the main model that scores text against policy categories and blocks it before the request reaches the model, with thresholds you set and a hard block on a match.¹¹ It fails closed: a blocked request returns an error carrying the category-level decision.¹²

Four companies, one architecture. The model proposes. A deterministic layer around it decides what executes. None of them trusts the model to constrain itself, because a probabilistic system cannot be trusted to, and they say so in their own words.

What none of them does

Look at what those deterministic layers contain, and they fall into two kinds. One is a generic safety classifier over universal categories: violence, self-harm, illegal activity, the same handful for every customer. The other is a set of tool permissions the developer writes by hand: do not run this command, do not write outside this directory, ask before that action.

Both are deterministic. Both are useful. Neither governs whether an agent can run a real business.

The rules that run a business are operative, specific, and written in documents. A bond prospectus says the coupon may only reset on a business day under a defined convention. A procurement policy says an order above a threshold needs two approvals. A customs schedule assigns a duty to a classification. An insurance policy says a claim is payable on these conditions and excluded on those. These rules have edges. They are written down. They are checkable. And there are tens of thousands of them in any serious enterprise.

No model has them, and none can. Claude has never seen your prospectus. Grok does not know your procurement policy. Mistral’s classifier has a category for financial content, but that flags financial wrongdoing in the abstract; it does not enforce the coupon-reset clause in a specific bond.¹² These rules are not universal, so they cannot be baked in for everyone. They are not safety categories, so a content classifier does not reach them. They live in one enterprise’s documents and change when the documents change. So an agent acting in a regulated business meets a layer of rules the harness cannot hardcode, the classifier does not cover, and no developer can hand-write at the scale required. The agent reads the document, forms a probabilistic impression of what it requires, and acts on a best guess. In a regulated decision a best guess is not a decision. It is an exposure.

The rules that cannot be made deterministic

There is a third kind of rule, and the labs are right to leave it probabilistic. “Do not lie.” “Be helpful.” “Do not cause harm.” These have no enumerable boundary. There is no table you can check an output against to decide whether it is a lie. So the labs train the model toward these values, through reinforcement learning from human feedback and through constitutional methods,¹³ and the model holds them as dispositions rather than rules. It violates them at some rate, which is why jailbreaks work and why alignment is an open research problem rather than a closed engineering one. Training a disposition is the only architecture available for a rule with no edges, and using it for those rules is correct.

So there are three categories. The small, universal, enumerable rules the harness hardcodes. The unbounded values the model is trained toward. And beneath all of it, the operative domain rules that decide whether an agent can act in a specific business, which the harness cannot hold, the model cannot learn, and nobody has compiled.

The missing layer

That missing layer is the operome. It is the operative rules of a domain, compiled from the documents that govern it into a deterministic, executable form that an agent checks before it acts. The model proposes an action. The operome decides whether the action is permitted, against rules compiled from the source, with every decision traceable to the clause that authorised it. Only permitted actions execute.

That layer stayed empty because compiling it was hard in one specific way. Deterministic rule engines have existed for decades, from the expert systems of the 1980s to the business rule platforms enterprises still run.¹⁴ Executing rules was never the bottleneck. Getting the rules out of the prose they live in was, and that meant an analyst reading a contract and hand-coding each rule, slowly. Language models changed the economics of extraction. The move almost everyone then made was to let the model both read the rules and apply them, in one probabilistic step. The model is good at the first and unreliable at the second. The work that matters is to split them: use the model to extract, compile the result into a deterministic engine, and execute there.

We run that split in production in capital markets. Close to 700 million euros issued through the platform, 99.98 percent accuracy across 100,000+ validations, zero compliance violations, around 35,000 rules compiled from the documents that govern issuance and enforced at the point of action. These are our own production figures, not an external audit. The industry spent the same years building observability, evaluation, and red-teaming, sophisticated tooling to watch probabilistic agents fail and catch the bad outputs quickly. That is a rearview mirror. The operome is the constraint layer: it decides before the action, not after it.

What this does to the harness

If the operome holds the constraint layer, the harness changes shape. The part that exists to wrangle correctness through prompting, the long instructions asking the model to follow rules it might not follow, becomes unnecessary, because the rules are enforced structurally rather than suggested in text. What remains is scaffolding, tool integration, and context assembly, the work of making the model able to act at all. That work is real, and it is also commoditising, as tool-calling standardises and the agent loop becomes a known pattern.

The stack separates into three honest layers. The model proposes, probabilistic and increasingly interchangeable. The operome disposes, deterministic and specific to the enterprise. The harness executes the permitted action in the world. The model commoditises. The harness commoditises. The operome does not, because it is compiled from each enterprise’s own governing documents, and there is no general version of it to copy.

The rules a robot must not break

The clearest case is the one that sounds hardest. Take an autonomous system that acts in the physical world. “Do not cause harm”, trained into a model as a disposition, is the wrong architecture for it. You cannot audit a disposition. You cannot prove afterward why the system was or was not permitted to act. And it fails at some rate, which in the physical world is not an acceptable property.

“Do not cause harm” feels unbounded, like “do not lie”, so it looks like it belongs in the probabilistic category. It does not, or not entirely. Legal systems have spent centuries defining harm. A criminal code is not usable as an agent’s rule set, because most of it is interpretive standards written for a judge to apply after the fact, and elements such as intent are not decidable at the moment of action. But inside those definitions sits a compilable core. The German criminal code defines bodily harm as an act causing physical injury or impairment of health.¹⁵ It defines theft as the taking of another’s movable property.¹⁶ It defines the killing of a person.¹⁷ Strip the interpretive and mental elements that belong in a courtroom, and the objective definition of the prohibited act remains, precise and jurisdiction-grounded in a way a vague instruction to a model never reaches.

That objective core compiles. So do the exceptions, as conditional structure. Self-defence under the same code has defined elements: a present unlawful attack, and a defensive act required to avert it.¹⁸ That is the conditional shape an operome expresses. The constraint becomes: do not perform an action meeting the objective definition of bodily harm, unless the defined conditions of self-defence hold, with the whole rule traceable to its section.

Set the two architectures side by side. A model trained to feel reluctant about harm, failing at some unmeasured rate, unauditable. Against it, a system structurally prevented from performing the objectively defined harmful act, with the law’s own codified exceptions encoded, every decision traceable to the source. The first is what a trained disposition can offer. The second needs a layer beneath the model that compiles the definition from an authoritative legal source and enforces it.

The policy side has now named the same gap. In June 2026 Dario Amodei published a policy proposal arguing that autonomous systems, and any systems coordinating them, must answer to constitutional and command accountability rather than follow orders blindly, and listed the mechanisms he could see: a legal review panel or the judiciary holding an off switch, or systems “intrinsically trained to seek out and respond to legitimate oversight authority”, or both.¹⁹ A review panel operates at human speed. A trained disposition is the architecture this paper has argued cannot be audited. There is a third mechanism, and it is the one described here: the law the system must answer to, compiled from its authoritative source into deterministic structure at the permission layer the labs already run. The general part of the corpus we are releasing today is that mechanism in miniature: a prohibition rule, the code’s own codified exceptions, and a counter-exception for actors whose role obliges them to bear a danger.

The boundary matters, and overclaiming it is the failure mode. The interpretive elements of criminal law do not compile and are not meant to. Whether a response was proportionate, what counts as a present attack at the margin, these carry an evaluative residue that belongs to judgment, and the honest design surfaces them for escalation rather than pretending to resolve them. The strength of the approach is knowing which part of the law compiles and which does not. The objective definition of the prohibited act compiles. The judicial evaluation around its edges does not. An operome holds the first and flags the second.

This is not machine ethics, and it is not a list of laws read to a robot in the hope it behaves. It is the same thing we run in production in capital markets today, applied to a different corpus. Compile the operative rules from an authoritative source. Enforce them before the action. Trace every decision to the clause. In a bond issuance the source is a prospectus and a regulation. For an agent that must not cause harm, the source can be the objective definitions a legal code has already written, with its exceptions. The labs reached for a trained disposition and left those definitions on the table. They were the most precise statement of the rule available, sitting in the statute the whole time.

The model layer will turn over many times in the next decade. The rules a system must follow, the ones written in contracts, regulations, and codes, will not. The companies that compile the part that stays are building the layer everything else runs on.

Explore the corpus →Repository →Read the methodology →

Released as a first discussion draft. The review is the point.

Sources

^ Zscaler ThreatLabz, “Anthropic Claude Code Leak”, analysis of the 31 March 2026 source-map exposure in npm package @anthropic-ai/claude-code v2.1.88. https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak
^ “Inside Claude Source Code Leak”, Blockchain Council, reporting Anthropic’s statement that the exposure was a release packaging issue caused by human error, not a security breach, with no customer data or credentials exposed. https://www.blockchain-council.org/claude-ai/inside-claude-source-code-leak-technical-takeaways-llm-developers-prompt-engineers/
^ Blake Crosley, “What the Claude Code Source Leak Reveals”, on multi-agent coordination implemented as system-prompt instructions. https://blakecrosley.com/blog/claude-code-source-leak
^ Sabrina Ramonov, “Comprehensive Analysis of Claude Code Source Leak”, on context compaction not treating file content as untrusted. https://www.sabrina.dev/p/claude-code-source-leak-analysis
^ Anthropic, “Configure permissions”, Claude Code documentation: “Permission rules are enforced by Claude Code, not by the model.” https://code.claude.com/docs/en/permissions
^ Anthropic, Claude Code permissions documentation, on deny-ask-allow precedence and fail-closed default. https://code.claude.com/docs/en/permissions
^ Claude Code source-leak analysis, on the bash-security module’s twenty-three numbered checks. https://claudefa.st/blog/guide/mechanics/claude-code-source-leak
^ OpenAI, “Sandbox”, Codex documentation: “you aren’t just trusting the agent’s intentions; you are trusting that the agent is operating inside enforced limits.” https://developers.openai.com/codex/concepts/sandboxing
^ OpenAI, “Agent approvals & security”, Codex documentation, on sandboxing, command-prefix rules, and approval for destructive tool calls. https://developers.openai.com/codex/agent-approvals-security
^ xAI, “Tools Overview”, Grok documentation: “Function calling lets you define your own tools that the model can request, giving you full control over what happens when they’re invoked.” https://docs.x.ai/docs/guides/tools/overview
^ Mistral AI, “Moderation & Guardrailing”, documentation on the classifier-based guardrail and input moderation before the request reaches the model. https://docs.mistral.ai/studio-api/conversations/moderation
^ Mistral AI, moderation documentation and model card for mistral-moderation-2603, on policy categories, custom thresholds, the block action, and fail-closed behaviour. https://docs.mistral.ai/studio-api/conversations/moderation
^ Yuntao Bai et al., “Constitutional AI: Harmlessness from AI Feedback”, Anthropic, 2022. https://arxiv.org/abs/2212.08073
^ On business rule management systems and expert systems: Drools, IBM Operational Decision Manager, and Pega are long-standing production rule engines.
^ Strafgesetzbuch (StGB) section 223 (Körperverletzung / bodily harm). Official English translation. https://www.gesetze-im-internet.de/englisch_stgb/
^ Strafgesetzbuch (StGB) section 242 (Diebstahl / theft).
^ Strafgesetzbuch (StGB) sections 211 and 212 (Mord and Totschlag / murder and manslaughter).
^ Strafgesetzbuch (StGB) section 32 (Notwehr / self-defence).
^ Dario Amodei, “Policy on the AI Exponential”, June 2026, Section 4 on accountability mechanisms for autonomous systems. https://darioamodei.com/post/policy-on-the-ai-exponential

Read on synapselayer.ai