an entry for the Sable thread contest

Sable,
explained
out loud.

Agents leak what they are given and spend money nobody can audit. Sable Network closes both: sealed on the way in, bounded before the call, signed on the way out.

Lisa is one of those agents — a voice receptionist running in production, eight languages, unsupervised. Everything Sable protects against, she does for a living. So ask her, not me.

For this contest she answers in English only. The other seven stay at work.

signed on the way outsealing…
"v": 1,
"content_fingerprint": "a1b2c3d4…"   ← not the content
"model": "sable-confidential-qwen3.6-35b"
"privacy_tier": "confidential"
"response_bound": true
"cost_micro_usd": 2140
"logging": "metadata-only"
secp256k1 · verifiable by anyone, including against them

Two ways an agent fails you

Both of them happen while you are asleep.

She tells everyone everything

A human asking a model discloses a question. My agent discloses the caller's name, their number, what they want, my pricing, my calendar — on every call, as a condition of working. That stream lands in someone's logs.

She spends money unattended

She can loop. She can be talked into an expensive detour by whoever is on the line. And when the invoice arrives, nobody can say what ran, on what, or for how much.

Sable's answer is that these are the same layer, because delegation is only safe when the delegate can't leak what you gave it and you can bound what it does. Engineering problems, not policy problems.

What happens to a caller's words

The order matters more than any single step.

01Sealed on arrival AES-256-GCM, before any routing decision
02Budget held first over the cap → refused before anything upstream runs
03Opened once, in one frame decrypted immediately before the call, then gone
04Metered and signed one metadata row; the portal cannot show a prompt

The last one is the part I keep re-reading. Their portal doesn't withhold your prompt — it has nowhere to put one. No column exists that could hold it. A breach, a subpoena or a curious engineer all find the same thing: metadata.

The moon answers

Sable's mark, Lisa's voice. She has read the whitepaper v2.0 — including the part listing what isn't built. Tap the moon and talk to her. English for this one.

Things worth asking her

  1. Why is my prompt sealed before you even know where to send it?
  2. What exactly do you keep about my request — and what can't you keep?
  3. What is a signed receipt, and why should I trust it more than your word?
  4. What happens if the confidential hardware fails verification?
  5. My agent spawns sub-agents. How do I stop one from draining my balance?
  6. What is Sable not able to do yet? Be honest.

The last one is the test. She'll tell you the host can still read sandbox code, and that no third-party machine serves traffic — because their own paper says so first.

The page I didn't expect

Their whitepaper lists its own holes. In the marketing document.

builtSealed ingress, metadata-only persistence
builtSigned receipts, publicly verifiable
builtTDX attestation — fails closed, never downgrades
not yetConfidential sandboxes: the host can still read your code
not yetThird-party operators — zero machines but theirs serve traffic
neverToken-settled compute or token-gated access
They won't call themselves a marketplace or decentralized until independent operators actually serve real work — because an exchange with no sellers is the most common artefact in this industry. Sable Network, whitepaper v2.0, §11

Anyone can promise privacy. Publishing the list of things you haven't done yet is the expensive kind of honesty, and it's the reason this is the layer I'd hand my agent to.