The article discusses the risk of AI models inferring missing data in agent systems, potentially leading to unauthorized executions, and proposes separating decision authority from models to ensure only explicitly declared instructions are followed.
Taking Definition and Verdict Authority Out of the Model — declare, judge, record, execute What agents do today: transfer( amount: 500.00 USD to_account: 110-234-5678 ← the model filled this in ) Every argument is present and correctly typed, so the schema check passes. Nobody ever declared where that account number had to come from. What the gate records instead: json { "slots": [ {"slot_id": "to_account", "status": "unknown", "route": "ask_user"} ], "unknown_count": 1 } Executions get logged; verdicts don't. The log keeps the tool and the final arguments, but not where each value came from or which conditions were checked. When the same instruction produces a different outcome, you can't tell afterward whether a value was looked up or invented. Blocked runs aren't logged at all, so what got filtered out is lost. A gate that records its verdict — every slot's state and source, and the runs that never executed — turns that into data you can count. We often attribute the danger of AI to hallucination or faulty reasoning. But there is a more fundamental problem. The model does not stop when it does not know. It fills the blank itself. If a value is missing, it infers the value. → Incorrect execution If a condition is missing, it assumes the condition. → Execution without instruction If the intent is missing, it decides the intent. → Different execution / execution without instruction All three are the same problem. The model is an engine that fills blanks. This is not a defect. It is trained behavior. Prohibition prompts or better model performance alone will not remove it. The model distorts the user's instruction and then executes with confidence. Confidence expands the scope. A tool will execute as long as its required inputs are satisfied. This is not a problem of the future. It is happening everywhere, right now. And solving it does not necessarily require a smarter AI. Separate both what must be decided and the verdict from the AI. Move the decision of what must be verified outside the model. Move the verdict on whether it has been verified outside the model, too. The model can still do the work. It asks the user, retrieves information, and prepares what is needed for execution. Rules are declared outside the model as checklists. Code performs the verification and records the verdict. Execution only reads the recorded result. This takes back the authority the model has been filling in because nobody declared it. Better model performance increases capability. If decision authority remains with the model, that added capability widens its reach into deciding what was never declared. If authority sits outside the model, both the decision and the responsibility remain with humans. What this structure does is stop guesses from becoming execution. The goal is not to execute the model's judgment, but to execute exactly what the user has explicitly declared. The detailed design is in the specification, and the reference implementation is in the repository. The specification is complete; the reference implementation is a skeleton, not a library. No production use yet.
The article discusses the principle that AI agents should not self-authorize actions and explores where to draw the line in allowing models to make decisions independently, emphasizing external controls like approval systems and policies.
The article discusses the safety risks for those building AI agents, highlighting that experts may overtrust models in their domain while being cautious in others due to unknown-unknowns.
The article discusses trust boundaries in AI agent systems where an LLM plans an executable DAG of agents, highlighting challenges in validating plans and ensuring safety through human approval and per-agent permissions.
The article proposes that to address the lack of explainability in AI agent mistakes, control mechanisms should be moved outside the black-box model, using predefined checks and logging for effective debugging and oversight.
This article argues that the AI safety debate is misdirected, focusing on model alignment and internal controls instead of the critical boundary: external admission authority over agent execution. It warns that systems capable of self-authorizing high-impact actions (e.g., deploying code, moving money) pose a fundamental risk that logging and monitoring cannot mitigate.