Architecting Authority, Refusal, and Mission-Bounded Autonomy
Constitutional Agency Beyond Guardrails Abstract The prevailing language of AI safety was largely developed for systems that answer. Such systems receive a prompt, generate an output, and are judged by what they say, display, recommend, or produce. Their risks are addressed through filters, prohibitions, instruction hierarchies, access controls, and other forms of external constraint. These mechanisms remain necessary, but they no longer describe the full problem. Agentic systems do not merely generate responses. They interpret assignments, construct subgoals, select tools, access data, delegate tasks, consume resources, and initiate actions whose consequences may persist beyond the conversation in which they began. Once assistance becomes delegated power, the decisive question is no longer only what the system must not do. It is who may authorize the system to act, how far that authority extends, when obedience becomes illegitimate, and under what conditions control must r...