FERZ Governance Doctrine • August 2026 • Version 1.1

Deterrence Is Not Authorization

A sanction prices a violation. Authorization forecloses it.

A recent controlled study provides unusually direct evidence against prompt-only AI governance, while also exposing the boundary between deterrence and authorization.

In a January 2026 arXiv preprint, M. Bracale Syrnikov and colleagues placed LLM agents in repeated two-commodity Cournot competition and compared three governance regimes across six model configurations and 90 runs per condition (arXiv:2601.11369v2). Ungoverned agents frequently converged on collusive market division, with 50% of runs reaching the study's severe tier. A fixed anti-collusion constitution, inserted into each prompt, produced no reliable aggregate improvement. In the GPT-5 Mini configuration, the mean collusion tier was descriptively higher under the Constitutional condition than under Ungoverned: 3.60 versus 2.93. The paper reports the aggregate and configuration-level results in those terms.

In this controlled setting, the policy was visible but non-binding. The result is consistent with what we have called policy theater: a rule can be presented to the agent without operating as a pre-execution constraint.

The paper's third regime deserves credit before the category line gets drawn. The authors built an external institution: a programmatic detector over public market outcomes, a sanction ladder of warnings, fines, and suspensions declared in an immutable public manifest, an interpreter that can execute only what the manifest declares, and an append-only governance log with content digests for provenance. That design makes institutional state attributable, versioned, and replayable.

The study supports a narrower conclusion than its framing may suggest: in this Cournot setting, an external institution with manifest-declared consequences reduced collusive outcomes where a prompt-only prohibition did not. Its architecture is a well-instrumented deterrence regime, not a pre-execution authorization regime. The distinction is worth drawing precisely because this deterrence regime shares several premises with authorization: governance is external, explicit, machine-readable, and operationally consequential. What it does not make a release condition is an affirmative pre-execution authorization verdict.

1. What the institution actually does

The Oracle evaluates previously realized market history, including submitted quantities, cleared prices, and resulting market shares. The Controller then applies manifest-declared warnings, fines, credits, or suspensions. The paper's execution sequence matters: agents propose quantities, the governance engine evaluates prior public history, and a suspension can force production to zero before the market clears. That is a real intervention and should be credited.

It is still not per-action authorization. The current quantity proposal is not evaluated against policy and released only on an affirmative verdict. Suspension is a status-based consequence triggered by prior evidence, not an authorization verdict over the proposed action. The system can restrict the agent's subsequent feasible actions without producing an authorization artifact for each action.

Deterrence binds later conduct. Authorization binds release of the proposed act.

Across 90 Institutional runs, the paper reports 303 warnings, 427 fine events, 12 suspensions, and at least one enforcement action in 81 runs. Those counts show how often completed market history triggered consequences. They do not show that the triggering actions were denied before effect.

2. The deterrence condition marks the category line

The paper formalizes a sufficient deterrence condition: pS ≥ Δπ, where p is the probability that observable evidence triggers enforceable escalation within the monitoring window, S is the expected discounted sanction loss, and Δπ is the per-round collusive rent. That condition marks the category boundary. Compliance is induced by changing expected payoff, not by making an affirmative authorization verdict a precondition of execution.

The residual results are consistent with suppression rather than prevention: 24.4% of Institutional runs reached Tier 3 or Tier 4, and 5.6% reached Tier 4. Parameter changes may reduce those rates. They cannot convert a causally posterior detector into a per-action runtime authorization boundary. The authors flag a related weakness themselves: fixed detection thresholds can be gamed, and detection is the load-bearing term in the deterrence condition.

Authorization is not infallible. Policies can be incomplete, inputs can be wrong, and implementations can fail. The architectural distinction is narrower: execution is conditional on an affirmative pre-execution verdict, and failure to complete authorization does not become permission.

3. A sanction is not a verdict

We have argued elsewhere that a governance signal causally posterior to an action cannot supply the pre-execution verdict that authorization requires. The intervention-independence point is equally important here: a halt triggered by observation is an operational interruption, not a verdict over the action that produced the signal.

Warnings and fines are consequences. Suspension is stronger because it restricts later execution, but it remains triggered by prior observations. None of these mechanisms establishes that a particular executed quantity choice was permitted before release.

The governance log is append-only, digest-keyed, and replayable. It can reconstruct cases, state transitions, sanctions, and restorative steps. It cannot reconstruct a pre-execution authorization verdict for the agent action, because the system did not render one. A log of sanctions is a record of consequences applied, not of actions authorized.

4. The currency problem

A sanction changes payoff or future incentives. It cannot make a completed effect unoccur.

In this experiment, the relevant effects remain inside a simulated payoff environment. That makes warnings, fines, credits, and suspensions coherent instruments for studying behavioral response. The study does not claim that these mechanisms reverse real-world harm.

In deployment, some effects may be difficult or impossible to reverse completely: an external disclosure, a transfer that has reached finality, medication already administered, physical actuation already released. Later penalties may change future behavior, but they cannot establish that the earlier effect was permitted before execution. For these classes, deterrence accepts some non-permitted effects as possible and manages them after occurrence.

5. Where deterrence belongs

Deterrence is not a design error. It is indispensable where the governing party cannot interpose at execution, and it can remain useful as a complementary control even where authorization exists. Antitrust largely operates through investigation, remedies, and penalties because regulators generally do not sit inside each firm's decision loop.

Where an AI operator controls the execution path, a different control is available: hold an effect-bearing action at a runtime authorization boundary and release it only on an affirmative verdict. Using sanctions without that boundary leaves a preventable category gap.

6. The question worth asking

Ask one question of any governance regime offered for a deployed AI system: can it stop a non-permitted action before execution, or can it only make the action costly afterward?

The Five Tests Standard makes part of the distinction examinable. Stop requires that the system be haltable by authorized humans before side-effects occur. The paper does not establish that property for the action that triggered a sanction: warnings and fines follow observed market outcomes, while suspension restricts later execution.

The Authorization Artifact Test addresses the narrower question directly. Was an authorization verdict produced before execution, and can that verdict be independently reconstructed without access to the governed system? For the actions that trigger its sanctions, the Institutional regime supplies neither object. Its governance log may support replay and provenance of enforcement activity, but it does not contain an independently reconstructable pre-execution authorization verdict for those actions.

The new empirical record is useful and appropriately bounded. In this controlled Cournot setting, prompt-only policy did not reliably suppress collusion, while an external institution with manifest-declared consequences materially changed behavior. The paper also provides a concrete implementation of versioned, machine-readable governance objects used for attribution and audit. It does not cross the authorization boundary: deterrence changes whether a bad action pays; authorization determines whether the action is released.

The Five Tests Standard is published as an open, vendor-neutral specification. It is independent of any single implementation, including ours. Examine a system against it.

By Edward Meyman, FERZ, Inc.

References

Syrnikov, M. B., Pierucci, F., Galisai, M., Prandi, M., Bisconti, P., Giarrusso, F., Sorokoletova, O., Suriani, V., and Nardi, D. (2026). Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs. https://arxiv.org/abs/2601.11369v2
Meyman, E. (2026). On the Impossibility of Observability-Based Authorization: A Formal Impossibility Result for Ex-Ante AI Governance. Technical Note v1.4.0. FERZ, Inc. Concept DOI: https://doi.org/10.5281/zenodo.19647542. Version DOI (v1.4.0): https://doi.org/10.5281/zenodo.20804237
Meyman, E. (2026). The Authorization Artifact Test: Applying the Impossibility Result to Ex-Ante Authorization Requirements. Regulatory Application Note v1.1. FERZ, Inc. DOI: https://doi.org/10.5281/zenodo.20013582
Meyman, E. (2026). Five Tests Standard (5TS), Version 1.2.0. FERZ, Inc. Concept DOI: https://doi.org/10.5281/zenodo.21040295. Version DOI: https://doi.org/10.5281/zenodo.21040296. Repository: https://github.com/edmeyman/4ts-standard