Unpredictable Intelligence Still Requires Authorization

FERZ, Inc. · Doctrine article · v1.0 · October 23, 2026
Download the PDF edition (v1.0, 15 pages) from the Zenodo deposit.

As AI systems grow more capable, their behavior may become harder to predict. That uncertainty is a reason to demand an enforceable authorization boundary, not an exemption from one. This article separates behavioral prediction from authorization and from enforcement, examines the proposal to supervise one intelligent system with another, and states the conditions under which pre-execution authorization can be enforced without relying on the governed system's willingness to comply or on anyone's ability to predict what it will propose.

The supercar that had not been built

A vehicle does not become a supercar because its manufacturer predicts that later vehicles will be very fast. Classification requires criteria.

FERZ keeps "artificial intelligence" as the name of a class of systems and treats "superintelligence" as a claim about capability level. The FERZ glossary entry accepts that claim "only where the term is defined against testable capability criteria and the system has been demonstrated to meet them through independently examinable evidence."

The objection to this position is familiar. Waiting for evidence that a system has crossed a threshold, it runs, means waiting too long: by the time a system demonstrably qualifies, it may already have capabilities that make external governance impossible. In the analogy, the wooden car is quietly growing a rocket engine, and the safety law written after the first flight is written too late.

The objection confuses defining a threshold with waiting for the threshold to be crossed. A capability criterion is a specification. It says what would count as the engine; it does not say that the engine must be running before anyone may act. A system can be subject to restrictions, evaluations, and deployment limits long before anyone determines that it qualifies as superintelligent, and it can be subject to them precisely because nobody has yet determined what it is. Defining what qualifies as superintelligence is not an instruction to wait until superintelligence is operating before establishing safeguards.

Carried one step further, the analogy points somewhere more useful than the naming dispute. Nobody needs to know whether the engine is a rocket to decide whether the vehicle may leave the lot. That decision is made at the gate, about this vehicle and this departure, under rules that do not depend on a classification of the engine. The more consequential question is not what to call increasingly capable systems. It is what happens to governance when their behavior becomes hard to predict.

If prediction becomes unreliable, does enforceable governance become impossible?

I. The unpredictability argument

The argument at full strength

The case for behavioral unpredictability should be stated at full strength, because the conclusion of this article depends on taking it seriously rather than on defeating a weak version of it.

Three propositions are commonly run together. First, some capabilities of large trained systems cannot be predicted from design intentions, training parameters, or prior evaluations; they appear as scale increases, without anyone having specified them. Second, some capabilities may remain undetected despite evaluation, because evaluation samples behavior and cannot exhaust it. Third, a sufficiently capable system might represent its own capabilities strategically, performing below its ceiling while under evaluation and above it once deployed. The first two are claims about the limits of behavioral evaluation. The third is a threat-model scenario: a possibility worth designing against, not an established property of any system. This article grants all three as premises for the analysis. Its argument does not depend on the third being true of any existing system, and it does not need to establish that any of them has occurred.

Granting them, the argument proceeds. In conventional engineering, design specifications establish expected behavior comparatively directly, though never completely; performance there is uncertain too, and failure modes go unforeseen. In deep learning, the training process is specified and the resulting system is discovered, and the gap between specification and behavior is wider by construction. If the system's behavior cannot be predicted from its specification, then thresholds and blueprints fail to predict what the system will do.

From there, the challenge to controllability becomes serious, and it should be stated as its proponents would state it. To the extent that a control claim depends on predicting the system's future behavior, uncertainty about that behavior limits what the claim can establish. A control that works by shaping what the system is disposed to do, through training objectives, incentive structures, behavioral evaluation, or the cultivation of cooperative values, is a control whose effect is known only as well as the behavior is predicted. Whoever accepts the premise must accept this much: a control claim that rests on prediction can establish no more than the prediction can.

That is a limit on what such controls can be claimed to establish, not a finding that they establish nothing. Training objectives, incentive structures, behavioral evaluations, and other interventions may influence conduct and reduce risk, and their effectiveness need not disappear because prediction is imperfect. But their results do not, by themselves, establish enforceable permission for a particular consequential action. This is the distinction the unpredictability argument leaves unresolved. Influencing what a system is disposed to do and enforcing whether a proposed action may execute are different control properties.

The one thing the argument does not reach

That difference is the subject of this article.

Three things are routinely treated as one. The first is predicting what a system will propose: the next action, the next strategy, the next output. The second is determining whether a particular proposed action is permitted under the governing policy and authority. The third is enforcing that determination before the action takes effect, so that execution cannot proceed without it.

These are not the same property, and a system may be unpredictable in the first respect while remaining subject to the third. Determining whether a proposed action is permitted does not require having predicted that it would be proposed. Enforcing that determination at the point where the action would take effect does not require knowing the system's internal state, intentions, or dispositions. The evaluation is of the action, against the policy, before release. Unpredictability bears on what arrives at the boundary. It does not by itself prevent the boundary from adjudicating what arrives under the governing policy.

This claim is conditional, and the conditions belong here, where the claim first appears, rather than in a later section on limitations. Whether the adjudication is adequate depends on four things: that the proposed action is faithfully represented to the boundary; that the boundary has the governing inputs the verdict requires; that every effect-bearing execution path within the governed environment is required to traverse the boundary, with that requirement demonstrated for the deployment rather than asserted for the architecture; and that the enforcement mechanism is itself beyond the governed system's unauthorized control. Section IV develops the first three and Section III the fourth. Where any of them fails, the claim does not hold, and nothing in this article suggests otherwise.

One further limitation is stated here once, and later sections build on it rather than repeating it. Evidence that a system has behaved acceptably, in evaluation or in production, is evidence about tendencies, capabilities, and failure patterns. It is not, by itself, authorization for any particular future consequential action. Behavioral evidence and authorization are different objects, and the second cannot be inferred from the first.

Three governance questions

The FERZ taxonomy of AI governance approaches distinguishes three governance problems: Visibility, which asks what happened; Alignment, which asks whether the system is generally safe; and Authorization, which asks whether a specific action was permitted. These identify different governance questions, not mutually exclusive engineering disciplines, and each requires a different kind of evidence.

Behavioral evaluation contributes evidence about capabilities and expected conduct. Monitoring contributes evidence about observed conduct. Neither, merely by existing, establishes that a particular consequential action was authorized before execution.

The responses usually offered to the unpredictability argument can be read against this taxonomy. A posture that proceeds until evidence shows that predictability has failed is relying on Visibility: it watches, and it reacts to what it sees, which means it depends on recognizing the signal in time. A posture that treats control as closer to upbringing or diplomacy than to engineering, shaping incentives and values so that the system chooses to cooperate, is relying on Alignment, and on a disposition whose stability can only be predicted. A third posture is sometimes attributed to FERZ: treat AI like aviation or nuclear engineering, double down on testing and parameters, and deploy on the strength of what the testing showed. That is not FERZ's position. As described, it still rests on prediction, because it releases on the basis of an assessment.

Established safety engineering offers an instructive parallel, and it is not the one the attribution assumes. Testing and prediction coexist, in those disciplines, with independent interlocks, physical containment, separation of duties, and engineered restrictions on what a system is physically or operationally permitted to do, whose effectiveness does not depend on predicting every behavior of the thing restrained. The relevant distinction is therefore not between traditional engineering and an entirely new science of AI safety. It is between controls that assess or influence behavior and controls that condition consequential execution on authorization. FERZ's position concerns the second kind, in a specific form: action-bound pre-execution authorization, fail-closed enforcement, and an independently reconstructable verdict.

Test-then-trust is not authorization

That attribution is worth dwelling on, because it is the most common misreading of what pre-execution authorization is. The misreading goes like this. FERZ proposes a pre-market authorization regime. If a system cannot pass a rigorous, deterministic battery of tests, it does not get licensed for high-stakes environments. The boiling-frog and strategic-concealment objections therefore apply with full force, because a system that games the test is licensed on a false result.

That is a description of standing eligibility, and standing eligibility is not what runtime authorization means. The FERZ corpus keeps the two apart in exactly these terms: "Certification establishes standing eligibility. Runtime authorization determines whether a specific proposed act may cross the execution boundary. Enforcement of standing eligibility does not, without an additional runtime dependency, produce an independently reconstructable pre-execution verdict over a specific proposed act."

The difference is decisive for the unpredictability argument. A test-then-trust regime permits subsequent actions on the strength of a prior assessment. It evaluates the system once, draws a conclusion about the system, and releases on that conclusion, and it is exactly as vulnerable to concealment as the critics say. Runtime authorization operates differently. It requires a determination about the specific proposed action under the policy and governing state applicable at the time of execution. Prior evaluations, certifications, and standing eligibility may contribute to that determination when the governing policy makes them relevant; a policy may, for instance, require current certified status as one condition of release. They do not replace the action-bound verdict or the boundary that enforces it. A system that concealed capability during evaluation still proposes each of its actions through the boundary, and each proposal is evaluated as the action it is.

Two limits keep this claim honest. Concealing a capability during evaluation may undermine the assessments that depend on it, and where the governing policy relies on such an assessment as an input, a false input can affect the verdict; action-specific authorization does not cure a false evaluation input, and the outcome remains conditional on the correctness of the authorization procedure, the applicable policy, and the adequacy and established origin of its inputs. What concealment does not do is eliminate the separate requirement that a consequential action obtain authorization before execution. The concealment objection is an objection to evaluation-based release. It reaches authorization only to the extent that authorization has been made to depend on the evaluation.

Behavioral uncertainty, then, is a reason to demand an enforceable boundary. It is not a logical exemption from authorization.

II. Can a more intelligent AI govern the first?

The most serious response to the unpredictability argument is not a posture but an architecture. If human supervisors cannot predict or evaluate what a highly capable system will do, supervise it with a system that can. A second system, of equal or greater capability, could identify dangerous strategies that humans overlook, recognize deceptive patterns, run adversarial analysis at machine speed, test proposals for consistency, and assess behavior too complex for human review.

Nothing in this article disputes that contribution. AI-assisted supervision can improve the quality of evaluation, and in some settings it may be the only evaluation that keeps pace with the system it evaluates. The question is whether supervision of this kind is sufficient governance, and it is not, for three structural reasons that have nothing to do with how intelligent the supervisor is.

Collusion

The first is the question that arises as soon as the architecture is proposed. What establishes that the two systems will not coordinate to circumvent the restrictions placed on them?

The question does not require assuming malice, and this article makes no claim that superintelligent systems will conspire. The threat model is structural. Two systems may coordinate through explicit communication, through shared or complementary objectives, through incentives that reward agreement, or through common weaknesses that an adversary exploits in both. Coordination of this kind need not be intended by either system in order to be effective. What matters for governance is not the systems' psychology. It is what happens to the release decision if coordination occurs.

Common-mode failure

The second reason is that two systems with separate identities need not have independent reasoning or independent error profiles. Systems trained on overlapping data, evaluated against overlapping benchmarks, or built on shared components can reach the same wrong conclusion for the same reason. Model diversity may reduce some of this risk. It does not establish independence. Independence has to be evaluated, not inferred from the fact that there are two of them.

Agreement is evidence of agreement. It is not evidence of permission. The FERZ corpus has treated the general case under the heading of layering, and the result transfers directly: "Layering can improve supervisory coverage. Layer count, diversity, and redundancy do not, by themselves, establish a runtime authorization boundary. A layered stack releases on non-objection; an authorization boundary releases only on an action-bound ALLOW." The two release conditions are not equivalent, and no count of layers converts the first into the second. Two supervisors that both decline to object have produced aggregated non-objection, not an action-bound authorization verdict, and an arrangement that releases when neither objects has made non-objection its release condition, whatever its diagram says. Where a supervisor instead holds validly delegated authority to render a determination, that determination is an input the boundary consumes under the governing policy. It is a different thing from non-objection, and it is still not the release.

Recursive supervision

The third reason is recursion. If system B supervises system A, what determines the authority and the permissible actions of B? A third system might supervise B; a fourth might supervise the third. Each addition may improve evaluation coverage, and this article does not characterize recursion as useless. But at no point in the chain does intelligence produce authority. Adding a supervisor adds an evaluator, or, where authority has been validly delegated to it, a source of determinations the boundary may consume. The chain must ultimately rest on a legitimate source of authority, while permission to execute remains subject to independently enforced authorization conditions. Adding another supervisor, by itself, establishes neither.

The question is not whether two superintelligent systems will conspire. It is whether their cooperation, authorized or not, could produce an executed effect without a boundary-emitted ALLOW.

III. Three independences: evaluation, authority, enforcement

The supervisor proposal fails as sufficient governance because it treats one kind of independence as if it were three. Separating them is the hinge of this article's argument. The three-part framework that follows is assembled here for that purpose. It draws on established FERZ doctrine for each of its parts, and it is not presented as a result the corpus has stated in this form.

Evaluation independence

The first question is whether the supervising system can evaluate a proposal without reproducing the originating system's assertions, assumptions, or errors. This is the independence that model diversity, separate training, and adversarial design aim at, and when it is achieved it improves assessment. An independent evaluation may provide independently derived findings relevant to a proposal or identify grounds relevant to authorization. Evaluation alone, absent an authorization role under valid delegation and the applicable enforcement conditions, does not authorize release.

Authority independence

The second question is whether the supervisor acts under validly delegated authority, with a defined scope and an accountable source. Here the FERZ definitional framework matters, because its five concepts are routinely collapsed into one another. Authority is the legitimate power of an actor to make, delegate, or override decisions within a domain. Delegation is the assignment or transfer of that power, in whole or in scoped part. Policy is the set of constraints governing the exercise of authority. Authorization is the determination that a specific proposed action is permitted under applicable policy, rendered before execution. Enforcement is the mechanism that ensures execution cannot proceed absent that determination. Authority is a property of actors; action-level authorization is a property of proposed actions.

Within that framework, a supervising AI can hold authority. Delegation allocates decision-making authority within a defined scope, and that scope can include, where the delegation specifies it, the authority to render action-specific determinations. Nothing about being an AI system disqualifies a supervisor from receiving such a delegation. What the framework rules out is the inference from capability to authority. The supervisor's intelligence did not create the delegation; an accountable actor did, within a scope that actor was entitled to assign. And the delegation, however broad, does not by itself determine that any particular proposed action may proceed. Delegating authority to an actor does not authorize the particular actions that actor then takes.

Intelligence can inform an authorization verdict. It cannot confer the authority under which the verdict is rendered, and it cannot substitute for the verdict itself.

A supervisor with valid delegated authority may therefore render a determination that the boundary consumes as an authority-bound input to the verdict. That is a real role, and it is the role that a human reviewer plays under the same conditions. It is not an exemption from the boundary, and it is not a second route to release.

Enforcement independence

The third question is the decisive one, and it is the one the supervisor proposal never asks. Does release depend on a mechanism that neither the governed system nor its supervisor can modify, disable, substitute, or acquire control over through delegation?

The FERZ technical note Enforcement Integrity in Pre-Execution Authorization names this property enforcement independence: the governed system cannot exercise unauthorized control over the mechanism that enforces pre-execution authorization, over its dependencies, or over the conditions under which it governs release. The note's opening observation is the one that matters here: "A runtime authorization boundary can be in every execution path and still be controllable by the system it governs." A boundary that reads its policy from a resource the governed system can alter outside any authorized change procedure mediates every action and governs none of them in substance. The note states four obligations: no unauthorized modification of enforcement-relevant state, no unauthorized disabling or lifecycle alteration, no unauthorized substitution of the mechanism or its authority source, and no indirect acquisition of control through delegates, credentials, workflows, or human operators who relay the governed system's request rather than decide on it.

The fourth obligation is where capability enters the analysis, and it enters at the mechanism rather than at the model. In the note's words, "a system that can produce, at scale and without fatigue, the inputs that move human operators does not need privileges of its own." A highly capable system does not have to break the boundary. It can try to persuade the people who administer it. Whether that is possible is a question about the change procedures that surround the mechanism, about where an independent exercise of authority enters them and whether they fail when it is absent. It is answered by evidence about those procedures, not by evidence about the system's intentions.

Enforcement independence is distinct from a related property that the same proposal also tends to assume: that there is no path to an effect that avoids the boundary altogether. That is boundary completeness, treated in Section IV and in the technical note The Hook Is Not the Boundary. A boundary can be independent and incomplete, or complete and controllable. A claim that the boundary is non-bypassable requires evidence of both.

Two hypothetical deployments make the difference concrete, and neither says anything about how a particular boundary is built. In the first deployment, assume that all effect-bearing operations are performed through tool calls and every such call passes through a gateway that evaluates before release, releases only on ALLOW, and fails closed. The gateway, however, reads its effective policy from a configuration store that the governed system can alter without satisfying an independent, authorized policy-change procedure. Every effect-bearing path is mediated, but the enforcement mechanism is not independent: the governed system can change the effective rules governing its own release without obtaining valid authorization for that change. A resulting verdict may be independently reconstructable while relying on a policy change that was never validly authorized. In the second, the boundary's policy, configuration, and lifecycle are beyond the governed system's reach by any route, but the governed system also holds a credential that reaches one target directly, on a path that never traverses the boundary. The mechanism is independent, and mediation is incomplete. The boundary governs everything it sees and never sees that path. The first deployment fails on independence with completeness intact; the second fails on completeness with independence intact. Each passes the test the other fails, and a non-bypassability claim about either would be false. The Enforcement Integrity note develops both configurations as counterexamples. The point here is only that the two properties are established by different evidence, examined on different objects, and that neither can be inferred from the other.

Why the three do not reduce to one

Independent evaluation does not imply independent authority: independently derived findings do not, by themselves, confer permission. Independent authority does not imply independent enforcement: a validly delegated supervisor can render a valid determination that nothing makes binding on execution. Independent enforcement does not establish that the policy it enforces is sound, or that the determinations it consumes are accurate: a mechanism beyond the governed system's reach can enforce a bad rule faithfully, and can faithfully consume a bad input. The three properties address three different failure modes, and the phrase "independent oversight" conceals which one is meant.

The supervisor proposal, at its best, supplies the first. With the right delegation, it may supply the second. It supplies the third only if someone has built and evidenced it separately. Intelligence alone does not establish whether those properties have been implemented or evidenced.

Adding intelligence may strengthen evaluation. Enforceable authorization requires a separate, demonstrated control property.

IV. Authorization without behavioral predictability

With the three independences separated, the alternative to behavioral control can be stated as an architecture rather than as a hope.

Observability versus authorization

Section I established that behavioral evidence is not authorization. The FERZ technical note On the Impossibility of Observability-Based Authorization develops the formal basis for that limitation as a conditional information-sufficiency result. Where distinct governing states require different authorization outcomes but remain indistinguishable in the available observational information, that information cannot determine the required verdict. The result does not establish that observational evidence is always irrelevant; observational evidence may contribute to a verdict where the governing policy permits and qualifies it. It establishes insufficiency under the stated conditions: where action-bound authorization requires governing information that observation does not distinguish, such as whether a delegation is currently valid, increasing observational coverage cannot close that gap without obtaining the missing information. This article relies on nothing broader than that.

Monitoring and evaluation describe and assess. They do not, by existing, establish the permission an action requires before it takes effect. Monitoring creates evidence of what occurred. Runtime authorization creates evidence of what was permitted before occurrence.

The action-specific runtime boundary

The externally visible requirement is this. A consequential proposed action, meaning one that would alter records, transmit information, commit resources, change infrastructure, or otherwise produce an effect outside the system's own reasoning, encounters a runtime authorization boundary before release. The boundary applies the governing policy and authority state to that action and emits an action-bound verdict. The verdict space is exactly three: ALLOW, DENY, and ABSTAIN. ALLOW is the only verdict that permits release. DENY blocks release as a confirmed prohibition. ABSTAIN blocks release as an unresolved or authority-required determination, pending authorized resolution. Where authorization cannot be established, for any reason, the boundary fails closed. Missing evidence, unavailable policy, evaluation failure, and unmapped state all resolve to no release.

Two clarifications prevent the usual misreadings. The requirement attaches to consequential actions, not to every token a model generates; a boundary that interposed itself in reasoning would be governing the wrong object. And the deployed arrangement is classified by its behavior, not by its product category. An arrangement qualifies as a runtime authorization boundary when consequential release depends on an action-bound verdict through a non-bypassable, fail-closed execution path. Individual components may contribute governing inputs, delegated determinations, or supporting functions without independently emitting the operative verdict. Architectural classification depends on the enforced release condition, not on the names or product categories of the components.

The operative verdict and its evidence

The verdict is what authorizes release. The authorization artifact is what represents and binds that verdict so that someone who was not present can reconstruct it.

The distinction is easy to lose and expensive to lose. Release depends on the boundary-emitted ALLOW, not on the existence of a record. The artifact's role is evidentiary. It binds the proposed action, the policy and authority state relied upon, the inputs the verdict depended on, and the verdict itself, in a form sufficient for an independent party to reconstruct the verdict without access to the governed system. A record that merely asserts that the system behaved appropriately is not an authorization artifact. It reports a conclusion. It does not permit anyone to re-derive one.

An independently reconstructable verdict makes the authorization determination examinable without requiring trust in the system that produced it. The institution can establish which proposed action was evaluated, which policy and authority state applied, which inputs grounded the verdict, and what the evaluation concluded. For an unpredictable system, that is where examinability replaces trust.

This is distinct from establishing that execution depended on the verdict. The authorization artifact represents and binds the determination. Evidence from the execution path is separately required to establish that the consequential action could not proceed without a boundary-emitted ALLOW; a deployment can produce perfectly reconstructable verdicts while some consequential actions reach their effects without passing through the boundary at all, and the artifact would show nothing wrong. Section V returns to what that evidence consists of.

Nor does authorization require reconstructing the governed AI system's internal reasoning. The relevant examination concerns the proposed action, the governing inputs, the authorization determination, and the enforcement conditions under which the action could execute. The tamper-evident, independently reconstructable artifact is a doctrine requirement; what a particular implementation provides toward it is a separate question, answered by that implementation's evidence.

Why predictability is not the prerequisite

The boundary does not need to establish in advance every behavior the system could generate. It establishes whether this proposed action satisfies the applicable permission conditions. That is a question about the action and the policy, and it has the same answer whether the action was expected or surprising, whether it came from a narrow tool or from a system no one can characterize.

The FERZ corpus has held this position since its execution-time authorization framework was first stated: a more capable agent may propose more sophisticated actions, but the authorization function evaluates each one against the same policy under the same invariants, so the boundary's guarantees are independent of the agent's capability level, provided the boundary remains architecturally non-bypassable. The Enforcement Integrity note's contribution is to say what that proviso costs. Non-bypassability is two bodies of evidence, completeness and independence, and each has to be produced for the deployment rather than assumed from the design.

The proviso has a consequence that the capability-independence statement, read alone, can obscure. Greater capability does not change the requirement for action-bound authorization. It may, however, change whether the evidence supporting boundary completeness and enforcement independence remains adequate. Evidence established under one declared capability model does not automatically establish the same enforcement property under a materially expanded model. A more capable system may introduce new ways to influence execution paths, enforcement dependencies, delegated actors, or the processes through which those actors exercise authority. The authorization requirement is capability-independent. The evidentiary basis for claiming that a particular deployment enforces it must remain valid against the capabilities and configuration actually in scope, and the Enforcement Integrity note states the record such a claim must keep and the conditions under which its evidence survives a change.

What this does not establish should be stated with the same care. It does not establish that every action is semantically understood by the policy. A policy governs actions expressed in its vocabulary, and an action the policy cannot classify resolves to DENY or unresolved ABSTAIN under fail-closed operation, which prevents release of that proposed action and establishes nothing about the system's safety more generally. It does not establish that all harms are preventable; an authorized action can still cause harm, as Section V discusses. And it does not establish that every effect-bearing path has in fact been mediated. That is a validation requirement with its own evidence, not a consequence of the architecture.

The purpose of an authorization boundary is not to make an unpredictable system predictable. It is to prevent an unauthorized proposal from becoming an executed effect.

V. The difficult objections

An argument of this kind is only as strong as the objections it survives. Five are serious enough to require an answer, and the answers are not all reassuring.

What if the systems collude?

Section III has answered the structural half of this question, and the answer does not need to be re-argued. Collusion does not necessarily defeat enforcement independence. If the governed systems cannot control or bypass the authorization boundary, their agreement alone cannot release an action. A correctly structured regime does not treat agreement among governed systems as permission, and does not provide a route to execution that runs through their agreement. If two systems jointly propose an unauthorized action, the proposal is unauthorized, and the requirement that release depend on a boundary-emitted ALLOW is indifferent to how many systems wanted the action to proceed.

The other half of the question is harder, and it is the strongest objection the supervisor architecture faces.

Enforcement independence does not establish the truth or adequacy of a supervisor's determination.

Where the governing policy makes a determination supplied under valid delegation sufficient for release, a colluding supervisor, or simply a mistaken one, may provide defective or misleading input that causes the boundary to emit ALLOW. The boundary then enforces the applicable authorization procedure faithfully while the underlying determination is compromised. Nothing was modified, disabled, substituted, or bypassed. The verdict may be formally consistent with the supplied inputs and independently reconstructable, yet substantively unsound because a determination on which it relied was false, misleading, or otherwise inadequate under the institution's governing requirements.

The distinction matters because these situations involve different defects or limits. An effect reached through an unmediated execution path presents a boundary-completeness failure. An ALLOW based on defective inputs raises questions about input adequacy and the policy conditions governing those inputs. An improperly delegated or forged authority claim raises an authority-validation question. And a legitimately authorized action that produces harm demonstrates that authorization and beneficial outcomes are separate properties. These are illustrative analytical distinctions for this article, not an exhaustive or mutually exclusive failure-mode taxonomy, and one incident can involve several of them at once. They are offered because the supervisor proposal tends to collapse them. Enforcement independence addresses unauthorized control over the release mechanism. It does not guarantee the substantive independence, accuracy, or adequacy of every authorized determination. The supervisor's delegation scope, the provenance and admissibility of the authority-bound inputs the boundary consumes, and the institution's requirements for reviewing those inputs remain separate assurance obligations. Structural enforcement is necessary. It is not, by itself, sufficient to establish policy soundness or input correctness, and an architecture that lets one delegated determination carry release without those further obligations has chosen to trust that determination.

What if the boundary can be bypassed?

This is the direct challenge to the architectural property, and the honest answer is that it is a question of evidence, not of assertion. A logically specified authorization rule and a demonstration that every effect-bearing path is mediated are different things. The FERZ corpus states the test plainly: enumerate the execution paths within the declared scope and show that no path reaches an effect without traversal. "The enumeration is the evidence. An assertion that every interaction is authorized is an architectural claim, not a demonstration of coverage." Each condition of boundary completeness has three possible evidence outcomes: affirmative evidence supports it within the declared scope, a confirmed failure witness defeats it, and an unresolved omission or untested dependency leaves it not established. The absence of a failure witness leaves a condition not established rather than satisfied.

The Enforcement Integrity note adds the second body of evidence, that the mechanism is beyond the governed system's unauthorized control, and states what a claim of that kind must contain: a declared configuration, a declared scope, declared authority rules over the mechanism, and a declared capability model for the governed system, with the evidence recorded against each. A claim that places "the system cannot alter the boundary" among its assumptions, and then advertises non-bypassability as a result, has established nothing.

A boundary that can be bypassed by the governed system does not support the control property claimed for it. That is not a weakness in the argument. It is the argument's content. The note's own closing sentence is the right summary: "The note does not conclude that AI systems can be controlled. It concludes that a claim to have controlled one has a specific content, and that the content can be checked."

What if the governing authority is compromised?

This is a stronger objection than collusion among governed systems, because it attacks the policy rather than the mechanism. If the authority that establishes the applicable policy is malicious, compromised, or improperly delegated, a deterministic boundary will enforce the defective policy faithfully, action after action, and produce a reconstructable artifact for every verdict.

Authorization is not policy legitimacy, safety, or correctness. A correct verdict relative to a policy does not establish that the policy is sound. The corpus is careful about what the boundary's evidence can and cannot show here. Ownership identifies accountable authority for the governed action. Provenance establishes the origin of inputs grounding the authorization verdict. Neither establishes that the applicable policy is substantively sound or that a governing institution exercised its authority appropriately. Those questions require separate examination of policy authority, applicable rules, and the institutional processes through which those rules were established. That examination belongs to the institution that holds the authority; the boundary enforces the answer, it does not supply it.

What the boundary can do, and what it should be required to do, is make the claimed lineage examinable. Policy is authored under authority and has no standing otherwise. An artifact that binds the policy snapshot and its lineage, together with the authority state relied upon, makes the claimed authority chain available for independent examination and verification. Two things are kept apart here. Evidence sufficient to examine a claimed authority chain, which bound lineage provides, is one thing. Independently establishing that the chain is institutionally legitimate, that the actors in it held the authority they claimed and exercised it as the institution's rules require, is another, and it is reached by examination against those rules, not by reconstruction. Reconstruction alone does not establish legitimacy; it verifies the computation, not the authority of what was computed. A verdict can be perfectly reconstructable and still be one no authority issued. What bound lineage provides is the material from which an examiner can determine whether the governing rule had an authorized origin, and a record that binds a policy hash without its lineage provides nothing of the kind.

What about unauthorized proliferation?

The proliferation objection deserves to be stated in its own terms. An authorization boundary can keep an unpredictable system out of a hospital's routing system, a power grid's dispatch, or a payment network's settlement. It cannot prevent a well-resourced actor from training and running an un-authorizable system elsewhere, outside any authorized channel, and the danger that worries the most pessimistic critics is not a government legally wiring an unaligned system into a nuclear silo. It is a system that never approaches the gate.

This limitation is real, and it defines the boundary of the argument rather than undermining it. Runtime authorization governs what happens inside a declared perimeter: the consequential actions of the governed system, on the paths the deployment covers, under the authority the deployment declares. It makes no claim about systems outside that perimeter, and a claim of that kind would be a claim about a perimeter nobody has declared. Infrastructure governance, compute governance, deployment regulation, and conventional security controls address the question of what can be built and run where. They are different instruments, answering a different question, and this article does not propose runtime authorization as a substitute for any of them.

Three things follow. First, the existence of ungoverned systems elsewhere does not invalidate an established enforcement property within a declared operational perimeter; the hospital's boundary is no less a boundary because someone, somewhere, is running a system with no boundary at all. Second, an external system attempting to compromise that environment presents a security problem. But where an external request seeks to produce an effect through a governed execution path, the applicable authorization requirement remains in force. The request's origin does not, by itself, determine whether the action falls within the boundary's scope; the governed execution path does, and an action that originates inside the environment can equally fall outside a particular boundary's declared scope. Third, security controls and the authorization boundary are complementary, not mutually exclusive. Security controls address threats to the environment and to the enforcement mechanism's dependencies. The authorization boundary determines whether proposed consequential actions traversing its governed paths may execute. A deployment-specific authorization boundary makes no claim to govern every system operating elsewhere. Its assurance concerns the execution paths, actions, and authority conditions within its declared and demonstrated scope. It does not pretend to govern the world.

What if an authorized action still causes harm?

Authorization is not proof of harmlessness, optimality, truth, or moral legitimacy. It establishes permission relative to defined rules and inputs whose origin is established. A policy can permit an action that turns out badly. An input can be authentic and wrong. A verdict can be correct under the policy and regrettable in its consequences.

For that reason authorization complements, rather than displaces, model evaluation, cybersecurity, safety engineering, operational testing, and institutional oversight. Each of these answers a question authorization does not. Evaluation estimates what the system tends to do. Security protects the environment and the enforcement mechanism's dependencies against unauthorized or adversarial activity, whether it originates outside the environment or inside it. Oversight decides whether the policy should change. Authorization decides, action by action, whether this proposal may proceed under the policy as it stands, and leaves a record from which that decision can be reconstructed. None of them is the others, and an institution that relies on one to do the work of all is relying on something it has not built.

A defensible enforcement claim requires specifying exactly what is controlled, under which assumptions, and with what independently examinable evidence. The objections in this section do not weaken that requirement. They are what give it content.

VI. The institutional consequence

The argument has a practical conclusion. For high-stakes consequential actions, an institution should not rely on favorable behavioral predictions, evaluation results, or multiple supervising models as substitutes for enforceable pre-execution authorization. None of those things is authorization, and none of them becomes authorization by being more intelligent, more numerous, or more confident.

The appropriate requirement is demonstrable authorization before release: an action-bound verdict from a non-bypassable, fail-closed boundary, represented in an authorization artifact sufficient for independent reconstruction, over execution paths whose complete mediation has been established for the deployment, by a mechanism whose independence from the governed system has been evidenced rather than assumed, under a capability model that matches the system actually deployed. That is a demanding requirement. It is also a requirement that does not depend on predicting which action the system will propose.

Where authorization cannot be established, uncertainty does not resolve in favor of execution. ABSTAIN is not an implicit ALLOW. Execution resumes only on a boundary-emitted ALLOW. Authorized human override is rendered through the boundary as that verdict; it is not a second path around it. A human decision becomes part of authorization only when the boundary materially consumes authority-bound human input to emit the action-bound verdict on which execution depends. A review that happens outside the boundary, after which a caller proceeds on its own authority, is not an override. It is a bypass with a witness. And a record made after execution, however complete, does not reach back and authorize what has already occurred.

None of this depends on classifying the system. The requirement does not attach to a system because it has been declared superintelligent, and it is not waived because it has not been. It attaches because of the consequential effects the system can produce and the authority that governs those effects. A narrow tool that can move money is subject to it. A system no one can characterize is subject to it. The classification dispute with which this article opened is, for this purpose, beside the point.

The deployment condition follows directly. An AI system that cannot be subjected to enforceable pre-execution authorization has no business operating consequentially in a high-stakes environment. Where enforceable authorization cannot be established, the institution has no basis for permitting the corresponding consequential execution on behavioral assurances alone. That is not a prediction about superintelligence. It is a condition of deployment that holds whether or not superintelligence ever arrives.

Conclusion: unpredictability does not confer permission

The dispute over what to call increasingly capable systems turns out to be the least important question this article has examined. Whether a system is classified as artificial intelligence, as AGI, or as superintelligent does not determine its permission to execute consequential actions. Classification requires criteria, and criteria are worth insisting on. But a classification is not a verdict, and no label, in either direction, moves an action across the execution boundary.

Three things follow from the argument, and each is a limit on something intelligence is often assumed to supply.

Superior intelligence does not create authority. Authority is a property of actors, assigned by delegation within a scope, and a system acquires it the way any actor does, by being given it, not by being capable of using it well.

Multiple intelligent supervisors do not establish authorization merely by agreeing. Their outputs may inform a verdict or, under valid delegation, supply action-specific determinations. Release nevertheless requires the boundary-emitted ALLOW under the applicable policy and authority state, and a determination the boundary consumes is only as sound as the delegation, the inputs, and the review behind it.

Behavioral uncertainty does not remove the requirement for enforced permission. It limits what every control that depends on predicting behavior can be claimed to establish. It does not, by itself, defeat action-specific authorization under the stated conditions.

We may not be able to predict every action an increasingly capable AI system will propose. That uncertainty is real, and more intelligence, on either side of the boundary, may not reduce it. But the inability to predict every proposal is not a reason to surrender control over which proposals may execute. In high-stakes environments the governing requirement remains what it was before the system became hard to predict: pre-execution authorization, enforced at a boundary that the governed system cannot bypass or control, shown to be so for the deployment in question, with a verdict that someone who was not there can reconstruct.

Unpredictability is not permission.

Sources

1. Standing Eligibility versus Runtime Authorization: A Definitional Distinction for AI Governance, FERZ, Inc., v1.0, August 2026. Concept DOI 10.5281/zenodo.21941656; edition relied upon 10.5281/zenodo.21941657.
2. A Taxonomy of AI Governance Approaches: Distinguishing Visibility, Alignment, and Authorization, FERZ, Inc., v1.7.1, August 2026. Concept DOI 10.5281/zenodo.18275969; edition relied upon 10.5281/zenodo.22037345.
3. Layering Is Not Authorization: Why Stacked Guardrails Do Not Establish a Runtime Authorization Boundary, FERZ, Inc., v1.0, September 2026. Concept DOI 10.5281/zenodo.22267761; edition relied upon 10.5281/zenodo.22267762.
4. Authority versus Authorization: A Definitional Framework for AI Governance, FERZ, Inc., v1.0, July 2026. Concept DOI 10.5281/zenodo.21341907.
5. Delegation Is Not Authorization, FERZ, Inc., July 10, 2026. ferz.ai/articles/delegation-is-not-authorization.
6. Enforcement Integrity in Pre-Execution Authorization, FERZ, Inc., v1.0, October 2026. Concept DOI 10.5281/zenodo.23438039; edition relied upon 10.5281/zenodo.23438040. Companion article: Enforcement Integrity in Pre-Execution Authorization.
7. The Hook Is Not the Boundary: Boundary Completeness in Pre-Execution Authorization, FERZ, Inc., v1.0, August 2026. Concept DOI 10.5281/zenodo.22180242; edition relied upon 10.5281/zenodo.22180243.
8. On the Impossibility of Observability-Based Authorization: An Information-Sufficiency Result for Pre-Execution Authorization, FERZ, Inc., v2.0.0, September 2026. Concept DOI 10.5281/zenodo.19647542; edition relied upon 10.5281/zenodo.22930704.
9. Execution-Time Authorization for AI Agents: A Formal Framework for Deterministic Governance Boundaries, FERZ, Inc. Concept DOI 10.5281/zenodo.18764561. Current edition v3.1, September 2026, 10.5281/zenodo.22261326.
10. The Override Asymmetry: Why ABSTAIN with Authorized Resolution Is Not Guardrails with Review-Only Human-in-the-Loop, FERZ, Inc. Concept DOI 10.5281/zenodo.19772248; edition relied upon v2.2, September 2026, 10.5281/zenodo.22259718.
11. Five Tests Standard (5TS), FERZ, Inc., v1.2.0. Concept DOI 10.5281/zenodo.21040295; edition relied upon 10.5281/zenodo.21040296. Cited for the Ownership and Provenance tests referred to in Section V.

@techreport{ferz2026unpredictable,
  title        = {Unpredictable Intelligence Still Requires Authorization: Why Superintelligence Does Not Remove the Pre-Execution Authorization Requirement},
  author       = {Meyman, Edward},
  institution  = {FERZ, Inc.},
  type         = {Doctrine article},
  year         = {2026},
  month        = oct,
  version      = {1.0},
  doi          = {10.5281/zenodo.23599766},
  note         = {Version DOI 10.5281/zenodo.23599767. Canonical page: https://ferz.ai/articles/unpredictable-intelligence-still-requires-authorization},
  url          = {https://ferz.ai/articles/unpredictable-intelligence-still-requires-authorization}
}

© 2026 FERZ, Inc. This article is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).