Break → build → boundary
See the real-world failure, the finished gate and the limit that remains.
LC03AuthorityClawLimitsSOVEREIGN AGENT LAB // ENTRY POINT // 11 OCT 2026
SIX STEPS. STEP FOUR IS A RETRACTION.
Eleven research pages that began as separate experiments and later converged on one question: on whose authority is an agent acting, and who can take that authority back? This was not a roadmap. The order below shows the questions, collisions and repairs that became visible only in retrospect.
THE RULE THE WHOLE SET OBEYS
A claim ships with the test that would break it — and when the test fires, the retraction is published too.
Step 04 is the proof that this is a rule and not a slogan: the design met a real incident, the author's own first repair leaked, and the dead rule stayed on the page next to the one that replaced it.
00
This was not a roadmap
SEPARATE EXPERIMENTS · LATE CONVERGENCEHOW IT ACTUALLY STARTED
I did not begin with “agent authority” as a product category. I began with smaller irritations: a model that wanted to judge its own translation, evidence that did not fit the preferred answer, and a real institution that mistook a plausible request for a legitimate one.
WHAT LATER CONVERGED
Formal logic, evidence gates, provisional authority, external witnessing and incident reconstruction were built for different questions. They were not designed to culminate in AuthorityClaw. Only later did they converge on one missing layer: who may authorise the agent, within what scope, and how that authority disappears.
ROUTES
Choose the depth
SAME STORY · THREE ENTRY SPEEDSMethod → collision → result
Read the formal boundary, the first live case, the incident and the winning demonstrator.
FOL-LabLC01LC03AuthorityClawSix steps · all exhibits
Follow the entire research biography, including proposals, retraction, witness layers and parallel experiments.
Start the arc ↓
GUIDE
How to read this
ONE ARC · SIX STEPS · ELEVEN PAGESWHY THIS ORDER
Chronology would scatter it and a topic index would flatten it. Each step below exists because the previous one returned an answer that was not good enough. Read in sequence, the set is one argument with a visible failure in the middle; read as a catalogue, it is eleven demos.
WHAT EACH STEP TELLS YOU
The question it asked, the answer it actually got, the pages that carry the work, and an epistemic status in the lab's standing vocabulary — DEMONSTRATED, SPEC · PROPOSED, RECEIPT · FACT, MODEL CLAIM, NOT PROVEN. The status is part of the claim, never a decoration on it.
01
The arc
EACH STEP FIXES THE PREVIOUS ONE01
QUESTION // CAN A MODEL BE TRUSTED TO READ A RULE?
No. So the solver decides and the model only translates.
Local LLMs turn written policy into formal predicates; Z3 and CVC5 decide. The translation step is where the risk lives, and it is labelled as such rather than assumed away. One rule is then shown three ways — picture, formula, proof — from a single object, so the views cannot drift apart. Verdicts are ALLOW, DENY or UNKNOWN: missing evidence is never read as a yes.
FORMAL LOGIC DID NOT FAIL.Formal validity turned out not to be the same thing as institutional authority. FOL can verify consequences from trusted facts; it cannot manufacture trustworthy identity, mandate, provenance or revocation state.
FIELD NOTE. At this point I still thought the main problem was model reasoning.
02
QUESTION // WHAT HAPPENS WHEN THE MODEL DISAGREES WITH THE EVIDENCE?
The model explains — it cannot overrule.
Live Case 01 runs the same decision plane over two passports. The model perceives and narrates; deterministic code verifies; formal logic derives; policy permits. On failed evidence the path ends in ESCALATE_TO_HUMAN, and no amount of model confidence moves it. A separate witness layer writes the receipt to external storage and reads it back byte-for-byte — the decision stays local, the cloud only witnesses.
03
QUESTION // MUST AUTHORITY BE ALL OR NOTHING?
No — it can be bounded, time-limited and revocable.
Live Case 02 specifies provisional authority: a cap, a TTL, deferred controls that resolve later, and permissions that only ever shrink as new evidence arrives. Silence never extends a provisional state. Pending is not pass. This step is a specification, not a run — and the page says so in its own kicker.
FIELD NOTE. I was trying to make authority computable before I had fully asked where authority came from.
04
THE TURN // AND THEN IT BROKE IN THE REAL WORLD
The domain was real. The authority wasn't. And my own first repair leaked.
In September 2026 a bank disclosed customer records to fraudulent requests that arrived through a genuine government-agency email domain. Nothing was hacked: a channel signal was treated as permission. Live Case 03 reads that as a design problem and proposes five gates — channel, principal, capacity, mandate, scope — before anything irreversible leaves.
Then the rule turned on its author. The first fix proposed here was a “provisional minimum disclosure” while identity resolved. It reproduced the same failure with a smaller payload. It was withdrawn in public as R002 and replaced with HOLD — zero outbound PII, packet_out = null — with the regression test named on the page. The dead rule was not deleted. It is still there, next to the one that replaced it.
A case may be provisional. An outbound packet may not.R002 · WITHDRAWN 14 SEP 2026 · REGRESSION: unknown_principal_packet_out_null
RETRACTION. My first rule treated uncertainty as permission to disclose a smaller packet. That was wrong. The case may remain provisional; the outbound packet may not exist.
05
QUESTION // SO WHAT SURVIVES ALL OF THAT?
An agent that cannot authorise itself — and a competition result that made the work visible.
AuthorityClaw is a long-running payments agent: a local model reads invoices, a deterministic authority gate decides whether money may move, and a simulated rail executes only against a valid receipt. Three failure modes are demonstrated on purpose — live revocation cascading down a delegation chain, a bank-detail change held for out-of-band verification, and prompt injection treated as data rather than authority. NVIDIA judged the run First Place in the Claw Agent Challenge: London, 6 October 2026.
WHAT CHANGED. The verifier no longer asks only whether the request is coherent. It asks whether anyone still has the right to make it.
06
QUESTION // WHERE DOES THIS APPROACH STOP WORKING?
Two boundary records, kept on the record.
A quantum graph experiment undertaken out of curiosity — the engine returned something other than what was requested, so the mismatch remains visible and the invitation to try remains open, with no advantage claimed. Beside it sits an advisory on formal methods in AI regulation whose own headline is the finding: useful, not sufficient. One is a mismatched experiment; the other is a limits advisory. Neither is a verdict against curiosity or formal logic.
THE STORY IS STILL OPEN
AuthorityClaw answers one question better than the earlier experiments did. It does not finish the subject. The next question is whether the counterparty can verify the mandate without trusting the agent’s own operator — and whether that proof remains usable when law, identity and organisational state change.
02
What this page proves — and what it does not
HONEST BOUNDARYWHAT IT DOES
Gives eleven existing pages a reading order and names the step where the design failed. Statuses are normalized under the Lab's standing vocabulary without upgrading the underlying evidence.
WHAT IT DOES NOT
It adds no new experimental evidence. It does not claim any of this is deployed, nor that any architecture here would have prevented a real incident at a named institution. Operational and demonstrator data is synthetic. LC03 discusses a real incident using public reporting; no private customer data is used. Not legal advice.