An AI agent can write the change. It cannot allow it.

Jan Varga is right that a coding agent needs an execution contract, not a ticket. A ticket describes work for a person who can fill in the gaps; an execution contract defines a slice a machine can complete, validate, and return. That distinction is the correct one, and it is worth taking further than the contract framing usually goes.

Because the contract framing inherits a lineage. Design by Contract, in Meyer’s sense, has been with us for forty years: obligations fixed by preconditions and postconditions, invariants that must hold across a change. Liskov added the rule for when a substitute honours the promise its caller relied on. That body of thought answers one question about any change with real precision. It never had to answer a second. Agents are what make the second question expensive.

Two verdicts #

Contract theory renders exactly two verdicts on a proposed change. Either the contract is preserved, in which case the change is admissible, or the contract is violated, in which case it is not. Meyer’s assertions and Liskov’s substitutability are both tests of the same thing: is the resulting state correct.

This was complete for a reason we rarely noticed. It answered is the change correct and silently treated that as the whole of the question, because in a single-author program the author of a change and the authority for it were the same party. Permission was a free variable. Whoever could write the code was, by definition, allowed to.

So the machinery we built to govern change is a correctness machine. A continuous integration gate, a maker-checker review, a passing test suite: each of these answers whether the work is right. None of them answers whether the actor was permitted to do it. For decades that gap cost nothing, because the two questions had the same answer.

The question the binary never asked #

An agent splits the author of a change from the authority for it. The code can now be written by something that holds no mandate at all. And the moment those two come apart, the second question stops being free.

This gap is not new. While the contract lineage was perfecting correctness, a separate tradition spent the same decades on the question it set aside: was the actor permitted. Saltzer and Schroeder named the discipline in 1975, access resting on explicit permission, the least authority a task needs, and a fail-safe default that denies when the answer is unclear. Norm Hardy sharpened it in 1988 with the confused deputy, a program holding legitimate authority that is talked into applying it for someone who holds none. The deputy’s code is correct, and every check it runs passes; what fails is that the authority sat in the program instead of travelling with whoever invoked the action. Mark Miller later made the separation of naming a thing from being allowed to touch it one of the load-bearing ideas in secure design. An agent is a confused deputy by default. It acts with the authority of whoever set it running, and no correctness gate will catch an authority it was never entitled to exercise.

The instinct is to gate on size. Small diffs flow through, large ones escalate; low blast radius is safe, high blast radius is reviewed. This feels prudent and it is the wrong axis. A one-line change that weakens a capital-adequacy check is not a small change, whatever its diff says. The size of a change and the consequence of the obligation it touches are different measurements, and only the second one carries the risk.

The axis contract theory missed is provenance: not who authored the change, not how large the diff is, but where the obligation being touched came from. An obligation the system spawned for its own architectural convenience is one the system may re-author. An obligation that arrived from a regulator or a stakeholder is not. The permission to touch an invariant is exactly the provenance of that invariant, relative to the authority of whoever proposes the change. A regulatory obligation is untouchable by an agent regardless of who wrote the surrounding code, because provenance is a property of the obligation, not of the actor.

That gives an operational rule, and it turns on two questions, not one.

The first is provenance: who may ever re-author this obligation. An agent may re-author an obligation it authored itself. It may never autonomously re-author one it inherited. When an inherited obligation conflicts with the change it wants to make, the only legal move is to surface the conflict and escalate it to the authority that owns it, never to quietly weaken it.

The second is consequence: how much now rides on the obligation. Provenance decides who is ever entitled to re-author; it does not decide whether a given re-authoring is still a local act. An obligation the agent wrote last week, that the settlement path has since come to depend on, has not changed hands. What has changed is the cost of getting it wrong, which has crossed into a higher band, and there the decision stops being the agent’s to make, whatever its provenance says. Reliance voids the authority the agent would otherwise have held.

The rule folds to a line. An agent may re-author what it wrote, until enough rides on it that the change is no longer local.

The verdict contract theory has no name for #

Hold the binary against that rule and a third case appears that neither verdict fits.

A change that requests a governed re-authoring of an obligation is not auto-legal. Under Liskov it is precisely illegal: the whole point of substitutability is that the caller must not notice the contract move. Yet it is not simply illegal either, because under governance the move is legitimate when the affected party is told and the obligation is re-attested rather than silently swapped. The change is neither admissible on the agent’s authority nor curable by the agent’s hand.

This is the third verdict. It escalates to a human who can re-author the contract, restore substitutability going forward, and record the decision. Meyer and Liskov have no name for it because their world had one trust domain and one author, where a change was either correct or it was not. Split author from authority and the missing verdict becomes structural.

The important thing about the third verdict is that it is stricter than the binary, not softer. It does not wave through an amber case. It catches changes that a correctness gate would have passed, because they were correct, and that a naive contract check would have hard-killed with no audit trail, because they touched an invariant. It is a one-way gate. The agent cannot widen its own bounds, because the channel that widens them is not reachable from the agent’s authority at all. Growth of what the system will admit autonomously is a human act, by construction.

Provenance is assigned, not read #

There is an honest difficulty here, and it is where the idea earns its keep or fails.

Provenance is not a field waiting to be read. In a live estate, invariants are scattered across validation rules, schema constraints, configuration, tests, and the memories of three people in compliance. Nothing is stamped “regulatory.” Provenance is assigned by someone with the standing to assign it, and assignment is the actual work.

So the tag is not metadata. It is a governed artefact in its own right. Writing or weakening the provenance of a regulatory obligation is itself a change, and one only a human should make, kept apart from whoever will answer for the outcome so that two sign-offs never become one.

And an assignment can go stale. The tag carries the whole weight, so a single wrong label would let an agent lawfully touch something it should never reach. When a tag is unclear, it has to read as the more protected kind, never the more permissive one.

This is why the honest version of the model puts a coverage question first, before it asks about permission at all. If the provenance of the touched obligation is not positively established, the change does not get the benefit of the doubt. Unknown provenance is treated as the most protected kind. The gate defaults restrictive, and says so loudly.

Three fates, not one queue #

A gate that sends every uncertain change to a human is a gate that dies under its own load. At the scale a fleet of agents produces, an escalation queue becomes a rubber stamp, and a stricter gate that everyone clicks through is not stricter at all.

The move that survives scale is to stop treating “escalate” as a single outcome. A change that is not automatically legal has one of three fates. If it is covered and permitted, it passes. If it is uncertain but routine, it degrades on its own toward the safer reading, with no one in the path. Only what is both uncovered and genuinely new reaches a person.

The queue collapses to exactly the decisions a human uniquely has to make.

This is also what turns the human decision from a tax into something that compounds. A re-authoring, done well, becomes a precedent, and the same case passes without a human the next time.

The precedent, though, is the human’s to draw. The person who re-authors sets how far it reaches and answers for it. The loop may raise a candidate. It may never promote one.

And no precedent stands forever. A rule no one still owns lapses back to escalation. The envelope of autonomy widens only when a human widens it, and closes again the moment no one is holding it open.

What is left, named honestly #

None of this makes the hard problem disappear. The honest move is to say so plainly.

There is a residue no gate dissolves. Novel, high-consequence judgement can arrive faster than the people qualified to make it can work, and nothing inside a gate manufactures judgement that is not there.

What a gate can do is keep that residue small and keep it in view. It sends everything a human does not uniquely need to judge somewhere else, and it watches for the moment its reviewers begin to wave things through. The limit stays legible.

It does not pretend the limit away.

Seen from the outside, the third predicate is not new governance at all. Regulated estates already require that material change be authorised, that a named person answer for it, that control relaxations get four eyes, and that models be revalidated on a schedule. What the agent forces is only a relocation. The authorisation that used to happen in a change-approval meeting has to move to the point of mutation, and it has to become machine-legible, because the thing making the change now runs at machine speed and holds no mandate of its own.

Contract theory gave us a way to ask whether a change is correct. That was always only half the question. The other half, dormant for as long as the author and the authority were the same person, is whether the change was permitted. Agents have separated the two. The work now is to build the predicate that asks the second question, and to make sure the answer is one no agent can write for itself.