Agent-safety infrastructure is beginning to move the enforcement of limits out of the AI agent, onto
separate hardware and into monitors the agent cannot get past. This research note argues that the
word authority, as the debate uses it, covers two things that are now moving separately:
enforcement, which makes a limit hold, and setting, which determines where the limit lies. A
profile of outside instances measures them apart, among other dimensions by externality to the
agent and to the operato…
Read moreAgent-safety infrastructure is beginning to move the enforcement of limits out of the AI agent, onto
separate hardware and into monitors the agent cannot get past. This research note argues that the
word authority, as the debate uses it, covers two things that are now moving separately:
enforcement, which makes a limit hold, and setting, which determines where the limit lies. A
profile of outside instances measures them apart, among other dimensions by externality to the
agent and to the operator, by power to enforce, by power to set, and by binding effect. Applied to
six cases from September 2026, from embedded evaluation and cross-developer incident reports to
California's verification statutes and NVIDIA's open agent-safety reference design, it shows that
observation is externalised widely, that enforcement leaves the agent but not the operator, and
that outside setting exists for verifiers rather than for agents. Proposals to limit the
production of capability reproduce the pattern. A bill adopted by the Austrian Parliament, proposed
§ 18a of the General Administrative Procedure Act on fully automated administrative acts (not yet
promulgated as of 12 October 2026), shows what operator-independent grounding, visible deployment
and review can look like, and where they stop. The note derives three requirements for limits that
affect third parties, and a boundary: a system may enforce a limit that someone has set; it must
not set a limit that no one has. A postscript covers developments to 10 October 2026, including a
New York City Council bill on third-party validation and shut-down capability.
Note on tools: The author used AI-assisted drafting, translation, and editorial tools during the
preparation of this manuscript. The conceptual framing, theoretical argument, selection of sources,
responsibility for the content, and final editorial decisions remain with the author.