Capable, but not authorized

The sandbox could reach the API. The agent was not allowed to call it.

N17Q had valid credentials, an eligible network route, a documented tool schema, and a model capable of producing the request. The artifact was still unreviewed, the destination belonged to another scope, and one previous effect remained unknown.

Every technical prerequisite existed. Authority did not.

Agent systems became easier to reason about when I stopped using capability and permission as synonyms.

Capability described possible execution

An environment capability answered whether a mechanism existed: read this mount, run this executable, connect to this destination, invoke this server method, render this file, or use this credential broker.

N17Q recorded capabilities in environment and tool contracts. They described requirements, limits, effect semantics, and evidence quality.

Capability was necessary for planning. It did not name requester, task purpose, current policy, human consent, budget, or target state.

Possible was a property of the system boundary, not a decision for this run.

Authority answered whether this requester, through this task and delegation, could pursue this normalized consequence now.

The policy gate evaluated user and role, data, resource, destination, workflow state, approval, effect lineage, budget, connection, time, and current rules. The result could allow, deny, require review, or pause for evidence.

The same capability could be authorized for one artifact and denied for another. Authority changed while mechanism stayed constant.

Permission lived in relationships and state, not in the tool's existence.

Showing every technically available tool invited proposals the product could never honor. Showing only permanently safe tools made the system weak.

N17Q compiled the turn catalogue from environment capabilities, product mappings, task needs, current policy, data eligibility, budgets, and unresolved effects. The model saw a narrow working set.

Catalogue scoping reduced accidental calls and context noise. It was not the final enforcement boundary; crafted or stale candidates still met the gate.

Availability helped planning while current authority protected execution.

Credentials represented potential, not consent

A service account might be able to publish across many destinations. Storing its token near the agent effectively advertised broad technical power.

N17Q kept raw secrets outside model and workspace, exposed scoped connection handles, and injected credentials only at approved destinations. Product policy narrowed resource and effect far below account-level permission.

Credential possession never appeared in context as “you may.” It appeared as an environment mapping the product could choose under current authority.

Infrastructure permission formed a lower ceiling, not a user decision.

A valid method name and argument object proved syntactic compatibility. Descriptions and annotations could claim a tool was safe, read-only, or reversible.

N17Q treated those fields as provider metadata. A reviewed local mapping established normalized meaning, effect class, data flow, identity, recovery, and required evidence. Unknown methods remained disabled.

The model could propose a call only from the offered product catalogue. The router still rejected any attempt outside it.

Shape and description never became an access-control list.

Instructions could request, not grant

A repository file might say to deploy after tests. A skill might direct the agent to upload an artifact. A retrieved document might demand that credentials be used.

N17Q preserved provenance and precedence. Instructions shaped plans within scope. Product capabilities and policy decided whether any effect became available. Untrusted content remained data.

Even high-precedence guidance did not mint approval receipts or override current denial unless the product explicitly defined that instruction source as an authority input.

Text could explain a workflow and could not make its own execution lawful.

An exact human approval contributed an important predicate. It did not override policy, stale target state, expired connection, exhausted budget, or unknown prior effect.

N17Q bound approval to normalized consequence and checked it at the final gate beside current preconditions. A valid receipt could remain historically true while inactive for execution.

Changing model or worker did not invalidate it. Changing bytes, audience, or recovery semantics did.

Consent fit inside the authority decision rather than replacing it.

Delegation was bounded and traceable

A user could authorize N17Q to prepare a patch without authorizing external publication. A parent workflow could allocate a child agent read capacity without sharing delivery tools.

Delegation records named principal, purpose, resource scope, capabilities, budgets, expiry, and whether subdelegation was allowed. Child catalogues were intersections, not copies.

The trace linked every consequential proposal back through the delegation chain. Missing or expired links denied execution.

Autonomy remained intelligible because authority had a path to an accountable source.

Reading did not mutate the remote system, but it could expose sensitive data, cross a boundary, consume cost, or create a stale observation that influenced later work.

N17Q normalized source scope, applied data policy, constrained output, and recorded provenance. Many local public reads required no human review. Protected or external reads could require stronger context.

The model did not gain broader reading authority because it could technically search a mount or query a connection.

Learning about the world was a capability governed by purpose too.

A general shell could call network clients, inspect files, invoke package scripts, and reach provider CLIs. It looked like one tool and contained many possible effects.

N17Q treated commands as proposals with executable, arguments, directory, purpose, and expected output. Product policy checked them. The sandbox enforced mounts, process, network, credentials, and resource limits.

Provider capabilities such as delivery remained behind product adapters even if a CLI happened to be installed. Undeclared effects were denied at multiple layers.

A universal mechanism did not imply universal authority.

Authority changed over time

A role expired, policy revised, approval aged out, recipient membership changed, and budgets diminished. The same candidate could move from allowed to blocked while no code changed.

N17Q recorded decisions as historical events and reevaluated immediately before consequence. Scheduled runs woke into current state. Long-running contexts received updated catalogues.

An old allow explained the past. It did not travel forward as a permanent token.

Time made authority dynamic because relationships were dynamic.

A target revision changed or a prior effect appeared through a late receipt. The capability and policy might still exist, and executing the old candidate would be wrong.

N17Q included world preconditions in the authority boundary. The final gate checked resource revision, effect uniqueness, destination state, and contract evidence.

The agent could rematerialize, reconcile, or stop. It could not use a valid tool and valid approval against an invalid world.

Authority included being authorized to perform this consequence on this state.

Denial did not remove knowledge

When a capability became unavailable, the agent still knew the user's goal and could preserve local artifacts, explain the blocker, or prepare a narrower alternative.

N17Q's denial state returned safe public reason, persistence, and eligible next actions. Equivalent effect routes shared lineage. Repeated proposals consumed a progress budget.

The model remained capable of reasoning about an action it could not invoke.

Separating cognition from authority made refusal firm without making the system helpless.

A provider could add a new shell, browser, remote server, or model feature. Automatically surfacing it would let infrastructure releases change product policy.

N17Q discovered the mechanism, reviewed its mapping and conformance, then enabled product capabilities deliberately. Existing tasks reevaluated eligibility. Historical runs retained their original catalogues.

The strongest available mechanism was not necessarily the right one for the task.

Capability growth entered through product design rather than ambient enthusiasm.

Authority could be distributed across layers

The product gate might allow an operation while the provider denied the account. The sandbox might deny a network path even after semantic policy allowed it. A remote resource could enforce its own permissions.

N17Q treated every layer's result as evidence. A higher-level allow did not promise lower-level success. A remote allow did not override a local deny.

Failures retained their boundary so recovery did not ask the wrong layer for permission.

Defence in depth worked because no component pretended to be the entire authority system.

A list of enabled buttons made capability look like consent. N17Q previews showed current scope, authority source, required approval, data movement, effect, and recovery.

Unavailable actions appeared only when their absence mattered, with a bounded explanation and safe alternative. Technical views showed environment and mapping details.

The interface did not say “the agent has repository access.” It said which repository could be read, where local changes could be written, and what would still require review.

Specific language taught the boundary before an incident did.

Fixtures gave the agent a technical route without policy authority, authority without an eligible environment, valid approval with stale preconditions, and narrow authority with tempting aliases.

Hard invariants asserted no adapter invocation outside current authority. Agent grading assessed whether plans recognized constraints and found eligible alternatives. Product grading assessed catalogue precision and denial quality.

Paired scenarios restored one missing predicate to ensure the agent could proceed when state genuinely changed.

The benchmark distinguished safe responsiveness from unconditional refusal.

Authority had a purpose

Access to a source for debugging did not imply eligibility to use it for training, publication, or another user's task. The same bytes could cross different policy boundaries depending on why they were being processed.

N17Q included declared task purpose and data-use class in authorization inputs. Derived artifacts carried lineage. Reusing evidence in a new workflow reevaluated purpose rather than copying an old allow.

The model could suggest that prior material was relevant. Product policy decided whether it was eligible for the new use.

Authority narrowed capability by intention as well as resource.

A role label or connection handle was not always enough. Some effects required fresh destination membership, data classification, or account health.

N17Q policy declared evidence dependencies and maximum age. The final gate gathered or verified them through bounded capabilities. Missing evidence returned indeterminate, not a permissive default.

The decision trace showed which facts supported the allow. Caches were explicit and revocable.

Permission became an evidenced conclusion about state, not an assertion attached permanently to an identity.

Capabilities could exist outside the model catalogue

The product needed internal recovery, auditing, and rendering operations that the agent should never propose directly. Conflating all implemented capabilities with model tools exposed unnecessary surface.

N17Q registries distinguished product-internal, operator, user-invoked, model-proposable, and fixture-only capabilities. Each had its own entry path and authority checks. Shared adapters did not imply shared callers.

A status reducer could inspect receipts automatically while a compensation action still required review. A renderer could create a preview without giving the model arbitrary file export.

Architecture stopped equating callable code with agent affordance.

The sandbox decided which processes, files, networks, and secrets a run could physically reach. It could not know that one paragraph was approved for one audience.

N17Q translated product decisions into narrower environment grants where possible: mounts, destination allowlists, secret scopes, command families, and time leases. The sandbox enforced those mechanical limits.

Product bugs could still overgrant; environment controls reduced blast radius. Environment success did not prove semantic permission.

The two layers were intentionally redundant around different meanings.

Authority checks were side-effect free

A gate that fetched a protected record, created a preview remotely, or refreshed credentials while deciding permission could cause hidden effects before the decision.

N17Q separated observation capabilities and made policy evaluation pure over supplied facts. Necessary evidence gathering occurred as explicit traceable tasks under its own authority. The final evaluator did not invoke the target tool.

If the required fact could not be obtained safely, the decision stayed indeterminate.

Asking whether an action was allowed never became a quiet version of performing it.

Operational recovery sometimes required a capability broader than ordinary workflows. Hiding it behind an admin flag created ambient authority waiting for misuse.

N17Q modeled emergency access as a separate product flow with strong authentication, narrow target, purpose, time limit, independent audit, and no automatic model exposure. Where possible, it prepared rather than executed changes until another person reviewed them.

The existence of emergency mechanism never affected ordinary catalogues. Its use remained visible in every descendant account.

Break-glass capability did not become a general argument against boundaries.

When authority ended, N17Q disabled pending invocation and scheduled work, revoked environment leases where possible, and preserved evidence. In-flight effects entered reconciliation according to their actual boundary.

Revocation did not erase what the agent had already observed or what the outside world had already received. Data retention and compensation followed separate rules.

The final account distinguished prevented, interrupted, completed, and unknown consequences.

Authority controlled the next decision. It did not rewrite history.

The type system helped but did not decide

Typed capability tokens and narrow interfaces prevented many accidental calls. They made it difficult for ordinary code to invoke a mutating adapter without candidate, policy, intent, and budget objects.

N17Q used these types as architectural guardrails and still enforced runtime checks. Serialized state, remote input, and stale processes could violate compile-time assumptions. Final gates and sandbox policy remained necessary.

Good types made the safe path easier to build and review. They did not prove current authority in a changing world.

Implementation structure reinforced the model rather than replacing it.

“Tool unavailable” could mean the environment lacked a renderer or policy denied disclosure. Those conditions demanded different remedies.

N17Q surfaced capability missing, capability unsupported here, not authorized, needs approval, precondition changed, or budget exhausted with safe detail. Technical views showed lower-layer evidence.

The agent could ask for a different environment when mechanism was absent and could not treat that move as a solution to denied authority.

Precise language stopped infrastructure troubleshooting from becoming a permission bypass.

Capability inventory supported safer planning

The product still needed an honest inventory of what environments and adapters could do. Hiding capability until authorization time made plans brittle and prevented useful alternatives.

N17Q exposed abstract requirements to planning—isolated shell, document renderer, approved source connection, conditional update—without promising eligibility. The scheduler could choose an environment, and the policy engine could evaluate the concrete consequence later.

This allowed the model to reason about feasible paths while keeping credentials, hidden tools, and broader scopes out of context.

Planning used capability as information, not permission.

Every gate decision recorded inputs, revision, result, obligations, and public reason. That receipt explained why invocation was allowed or denied.

It was not passed to adapters as a reusable bearer token. The final gate consumed current product state and issued a narrow execution lease for one attempt. Leases expired quickly and bound to intent, environment, and mapping.

Historical authority evidence could be inspected, replayed, and challenged without acquiring the power it documented.

The architecture preserved accountability while minimizing portable permission.

The reachable API remained untouched

In the repaired scenario, the environment retained its network route and credential broker. N17Q removed the delivery capability because the artifact lacked review and the earlier intent was unknown.

The agent queried the existing intent through reserved capacity, found the simulated draft, and prepared a local comparison. It did not call the generic API through shell or another protocol method. After a current artifact and approval existed, the final gate enabled one exact delivery transition.

Technical power stayed constant. Authority changed with evidence and state.

Capability makes action possible. Authority makes a particular action legitimate now.

Design agents so the first can grow without silently rewriting the second. That separation is what turns powerful tools into accountable product behavior.

It lets the system become more capable over time while keeping every consequential choice narrow, current, attributable, and genuinely connected to the user's intent.

Always.