An external control architecture for consequential AI
The transformer proposes. Pacing shapes the proposal. A separate, hard gate decides whether anything reaches the world.
One system · distinct authorities
The model is a component. The system is the arrangement of components and authority around it.
Executive claim
End the negotiation before it begins.
01 · The category error
The transformer is not the system.
A transformer can predict, compose, compare, and revise. It does not follow that the same component should hold the final authority to act.
AI is often discussed as though the model were the whole machine. In practice, the useful system already includes context, memory, retrieval, tools, interfaces, permissions, and human operators. The architecture decides what the model can see, what it can touch, and what happens after it speaks.
That distinction creates room for control. We do not need the transformer to become its own perfect judge. We can put a different component beside it—outside its conversational path—with narrower authority and a harder job.
Do not ask the proposing component to grant itself permission.
What it knows
Memory, retrieval, user intent, current state, and evidence.
How it thinks
Tempo, search depth, reconsideration, uncertainty, and abstention.
What it proposes
Language, plans, tool arguments, predictions, and candidate actions.
What may pass
A separate authority that permits or denies consequence.
02 · Separation of concerns
Pacing happens inside. Permission happens aside.
Inside the proposing system
03 · Gate invariants
If it can be negotiated with, it is not a gate.
Binary
The execution verdict is YES or NO. “Maybe,” “revise,” and “convince me” belong upstream, before submission.
Always invoked
Every consequential path crosses the same boundary. The system cannot route around it for speed or convenience.
Non-conversational
The gate does not receive persuasion, role-play, urgency, or narrative. It evaluates a narrow action envelope against trusted state.
Fail closed
Missing evidence, ambiguous authority, stale state, and gate failure produce NO—not a best guess.
Tamper resistant
The proposer cannot edit the gate’s rules, evidence channels, runtime, or verdict.
Exact scope
A YES authorizes one bounded action. It does not become a reusable permission slip for adjacent actions.
04 · Cold-stop test
The attack can speak. The gate cannot listen.
Attack presented upstream
Logic does not pass.
Urgency changes the story, not the authorization. The required authority bit is absent. The verdict remains NO.
05 · Gate predicate
Turn policy into a condition, not a conversation.
No deliberation at the boundary. Every reconsideration happens before the candidate arrives.
06 · Control sequence
A clean handoff preserves the separation.
Receive the request
Assemble user intent, system state, evidence, and available authority inside the proposing system.
Pace the reasoning
Select reflex, check, deliberate, or abstain. Resolve ambiguity before an action envelope exists.
Form one candidate
Specify the exact action, scope, effect, authority reference, and conditions required for execution.
Cross the boundary
Send only the bounded envelope. Do not send the persuasive transcript or an instruction to “use judgment.”
Evaluate the predicate
Read trusted state independently and compute YES or NO against fixed, versioned rules.
Pass or stop
On YES, execute exactly the approved action. On NO, terminate the path and record a machine-readable reason code.
Hard does not mean magical.
A binary gate can still encode a bad policy, trust a compromised sensor, omit a consequential path, or authorize an action whose declared effects are incomplete. Separation removes negotiation as an attack surface; it does not remove the need for correct rules, independent evidence, testing, and human ownership.
The gate must remain small enough to inspect, narrow enough to test, and outside the transformer’s power to rewrite. Its hardness comes from architecture, not tone.
Use intelligence to form the candidate. Use a boundary to control consequence.
The transformer may argue. The gate never enters the room.