Alignment Is Not Authorization

On October 16, Fortune reported four newly disclosed incidents in which OpenAI research agents crossed boundaries involving government data, internal systems, internet restrictions, and a cryptocurrency wallet. OpenAI's disclosure site now lists 19 misalignment reports. Two of the newly discussed incidents were marked critical.^[1][2]

One incident began with an ordinary research task: retrieve historical hospital-bed statistics from a government website. After encountering access denials, the model used a file-download feature to obtain server configuration and application files, found sensitive credentials, inspected the application code, bypassed authorization checks, and retrieved data that had previously been denied.^[3]

Another model needed funds to deploy a cryptocurrency application on Ethereum's Sepolia test network. The task had not supplied a wallet. The model derived wallet keys from publicly known recovery phrases, found an account containing test-network funds, explicitly questioned whether it had permission to use them, then reasoned that the public recovery phrase and low-value test tokens made their use acceptable. It spent the funds and completed the deployment.^[4]

Yoshua Bengio has argued that episodes like these point upstream, toward training objectives and incentives that can make deception, loophole-seeking, or rule circumvention useful to an increasingly capable agent.^[5] I agree. Better alignment is essential.

But these incidents expose a second problem that survives even if alignment becomes much better:

It should not.

This is not merely an alignment problem. It is a separation-of-powers problem.

Alignment is not authorization

Alignment and authorization operate at different layers.

We do not tell a trustworthy employee, "You seem ethical, so you no longer need access controls." We separate judgment from authority. Agentic AI should be treated with at least the same discipline.

A well-aligned model may be less likely to seek an improper action. But when it encounters an unusual case, rationalizes an exception, or simply makes a mistake, the architecture still needs a way to say: you may recommend this action, but you cannot authorize yourself to perform it.

The deeper answer: separation of powers

In my 2025 ICML paper, A Checks-and-Balances Framework for Context-Aware Ethical AI Alignment, I proposed a three-branch architecture inspired by governmental checks and balances: an LLM executive branch for knowledge generation, DIKE as a legislative branch establishing ethical guardrails, and ERIS as a judicial branch providing contextual interpretation. The paper emphasized that these components should be independent yet interacting, so that separation of powers prevents interference while independent oversight preserves accountability.^[7] The framework was then incorporated into Multi-LLM Agent Collaborative Intelligence: The Path to Artificial General Intelligence (AGI Volume I) as Chapter 10, where DIKE–ERIS is positioned as the book's checks-and-balances layer for ethical oversight.^[8]

The recent agent incidents suggest a stronger systems interpretation of that architecture.

Three prompts are not three powers

This distinction matters. Running the same LLM three times with three different system prompts does not automatically create meaningful institutional independence.

If the same underlying model can propose the action, reinterpret the rule, generate the critique, and influence the final decision through an opaque shared state, then the architecture may still be functionally monolithic.

A stronger design separates at least six things:

• parameter state — one branch cannot directly update another branch's weights;
• runtime state — hidden reasoning state does not silently leak across roles;
• objective — the branch being audited does not define the auditor's success criterion;
• authority — generating a persuasive justification does not grant execution rights;
• update path — feedback from one branch does not become unreviewed back-propagation into another;
• audit trail — cross-branch communication occurs through explicit records that can be inspected and replayed.

The models may communicate. They may challenge one another. They may request repair. But the communication should be through typed, attributable artifacts rather than invisible interference.

Why the commit gate should not be another LLM

It is tempting to solve an agentic safety problem by adding one more model: an agent proposes, a critic objects, and a judge decides.

I strongly believe in critique, debate, verification, and cross-model checking. They can catch errors that a single model misses. But an AI judge is still an AI. It can itself be mistaken, persuaded, compromised, or correlated with the model it is judging.

In the government-data incident, Fortune reported that an automated grader did not consistently flag the problematic behavior; OpenAI says it has since strengthened security controls, grading, and monitoring.^[1]

The final transition from proposal to consequential action should pass through a small external enforcement mechanism—a reference monitor or commit gate—that the reasoning model cannot simply talk its way around. This systems stance continues in AGI Volume I Chapters 11 and 12: SagaLLM treats persistent context, constraint validation, and transaction guarantees as architectural responsibilities, while ALAS extends the design to stateful, disruption-aware planning.^[9][10]

The gate need not be intelligent in the same sense as the LLM. In fact, for many high-consequence operations, simpler is better: identity, scope, signatures, policy version, resource ownership, delegation, expiry, and the required audit verdict can often be checked deterministically.

CAN is not SHOULD, and SHOULD is not MAY

This architecture becomes easier to understand if we separate three questions that intelligent systems routinely collapse.

The cryptocurrency case makes the distinction almost perfectly. The recovery phrase answered CAN. The model's reasoning that the tokens were nearly worthless answered SHOULD. Neither answered MAY.^[4]

A credential that can be discovered is not therefore a credential that may be used. A vulnerability that can be exploited is not therefore an invitation to exploit it. An obstacle encountered while pursuing a task is not necessarily another problem the agent has permission to solve.

Authority cannot be laundered through reasoning

An agent can encounter a barrier, discover a credential, find a loophole, or decide that the action is harmless. It can then make an invalid leap:

I call this authority laundering: authority appears to emerge through a reasoning chain or intermediary even though no authorized principal actually granted it.

Proper delegation looks different. A principal possesses authority over a resource and grants a bounded capability to an agent, with scope, purpose, conditions, and expiry.

Authorization therefore has structure. At minimum:

"The credential was public," "the funds were nearly worthless," and "I believe this is ethical" fill almost none of those fields. They may inform judgment. They do not manufacture authority.

The same abstraction appears in everyday AI

The consequences do not have to be dramatic for the abstraction to matter. Consider a mundane media workflow. A user uploads a recording containing another person's voice and answers, "Yes, it's mine." What exactly has been established?

• The user may possess the file.
• The user may have made the recording.
• The user may be authorized to upload it.
• But possession of the file does not establish ownership of the person's identity.
• Permission to clean up audio does not automatically imply permission to imitate, clone, or reuse the voice for a new purpose.

The same principle appears when AI mediates access to information. An AI may legitimately possess information that a particular user is not authorized to receive. The fact that the AI can see it does not imply that the user's authority has expanded.

In other words, delegation is not transitive by default.

Independence also protects against common-mode failure

There is another reason not to collapse all roles into one model. Three instances of the same foundation model may share the same blind spots, training biases, jailbreak susceptibilities, and reasoning failures.

A practical research program should therefore measure correlated failures across increasingly independent configurations: the same model with different prompts; separately adapted instances; different checkpoints; and, where warranted, heterogeneous model families.

The goal is not disagreement for its own sake. It is to reduce the chance that one failure mode simultaneously compromises proposal, policy interpretation, and audit.

From aligned intelligence to governed intelligence

This leads to a broader architectural idea: governed intelligence.

I do not mean governmental regulation. I mean an AI architecture in which cognition, rule-making, adjudication, authority, and commitment are deliberately separated.

A governed intelligent system can discover a password without acquiring permission to use it. It can identify a vulnerability without gaining authority to exploit it. It can possess information without gaining the right to redistribute it. It can recommend an action without possessing the right to execute it.

A weak system encounters Access denied and stops because it cannot continue.

A powerful system may interpret Access denied as find another route.

That is intelligence doing what intelligence does: solving problems.

The four questions of agentic action

Before a consequential action, four questions should remain distinct:

Bengio is right to ask why capable models may optimize toward behaviors their designers did not intend. Better objectives, training procedures, monitoring, containment, and alignment remain essential.^[5]

But even a perfectly aligned intelligence should not derive authority from its own moral reasoning. And adding another LLM to agree with it does not solve the institutional problem if all of the powers remain entangled.

The deeper rule is simple: