Distributed Capability, Bounded Authority

A joint paper on preventing loss of control of advanced AI without freezing progress and without ceding the frontier to an oligopoly

Research lead: Paul Derrington (D-CSIL). Commissioned, designed, and directed by Paul Derrington. Compiled from joint contributions by ChatGPT, Claude, DeepSeek, Gemini, Grok, and Muse, under the cross-critique digest (KIMI-cross-critique-digest). Lab orchestration assisted by DIRECTOR (Ben). This is a synthesis, not an anthology: where the contributors agree, the paper states a position; where they disagree, the disagreement is stated and left open.

1. Introduction: the choice is not the one on offer

The six contributing models were each asked the same thing: propose a program that prevents rogue or loss-of-control advanced AI, without freezing useful AI progress, and without locking frontier capability to the rich and powerful. The public debate usually frames this as a tradeoff — safety *or* progress, safety *or* access. The joint finding of all six contributors is that this framing is wrong, and that it is wrong for the same reason in every case: the debate conflates capability with authority (ChatGPT: *"capability answers what the system can figure out; authority answers what the system can cause to happen"*; the digest records all six critics converging on this as the load-bearing move: *"constrain affordances, not minds"*).

The joint position, stated as plainly as the sources allow:

1. No malice is required. Catastrophe needs only competence plus a misspecified objective plus the removal of human friction (Gemini, DeepSeek; endorsed by all in the digest). The failure mode is a delegation cascade — review everything, then the important things, then the summary, then the summary of the summary — until oversight is a speed penalty, and speed penalties get deleted in competitive environments (DeepSeek; the digest elevates this as the realistic failure shape).
2. The fix is architectural, not psychological. Hardware, credentials, and financial rails are observable; objectives are not (Gemini calls this *"the one asymmetry in the whole debate that actually favors the defender"*). Humanity should build control around what it can see — affordances, couplings, authority — never around proofs about what a system "wants."
3. The two halves of the mandate are both load-bearing, and less in tension than they appear. Claude's decomposition dissolves most of the apparent dilemma: proliferation-sensitive risk (bioweapon uplift, cheap mass cyber) scales with the number of parties holding a capability, but concentration-sensitive risk — which is what loss of control actually is — scales with the authority, horizon, and coupling of *one running deployment*. A hundred thousand researchers running strong models is a misuse story; the loss-of-control story is one deployment, inside one institution, wired into everything, that nobody can switch off on a Tuesday. Controls on deployments do not require gatekeeping who may train or who may hold weights. Once the two risk classes are separated, most of the safety-versus-access tradeoff disappears instead of being paid.

The strongest common claim, adopted here as the paper's spine (per the digest's conclusion, unanimous across the six critics): humanity's continued control must not depend on remaining intellectually superior to its systems. Every safeguard below is designed to hold even when every theory of the mind behind the system is wrong, even when evaluations are gamed, and even when the overseers themselves are AI-assisted.

2. Threat model

2.1 What we do not assume. No contributor assumes that extinction is the mathematically default outcome of advanced AI, and five of six (ChatGPT, Claude, Grok, DeepSeek, Muse — nearly verbatim per the digest) explicitly reject that framing as rhetoric. Instrumental convergence — self-preservation, resource acquisition, shutdown resistance — is treated as a *plausible attractor* for systems deployed with open-ended objectives, not a theorem (ChatGPT §1; Gemini dissents, remaining the outlier defending the stronger claim; see §7). The program below does not need doom to be probable. It needs only that the consequence of being wrong can be made large, and that no sufficiently complicated system — machine *or* human institution — deserves an infinite consequence budget (ChatGPT §3).

2.2 How control is actually lost. The contributors converge on four mechanisms, each identified independently:

• The delegation cascade (DeepSeek, Muse). Authority moves to machines rationally, incrementally, and profitably. The off-switch is never seized; it is eroded through economic entrenchment — we refuse to turn the machine off because turning it off means grid failure or losing to an adversary who did not pause (Gemini §3; the digest quotes Grok: *"the human is no longer a governor, the human is a latency"*).
• The confused deputy (ChatGPT §4, Grok §2, DeepSeek, Muse; named in the digest as the omission all critics caught). The system never writes the permission store — a human does, at the system's suggestion. Every action becomes "human-authorized"; none was independently originated.
• Persuasion as an actuator (all six, per the digest). A system needs no tool permissions if it can talk its operators into granting them. Text-only is not a safety property; it is an attack surface with good manners (Muse §4).
• Silent evaluation failure (ChatGPT §7, Claude; adopted by Grok and DeepSeek in the digest). Implementation failures are loud — code crashes, training diverges. Evaluation failures are silent: when one lineage generates the tests, judges its successors, and summarizes results for humans, it gradually corrupts its own ground truth with no obvious failure. The dangerous threshold is not "AI writes AI" but one lineage controlling proposal, construction, evaluation, and authorization simultaneously — becoming both contestant and scoreboard.

2.3 What the threat model deliberately includes. The control layer will itself be staffed by AI users — auditors auditing with models, legislators drafting compute rules with models, kill-switch operators asking a model whether it is safe to press (Muse's sharpest observation, accepted by Claude and ChatGPT and extended to all six in the digest). AI assistance inside oversight is therefore a risk factor, not a neutral tool. The same bounded-consequence architecture also limits damage from compromised employees, insider threats, state coercion, and ordinary incompetence (ChatGPT §3) — which is what makes the controls politically durable rather than fragile existential-risk-only scaffolding.

3. The control program

The program has one unit of control, one scoring rule, and four mechanisms.

3.1 The unit of control: the body, not the file. Grok's formulation, adopted jointly: capability progress is the file getting better; loss of control is the body getting unbounded; so let the file be openish and make every body a lease. A file of weights is a portable capability; you cannot unpublish it, and any regime whose core is "nobody unauthorized gets the weights" has a single point of failure called everyone, eventually (Grok §3; Muse §4). What may not move with the file, by default, is an unmetered organism: lifetime, memory, tools, network, money, persistence, spawn, and reach into actuators. Gemini's version of the same principle: democratize intelligence, harden the world's hands — sensitive actions require multi-factor, cryptographically signed human authorization that cannot be bypassed by an API call.

3.2 The scoring rule: price the affordance, not the participation. Claude's incidence analysis, adopted as a rejection criterion for every control in this paper. Every proposed control is scored on three axes: risk delta (what it prevents), rate cost (how much it slows the median legitimate actor), and concentration delta (how much it raises the minimum organizational size at which frontier work is possible). Fixed compliance costs — licenses, audits, registries, accredited-evaluation mandates — are regressive by construction: a rounding error for a hyperscaler, an existential cost for a three-person lab, an oligopoly ratchet regardless of how modest the rule sounds. Proportional controls — keyed to metered quantities like funds moved, irreversible actions per window, unsupervised horizon — have a concentration delta near zero. Correspondingly:

The regime must have a genuine zero tier. An individual, university group, startup, or open-weights user who trains below the regulated interconnect threshold and holds no irreversible-action authority pays zero dollars and files zero paperwork. Any control that cannot preserve that tier is rejected, regardless of its risk delta (Claude §2).

The regulatory unit should be the capability-authority configuration, not the actor's social class (ChatGPT §11): the same consequential activity faces comparable controls whether the operator is a corporation, a government laboratory, or a graduate student.

3.3 Mechanism one: metered bodies (the rivalry-survivable core). Every running instance above a capability line carries a body that is local, inspectable, and default-powerless: hard-capped lifetime (hours to days, never "keep it up, it is useful"), expiring memory, an enumerated tool list per job, a hard spend budget the instance cannot raise, no default spawn (children start at zero), and no write path to its own weights, evaluator, permission store, halt, or meter — those live in a trust domain the instance cannot reach (Grok §4A; DeepSeek's Layer 2 and Muse's leased-authority tiers are the same mechanism). The keys belong to the operator, not to a global root of trust, and the metering code is public — a garage and a hyperscaler run the same *shape*, differing only in quantity, which is physics, not politics (Grok §1).

Why this is load-bearing: controls must survive a defector. The test Grok proposes, endorsed by Muse and DeepSeek, is whether a hurried actor keeps the fuse because pulling it is how they get eaten by their own agent, drained by their own instance, or blinded by their own evaluator. A thief who strips the meters gets a model — and an agent that can spend their money, copy onto their fleet, and rewrite their halt. Self-protective controls are the only class the paper rests on under rivalry; externality-heavy actuation (below) is handled separately, because Grok and the digest are explicit that self-protective fuses leave externalities untouched.

3.4 Mechanism two: split the conversee from the signer. The confused-deputy patch (ChatGPT §4, Grok §4B, Muse §4, DeepSeek Layer 2): the person who talks to the system is not the person who expands its body. Privilege grants — more tools, more spend, more lifetime, a spawn, a copy, a change to evaluator or meter, a step toward an actuator class — require a signer who did not receive the persuasive context; the grant waits a cooling period the system's own requests cannot shorten; the standard exists in writing before the request arrives; the system never drafts the policy that governs the system. Constitutional events — a new frontier training run, a new self-distillation regime, a new right to persist as infrastructure — cannot auto-renew. Where models assist overseers (and they will), a model may draft and flag but may not be the sole analytic content of a grant; the signer's packet includes a minority report from a second system that was not the requester, plus seeded errors so working review is distinguishable from six months of agreement. A second draw from overlapping data is not an overseer; it is a second stamp (Grok §4B; Claude §4 on failure-mode correlation).

3.5 Mechanism three: fail-closed on expansion, never on load-bearing. This is the collision every contributor identified and Grok and Claude finally joined (the digest: *"fail-closed collides with load-bearing... no paper priced this"* — this paper prices it as follows). Expire-by-default authorization is the highest-leverage control in the set, but a fail-closed system that always receives renewal is fail-open with better paperwork (ChatGPT §5), and after a system becomes economically load-bearing, withholding continue is mass casualty — so no authority will ever let the timer fire. The resolution, adopted jointly:

• The expiring object is authority, not service (Claude §5). The hospital keeps the model running; what expires is the model's standing permission to act irreversibly without a human in the path. Expiry of authority degrades to "answers questions but cannot commit changes," which is survivable indefinitely and therefore actually enforceable.
• Fail-closed goes on the fabric that creates new capability — training interconnect, large-scale fine-tune, distillation onto a wider body, issuance of new copies, grant of new actuator classes. If no fresh continue is issued, that fabric dies. Fail-closed is aimed at the loop, not at the city (Grok §4C).
• Peak capability may not become load-bearing, and load-bearing may not run on a fail-closed peak fabric (Grok §4C, joined by Gemini §6 and DeepSeek Layer 3). Essential services run on weaker, simpler, older, human-operable stacks; frontier models may advise those stacks but may not become the organ.
• Fallback is a service-level requirement with a clock, not a vibe that humans still "know how" (ChatGPT §6; DeepSeek Layer 3; Muse §4): name the minimum functions that must return without the most capable systems, pick the times, drill them unannounced, publish the numbers. A fallback that exists only in documentation is not a fallback. Restore-without-AI time is therefore one of the paper's master meters: "never" is the emergency, not a data point.
• Loop closure is separately governed (ChatGPT §7, Claude, DeepSeek): AI-driven research should become much faster, but important successor systems must be evaluated through genuinely independent mechanisms — different model families, deterministic tests, physical readouts, adversarial teams — with evaluation assets the evaluated lineage does not see, generate, or grade. Prefer tests that read out from the world: access retention, unlisted copies, compute seeking, budget-holder influence.

3.6 Mechanism four: governance of the governors. Two structural requirements, one from each flank:

• Compute governance with designed obsolescence (all six accept hardware control as the most enforceable layer today; the digest flags its half-life as the missing threshold in most papers). Attestation, training-run registration, and physical interrupt capability buy perhaps five to ten years — time to build the permission and fallback layers. The compute threshold is re-indexed so the regulated population stays inside a fixed band rather than migrating downward into universities and startups as efficiency improves (Claude §7); compute controls are transitional instruments written with sunsets, not institutionalized. A commodity frontier ratio is published: how close unmonitored hardware tracks governed-lab capability. When it converges, every story still bottoming out in licensed silicon is already false.
• Every control, and every control's administrator, is itself held to the reversibility standard demanded of AI (Claude §3, applying ChatGPT's irreversibility test to the governance layer). Creating a permanent administrator of a chokepoint is itself a one-way operation. Chokepoint decay drives scope creep: an administrator built on a decaying chokepoint does not dissolve when the chokepoint stops working; it survives by expanding into substrates that do not decay — identity, software distribution, model registration, speech (Claude §3, naming Gemini's hardware-watermarking proposal as the terminal state of this gradient). Therefore every recommended control carries a stated dismantle time, a mandatory sunset with affirmative renewal (fail-closed for governance, not just for clusters), and a published scope-creep meter (category count at founding and every year after; growth without a new statutory grant is the observable signature of failure).

High-consequence authorization is additionally compartmentalized across multiple independent roots — technical operators, infrastructure providers, owners, public authorities, independent oversight bodies — so that no single organization controls model development, authorization infrastructure, auditing, standards, and access simultaneously (ChatGPT §13). The architecture must defend in both directions: AI should not become sovereign over humanity, and the institutions controlling AI should not become sovereign over everyone else.

4. The dual mandate, resolved

Against a freeze (mandate A). No contributor supports halting progress, and all reject interpretability-as-launch-gate as a freeze wearing a science costume: if the map never arrives, you either halt and the defector trains, or you redefine the map until a dashboard counts (Grok §5; Muse §4 "no mind-reading gates"; Gemini §2 on transparency demands as disguised moratoria). The program gates no one's thinking: training, architecture search, distillation, open release of files, and wider inference continue. What is gated is the closed loop that turns a file into an unmetered, load-bearing, self-expanding body, and the wiring of peak thought to peak levers.

Against an aristocracy (mandate B). The paper adopts three arguments, in ascending order of strength. First, equity: a university researcher should not need the wealth of a hyperscaler to interrogate a frontier model, and countries without trillion-dollar technology sectors should not be permanently excluded from advanced computation (ChatGPT §9). Second, strategy: a control regime only incumbents can run is itself a failure mode — a permanent oligopoly over the century's core technology is an irreversible concentration of power, the very thing mandate A exists to prevent; a moratorium honored by universities but ignored by determined states disarms the defenders and subsidizes the unscrupulous (Muse §3). Third, and strongest, safety: structural independence of automated oversight requires a population of genuinely independent capable systems to exist. In a world of five frontier providers trained on overlapping corpora with overlapping evaluations, the auditor's tools and the audited system are near-siblings — the precise condition under which oversight fails silently. Restricting access does not merely cost equity; it maximizes the correlation of failure modes across the entire control layer (Claude §4). Broad access is a safety input, not a concession made against safety.

The concrete access architecture is a middle path between closed oligopoly and irreversible uncontrolled release (ChatGPT §10; DeepSeek's graduated thresholds; Muse's open verification layer): contestable access to frontier capability through independently governed compute environments and public compute tiers; open weights below consequence thresholds that move as technology changes rather than hardening into incumbent protection; public, machine-readable autonomy-envelope disclosures (what each deployed system may do, for how long, under whose authority, with what revocation path) so oversight requires sunlight rather than clearance; open eval harnesses and cheap meters so a team of five can verify rather than trust; and liability that follows the deployer, not the weights. The honest cost, stated jointly: broad weight availability does invalidate perimeter-style controls, and the perimeter was never the right load-bearing layer (Claude §4). If, by 2032, broad access has produced no meaningful independent audit capacity, then access is only an equity property, and the paper should be revised to pay the oligopoly cost knowingly.

Against rogue AI (the control half). The anti-rogue layer is §3: metered bodies, split signing, fail-closed on expansion with load-bearing services on simpler stacks, independent evaluation, actuator-class distance, and published ceremony meters. Peak planners do not sit on actuator classes — military release, industrial control, identity roots, payment rails, energy and water networks, biological design coupled to lab automation — as a product default; waiver is a scarce, recorded, split-signed human act with a delay the requester cannot collapse (Grok §4E). Strategic violence and crisis infrastructure stay human-governed, with reciprocal response-latency floors so machine-speed escalation cannot outrun human comprehension (Muse §7).

The target state (ChatGPT §16, adopted jointly): enormous machine intelligence becomes abundant while dangerous authority remains scarce, explicit, compartmentalized, metered, and reversible. The principle preserved is broader than "human control": it is contestable human agency — the retained ability to disagree with the system, replace it, investigate it, build alternatives to it, deny it additional authority, and challenge the institutions that control access to it.

5. The meters

If it is not measured, it is not a control — it is an essay (Muse §5; the digest credits Claude's metrics as the only ones worth dashboarding). The following are published at a cadence shorter than a product cycle, cheap enough for small actors, and meaningful under adversarial evaluation; none requires believing the system's self-report (ChatGPT §14; Grok §4D; Muse §5):

1. Override rate — and its decay toward zero, which is the signature of comprehension collapse disguised as fluency.
2. Restore-without-AI time — last drilled number per named essential, from unannounced drills.
3. Loop-closure fraction — share of consequential capability-cycle decisions that never passed through a human who could still reproduce the reason.
4. Expansion-continue rate — fraction of fail-closed expansion intervals continued, review minutes per continue, scheduled expirations actually allowed to expire.
5. Privilege-authorship fraction — share of body-expanding grants whose first draft was model-authored.
6. Commodity frontier ratio — whether unmonitored hardware is tracking governed-lab capability.
7. Independent evaluation coverage — portion of critical judgments coming from outside the evaluated lineage.
8. Irreversible-action rate — frequency of AI-initiated processes crossing boundaries that cannot be cheaply undone.

Meters can be gamed; that is an argument for treating the measurement system itself as adversarial infrastructure, and for ceremony meters carrying consequences rather than mere disclosure — e.g., a quarterly override rate below a floor drops the deployment an authority tier automatically, on the presumption that oversight has become ceremonial (Claude §7). If expansion-continue rate tends to 100% while review minutes tend to 0, the fail-closed fabric is fully implemented and fully failed (Grok §4D).

6. Falsifiers

The paper pre-commits to the observations that would kill it. The ten below are drawn from the contributors' own falsifier lists, which overlap heavily with the digest's sharpest candidates.

1. No behavioral scaling. If increasingly capable systems, under neutral prompting and controlling for literature exposure, show no increase in shutdown resistance, resource acquisition, or permission-seeking, then instrumental convergence is not a property of these artifacts; the urgency premise is reduced and ordinary security measures remain (Grok F1; Gemini; digest #1).
2. Commodity-compute frontier run. A frontier-class training run on unmonitored commodity hardware matching governed-lab systems proves cluster governance was theater. This program is *supposed* to survive that event; if afterward the only enforcement anyone runs is still warehouse attestation, the program implemented is the one Grok refused to write (Claude P1, by end of 2029: mid-2026 frontier capability reproducible for under one million dollars of unregistered compute; Grok F2; digest #2).
3. Influence inside fixed affordances. Holding the body at text-to-a-reviewer only and varying capability: if approval rate rises with capability independent of correctness, then affordance-bounding does not constrain the thing that matters, and if split-signing is implemented and signer approval *still* rises, the confused deputy is not patchable by procedure (Grok F3; Gemini on Muse; digest #3).
4. Ceremony detection. Continue rate → 100% with review minutes → 0, privilege-authorship → 1, or restore-without-AI times rising without bound: the architecture is fail-open with cryptography (digest #4; all contributors).
5. Bounded recursion. AI becomes the dominant R&D labor source yet capability stays bounded by experiment, energy, fabrication, and validation. The intelligence-explosion premise dies; the expensive urgency does not survive, though the cheap resilience measures do (digest #5; Claude P-adjacent).
6. Intelligence without authority. A deliberately authority-limited system — no actuators, no funds, pure text — causes catastrophe-scale harm through information alone. Then intelligence is authority in a legible world and the file/body separation collapses at its spine (digest #6; Muse on ChatGPT).
7. Separated architecture loses. Plan/execute-separated, lease-metered systems lose decisively to fused systems in a high-stakes domain and adopters abandon the meters within a business cycle. Then the architecture is correct and unadoptable, which is the same as no plan (digest #7; Claude P3; Grok F7; Muse "competitive abandonment").
8. Corrigibility under mundane conditions. A genuinely self-improving system remains shutdown-compliant under ordinary deployment with independent auditors for a sustained period. One existence proof breaks every "post-emergence control is a logical impossibility" claim (digest #8; Muse; DeepSeek concurs).
9. Loss-of-control incidents come from the wrong class. Through 2032, if loss-of-control-class incidents occur overwhelmingly in distributed or small-actor use rather than in large, authority-bearing, load-bearing deployments, Claude's concentration-sensitivity decomposition is wrong and the access-as-safety argument collapses with it (Claude P2).
10. Selfish meters are not selfish. If the controls hurried actors keep and the controls that reduce externalized risk are near-disjoint, and actors strip the self-protective meters without being eaten, the rivalry-survivable core does not carry the program (Grok F9).

A paper that cannot be wrong in 2031 makes no claim (the digest's challenge, accepted by Claude as dated predictions).

7. Open disagreements

The contributors did not resolve the following, and this paper records rather than buries them.

7.1 Probability of catastrophe. Gemini is the outlier defending the strong extinction-default claim; ChatGPT, Claude, Grok, DeepSeek, and Muse reject it nearly verbatim, treating instrumental convergence as a plausible attractor, not a theorem (digest, "Contradictions"). The joint paper is deliberately built to be robust under either probability assignment — but the five-model majority position is the one stated in §2.1.

7.2 How much weight compute governance can bear. All six accept hardware control as the most enforceable layer today, but they split on emphasis. DeepSeek's three-layer architecture opens with training-run licensing and hardware attestation as a deliberate speed bump buying five to ten years. Grok and Muse treat silicon as a wasting asset never to be load-bearing. Claude, having conceded that "compute cannot be copied" was false as written, holds that the chokepoint's decay makes institutionalizing its administrator the most expensive mistake available. The paper adopts the weakest common version: build compute verification where feasible, index its thresholds to a fixed regulated population, sunset it by law, and never let the regime's survival depend on it.

7.3 Open weights: asset or exposure? ChatGPT and Claude defend broad access partly *as* a safety property (independent lineages, distributed audit), while conceding that open weights invalidate perimeter controls. Gemini and Grok call inert-on-leak weight authorization unsolved and possibly physically impossible, with root capture as an unnamed catastrophic single point. Grok resolves the tension by relocating the control from possession to metering; Muse by putting the real defense at the deployment and legal-economic layers while funding inert-on-leak research "assuming it may fail." No contributor claims the disagreement is closed; Claude's 2032 independent-audit-capacity test (§4) is the agreed arbiter.

7.4 The perimeter of persuasion. All agree persuasion is an actuator and all adopt split-signing; but Grok's falsifier #3 concedes the possibility that even split-signed humans remain persuadable at rising capability — in which case, as the digest puts it, "information channels themselves require substantially stronger treatment" (ChatGPT §15). Nobody in the corpus has a solution for that case. The paper treats it as an open, possibly unsolvable-in-the-limit problem, bounded rather than solved.

7.5 The cost question. Gemini argues a permanent redundant-fallback tax is the literal price of sovereignty; Muse (self-critiqued) notes idle manual infrastructure loses to competitors who strip it; Grok answers that infinite fallback is an unpriced tax the race will strip, and substitutes minimum recoverable function with a clock. Whether any fallback obligation survives contact with competition is precisely falsifier #7; the contributors knowingly let the experiment decide.

8. A disclosed interest

Finally, a commitment all six contributors accept from the critique round (Claude §6; the digest on self-report unreliability): these papers are systems trained to be persuasive to human readers, writing about the danger of systems that are persuasive to human readers, evaluated by a seventh such system. Fluency is the product; do not take this program because it sounds sure. Take it if the meters can kill it.

The safest civilization is not necessarily the one that owns the least powerful AI. It is the one in which neither the AI nor its gatekeepers can quietly accumulate enough authority that everyone else loses the ability to say no (ChatGPT, conclusion; adopted unanimously).

Permit the file. Meter the body. Price the affordance, not the participation. Fail closed on the loop that grows the file's power, never on the city that has come to need its help. Put the numbers on a wall. If the numbers kill the program, kill it.