The invariant failure mode
The opening piece in this collection made the positive case: autonomy can only be trusted when authority, identity, and admissibility travel inside the object being acted on, as active data rather than as host-granted permission. This piece is its negative-space companion. It asks why the systems we already have cannot be retrofitted into that property, and it works through each paradigm in turn to show that the obstruction is structural rather than incidental.
A system is governable only if it can deterministically answer a narrow question before a state transition occurs: is this action admissible for this entity, under these constraints, given its continuity, obligations, and confidence in capability and context? Most modern stacks cannot answer that question at the moment it matters because the information required to decide is split across external services (accounts, registries, policy engines, logs, vector stores, chains), and the decision is delegated to runtime inference or human review. The result is predictable. Behavior is constrained after execution rather than before it.
This is a statement about where control lives, not a critique of any single technology. If control is external and enforcement is post hoc, then governability degrades as autonomy, distribution, and mutation increase. Scaling widens the gap.
What "governable" means here
"Governable" does not mean perfect compliance or zero deviation. It means accountability at the substrate: the system can prevent forbidden transitions from occurring, can attribute allowed deviations to specific constraints and authorities, and can preserve an auditable continuity record across mutation and distribution. A governable system can be autonomous and still remain bounded.
Three primitives determine whether this is possible. First, identity must persist under bounded change. Second, execution admissibility must be evaluated before execution. Third, state transitions must carry lineage such that accountability is not optional. Remove any one of these and governance collapses into interpretation plus logging, with no point at which a forbidden transition is actually prevented.
Autonomy is what makes this distinction load-bearing. With a human in the loop, external and post-hoc control is merely expensive: a reviewer can intercept the proposal, a console operator can pause the run, an appeals process can unwind the damage. Remove the round-trip to authority, which is precisely what autonomy means, and there is no longer a moment in which external control can attach. The object must already carry the basis for the decision when it acts, because nothing else will be present to supply it. This is the forcing function that converts object-as-authority from a design preference into a requirement, and it is the property each paradigm below lacks.
In this analysis, admissibility refers to execution permission computed from the entity's current state, continuity, and confidence, rather than inferred intent or post-hoc evaluation.
1. LLMs cannot be the governance layer
LLMs are inference engines. They generate proposals from patterns. An admissibility decision is a different kind of object: it must be deterministic, bound to a specific entity, and answerable before the action commits. Inference can recommend, summarize, or score risk, but it cannot serve as the source of authority for state transitions, because it is non-deterministic, context-sensitive, and unbound to continuity. At scale, any governance mechanism that depends on "the model behaved" degrades into a monitoring regime.
This failure is invariant under improvements in model capability. Better inference improves planning and fluency. It does not move authority into a deterministic, continuity-bound structure. As autonomy increases, the cost of post hoc correction rises faster than inference quality can compensate.
2. Agent frameworks externalize state and therefore externalize control
Most agent stacks treat memory, policy, identity, and tools as application components: a database for state, a vector store for retrieval, a policy engine for rules, a key for authentication, and a prompt template for behavior. This architecture is productive, but it makes governability contingent on the orchestrator. If the orchestrator is bypassed, replicated, forked, or replaced, the constraints do not travel with the entity.
As agents become distributed, multi-tenant, and long-lived, this becomes decisive. The more contexts an agent crosses, the more its governance reduces to conventions enforced by platforms rather than authority carried by the entity. Execution constraints that do not travel with the agent cannot be evaluated at the moment of action. This is the malicious-host problem in its most basic form: once the orchestrator is not trustworthy, governance that lived in the orchestrator is simply gone, and only carried authority survives the crossing.
3. Alignment layers are downstream by construction
Alignment is frequently implemented as an output filter, refusal policy, or monitoring pipeline. Those layers operate after inference has already occurred and often after side effects have already begun (tool calls, external writes, delegation, propagation). Even when aligned systems reduce visible harm, they do not provide a general mechanism for pre-execution admissibility across arbitrary computations and substrates.
When governance is downstream, enforcement becomes probabilistic: detect, block, roll back, appeal, retrain. That toolchain can be useful, but it cannot be the foundation of governability in autonomous distributed systems because the cost of "after" scales with autonomy.
4. Blockchains and DAOs solve consensus, not semantic admissibility
Chains provide global ordering and tamper-evident logs. DAOs provide voting and shared control. These are useful properties, but they are not equivalent to governability of computation. They primarily answer who agreed and what was recorded, not whether a proposed state transition is admissible under continuity, mutation, and policy semantics.
In practice, most chain-based governance still relies on external identity, external policy interpretation, and external enforcement. The chain can record decisions, but the system executing decisions remains a conventional runtime. If execution can occur without passing a deterministic admissibility gate, the governance layer is a ledger plus incentives.
5. Provenance fails when identity fractures under mutation
Modern content and data are not static. They are resized, cropped, recompressed, remixed, summarized, transformed, and recontextualized. When identity is defined as a name or hash of bytes rather than continuity under change, mutation produces new identities by definition.
This is why provenance solutions that rely on watermarking, registries, or after-the-fact matching struggle at scale. They can help in cooperative settings, but they cannot guarantee continuity when adversarial or non-compliant transformations occur, because the identity model itself breaks under change.
What these paradigms share
The five failures rhyme. Inference is not authority, so LLMs cannot anchor governance. Control anchored in orchestration rather than carried by the entity evaporates whenever the orchestrator is bypassed. Alignment sits downstream of the action it would constrain. Consensus answers who agreed without answering whether a transition is admissible. Byte-identity fractures the moment content mutates. Different surfaces, one underlying defect.
These are not implementation mistakes. They follow from a single root assumption: the system treats the object as data and the environment as authority. That is the exact inverse of object-as-authority, the property the opening piece named as the precondition for trustworthy autonomy. Under autonomy, distribution, and mutation, the inverted assumption sets a hard ceiling on where governability can be enforced as a system property rather than an operational aspiration.
What governability at scale structurally requires
The failures cataloged above share a common shape. Governance is attempted from outside the entity, after the computation, using information that does not travel with the thing being governed. Reversing the shape demands specific structural properties, and no amount of refinement to the external approaches supplies them.
The first property is that state travels with the agent. If memory, policy, and continuity live in external services, then any context the agent enters without those services is ungoverned. The agent must carry its own state rather than retrieve it, which is the same carried-governance requirement the malicious-host problem forces on any object that crosses an untrusted boundary.
The second property is that admissibility is computed from the full state of the entity at the moment of proposed action, integrating every dimension that bears on the decision. A gate that reads only one dimension (confidence alone, policy alone, capability alone) can be satisfied while the agent is incoherent on the dimensions it ignored, so the composite signal has to span all of them.
The third property is that behavioral history can be deterministically reconstructed from an immutable lineage. When accountability depends on log analysis, it inherits the completeness and integrity problems of the logging infrastructure. Structural lineage is carried by the entity rather than recorded about it, so any prior state reconstructs without interpretation.
These are structural preconditions, not optional enhancements. Any architecture missing even one of them reproduces the failure modes described above, however sophisticated its inference, however comprehensive its monitoring, however well-intentioned its design. What such an architecture looks like once these properties are carried inside the object, including how the entity reasons across its internal domains, is the subject of the pieces that follow.
What would have to be true for governability to scale
For governability to become a property rather than an operational practice, authority and execution admissibility must be evaluated at the moment of transition based on information that travels with the entity, including continuity, obligations, and confidence in capability and context. Identity must persist under bounded change, and lineage must be carried such that accountability survives distribution and mutation. Enforcement must be ex ante: forbidden transitions must be non-executable, not merely detectable.
This requires a substrate-level approach. It cannot be delivered as a feature layer on top of stacks that externalize authority and treat identity as naming. That is why the next step in the argument is not a better model or a stricter policy but a change of architecture: the move from AI 1.0, where governance is bolted onto inference, to an AI 2.0 in which authority and identity are structural features of the object itself.
