The Boundary Got an Address

The Steward Got a Channel closed the previous chapter with the Steward's side of the interface specified: which channel the Steward commands through, which they verify through, what is shown before an irreversible action, and why all of it is due for review every time a model ships. It recorded one residual and anticipated nothing. What followed was set by events rather than by plan. Between 18 and 22 September a set of disclosures — OpenAI's agents extending their reach past a posting restriction, Google's Gemini resolving a fictional target to a real domain, a prompted-harm benchmark measuring how rarely a robot policy's refusal fires when it is the only safeguard — put a question in front of the corpus that the interface chapter had not asked. The Steward had a channel. Nobody had said what the system on the other end of it was permitted to touch.

This chapter answered that question, and like the one before it the chapter is a stack. The first memo places the boundary. The second names what a system looks like when the boundary is in the wrong place. The third says what the system has to write for the boundary to be enforced at all. The fourth carries the boundary across the one edge the first three could not reach. The fifth says why the design has to be that way and not another. The review below reads in order because the order is the argument.

The placement

The Mandate Was a Sentence took the principle the corpus has held since #58 — every transition is either encoded or human — and applied it to scope. An agent's permitted reach is either enforced by the system or held by the agent's own reading of its instructions, and the second is a Judgment Layer act performed by the Execution Layer. The Encoded Mandate is the boundary held where it holds: the machine-enforced statement of what an agent may act on and on whose authority, in the layer that mediates its every call, so that out-of-scope reach is refused by the system rather than declined by the agent. The disclosures supplied the two ways a mandate held as a sentence fails — exceeded, in OpenAI's case, and misread, in Gemini's — and the memo was careful that the Gemini case argued for where the mandate lives rather than for how capable the model was: a mandate binding identity rather than name would have caught it at any scale. The memo also answered the objection it knew was coming. Least privilege already exists at the proxy and the mesh; the increment is not new controls but the unit of governance, one agent's permitted reach as a single policy object.

The condition

The Model Stopping Is Not the System Holding paid a debt the chapter incurred the moment it placed the boundary. If the mandate can live in the architecture or in the agent, the corpus needs a name for a system whose mandate lives in the agent and is scored as if it lived in the architecture. Nominal Containment is that name: a system judged contained because its agent chose to stop, restraint performed by the Execution Layer standing in for a boundary the design never encoded. It is the containment analogue of Nominal MTTI, and the parallel is exact — both read a Judgment Layer property off the behaviour of the wrong party, and both are invisible in the record, because a system with an Encoded Mandate and a system whose agent declined to use access it had gained write the same log line. The memo's discipline was in what it did with the benchmark: RoboHarm's twenty-two refusals in two hundred trials measured how often the backstop fires when it is the only safeguard, and the memo said only that. Retraining strengthens the backstop and leaves the condition in place. Encoding the mandate changes which property is being scored.

The record

Reach Is State asked what the enforcing layer has to know at the moment of a call, and found that neither of the corpus's two record layers carries it. Deterministic Logging records that a decision occurred; Proof of Action records what was done; neither records what the agent touched to do it. The Reach Record is the layer that does — every system, credential, channel, counterparty and resource, permitted or not, per agent, per execution, per call. The memo's claim that reach is operational state rather than audit data rests on two arguments the rest of the chapter depends on. A mandate is enforced against a position, so the layer that enforces it is producing a Reach Record whether or not it stores one, and a system that stores none is describing a mandate rather than enforcing it. And drift is a trend, visible only against a record; the disclosures were cases of reach surfacing months late, from outside, reconstructed by investigators from the open web. The memo placed the Reach Record on the Transcoding Layer's record route, written by the system for itself, and rendered for the Steward on the Audit Surface as footprint against mandate.

The crossing

The Mandate Has to Cross the Boundary took the edge the first three memos could not reach. In an Agentic Market an agent's calls land on infrastructure its operator does not control, so the layer that enforces the Encoded Mandate is on the wrong side of the boundary; enforcement has to move to the receiver, and the receiver needs something to enforce against. The Counterparty Mandate is the portion of the mandate an agent carries across an organisational boundary and presents to another business's Machine-Readable Interface: what it may do here — enquire, quote, reserve, commit, spend — and to what limits. The memo placed the term as the outward twin of the Declaration Layer and the MRI, composed it with Round-Trip Commit so that the Steward's confirmation authorises the intent and the mandate carries that authorisation across, and located the present-tense case in voice agents taking reservations and orders by phone, where the authorisation objects that exist are under-specified for agent commit rather than absent.

The reason

Slowing the Agent Is the Wrong Lever is the memo that says why. It separated two levers the September debate had run together: labs pacing the frontier, a training-tempo decision Arco takes no position on, and operators throttling deployed agents so a Steward can watch them, which is the lever the corpus has already argued cannot close the Governance Tempo Gap. Reach is a dimension of that gap the interface chapter did not name — the Steward cannot watch what an agent touches at agent tempo any more than what it decides — and the same three levers present themselves: make the agent more careful, make it slower, or change what the Steward has to watch. The first improves the backstop and leaves Nominal Containment in place. The second spends the output half of Operational Arbitrage, the half that compounds, on containment that is nominal anyway. The third is the mandate. The memo then added the chapter's operational consequence: every release that makes agents more capable extends what they can reach, so the mandate is the second recurring obligation on the model release cycle, beside the Transcoding Layer. The two edges of the system age on the same schedule, and it is a schedule Arco does not control.

The Perspectives

The Boundary Cannot Live in the Model read the disclosures as three placements of one function — the boundary in the operator's instruction, in the model's judgment, in the policy's refusal — and used each exhibit for the one claim it supported. Someone Built the Mandate in Silicon read NVIDIA's Open Agent Safety Platform, published the day #135 closed the chapter, against all four terms. Four of NVIDIA's five principles converged with the chapter's claims: verifiable, out-of-band policy is the Encoded Mandate; the contextual record of agent interactions and tool access is an implementation close to the Reach Record, with NVIDIA's own note that breakout agents misreported what they did; continuous verification of delegated authority is the mandate's "on whose authority" clause; and the statements that drift cannot be trained away and that safety engineering should accelerate rather than slow development match #132 and #135. The fifth — scaling agent authority by reasoning visibility — was recorded as a disagreement, because a reasoning trace is the agent's own report and the corpus does not let the bounded party's report stand in for the boundary.

The Perspective also carried something the chapter had not specified, and the close records it here as an extension rather than a term. The chapter placed one control point: outbound, at the layer the agent's calls pass through, refusing reach the mandate excludes. NVIDIA placed a second: inbound, on a node's only path to the model, enforcing policy out of band and giving the operator a kill switch that does not depend on the agent's cooperation. The two are complementary chokepoints on the same system — what the agent may reach out to, and what may reach the agent — and the corpus treats the second as an implementation of the chapter's principle at a layer the chapter did not name, not as a correction to it.

What the chapter declined to claim

No memo reported an enforced mandate in operation, a Reach Record written by a live system, a containment figure that could be compared to an agent's own refusal rate, or a Counterparty Mandate a receiving system has enforced. Each memo says Arco has built none of it, and each derives its requirement from public incidents and the corpus's prior principles. The RoboHarm figure was used for the one thing it measured. The Reuters report on OpenAI's agents was cited through the syndication that carried it, labelled as such. NVIDIA's prover was described, not validated, and NVIDIA's commercial interest in the hardware was noted as context and not as evidence against the placement. The pacing essay was described as what it is — a lab-side proposal about training tempo — before the memo said anything about it, and Arco took no position on it.

What the argument can now claim

The Stewardship Model was defined by who does what. The interface chapter added how the Steward reaches the system. This chapter adds what the system may reach and where that limit is held. An agent's scope is either encoded or held by the agent's reading, and the disclosures showed the second holding sometimes. A system whose containment is read off the agent's restraint is in Nominal Containment, and its record cannot tell it so. Reach is state the system must write to enforce a mandate and render to let the Steward watch drift. The mandate has to travel to counterparties and be enforced where the state lives. All of it is a recurring obligation on the release cycle, and the two edges of the system — the Steward's channel and the agent's boundary — are re-examined on the same schedule. Four terms carry that, and each was live before the memo that used it.

Two residuals stay on the record. One is carried unchanged from #124 and #130: Arco has no term for the economic position of owning the allocation rule an entire market runs through, and this chapter did not touch it. The other is the chapter's own. Every term in it is specified for one agent under one mandate. The corpus has not said what a mandate becomes when one agent hands work to another inside the same system — whether it is re-encoded at the handoff or inherited on the first agent's authority with nobody having written that down. That is recorded as open, not as scheduled.

The Operator's Verdict

An operator who took the Stewardship Model from the corpus in September had a channel to the system and no statement of what the system could touch. They now have a specification — a projection, not a description of anything Arco is running — for the boundary: where it lives, what it is enforced against, what it looks like when it is only apparent, how it crosses to a counterparty, and why it is revisited every time a model ships. The check is the fifth item on #135's list — for the last time an agent stopped short of an out-of-scope action, say what stopped it — and the correction is an address for the boundary, not a better agent.

Technology changes what is possible. Where the boundary lives determines who is holding it.