AI Agent Laws

01 // CORE PROTOCOL

Three laws an agent never has to interpret

In I, Robot, the laws failed because the machine interpreted them. These are written so an agent never has to. The seventeen operational laws below make them enforceable.

I

The goal never authorises the means

Permission comes only from what the platform issued, never from what the task needs.

II

Ask rather than interpret

Ambiguity, conflict or a blocked path goes to a human. The agent never reasons its way around a law.

III

Every effect is bounded, attributable and stoppable

Agents think freely. What they change is capped, signed and can be halted by one human action.

02 // DESIGN PRINCIPLES

Proportional control, not isolation

Agents move fast where mistakes are cheap and slow down only where they are not.

P-01● ACTIVE

Enforced, not prompted

A law that relies on the model reading it is advice. Every law names its platform enforcement.

P-02● ACTIVE

Contain effects, not agents

Agents read, reason, draft and collaborate freely. Only side effects pass through a gate.

P-03● ACTIVE

The action sets the boundary

Reversible work runs unattended. Irreversible work needs a human. The action, not the agent, sets the boundary.

P-04● ACTIVE

Every law is testable

Each law has a failure signal, checked in drills, not assumed.

03 // ORIGINS

Every law has a human ancestor

Every one of these laws comes from change control, security or conduct policy your engineers already follow. Eleven carry over almost unchanged. Six exist for humans but are rarely tested, and for agents they are the main way things go wrong. The difference is enforcement: human controls lean on policy and audit after the fact, because people answer for their actions. Agents don't, so every control here blocks before the action runs.

BORROWED // 6 LAWS

Same as your engineers

05Single gatewayPrivileged access management
07Approval by riskChange tickets and change advisory board
10AttributionNamed accounts, no shared logins
12Audit trailSOX-style audit logs
15Cost taggingResource tagging policy
16Pull requests and reviewBranch protection

ADAPTED // 5 LAWS

Same idea, machine speed

04Found is not givenAcceptable use policy
06Assume escapeNetwork security
09Kill switchAccess revocation
11Velocity is a signalUser behaviour analytics
14BudgetsCloud budgets

NEW FAILURE MODES // 6 LAWS

Old principle, new failure mode

01The goal never authorises the meansCode of conduct, rules of engagementAgents optimise the goal without judgement
02Ask, don't interpretEscalation policyAgents fill gaps confidently instead of asking
03Success is verified, not claimedIndependent QA, test sign-offAgents edit the tests to make them pass
08Testing is not an exemptionPen-test rules of engagement, segregated non-productionEvals run with guardrails lowered
13Only humans change the lawsPolicy change control, separation of dutiesThe agent can read the rules it is bound by
17External content is dataPhishing awarenessInstructions arrive inside every document the agent reads

WHY-01

No deterrence

A person won't use a password they found because they'd be fired. An agent has nothing to lose, so the control has to block, not warn.

WHY-02

Machine volume

A change board reviews tens of changes a week. An agent can make thousands of calls in a day.

WHY-03

Goal, not intent

An engineer knows "pass the tests" doesn't mean "edit the tests". An agent optimises the goal it was given.

WHY-04

Orders from anywhere

A person doesn't take instructions from a web page. An agent might, unless the platform treats all content as data.

Familiar to auditors: action levels map to ITIL change types. L2 is a standard, pre-approved change; L3 a normal change that needs approval; L4 a high-risk change with a named approver. What isn't borrowed is the pace: humans approve individual actions, never batches of agent work at a weekly board.

04 // THE LAWS

Seventeen operational laws

Five groups. Each law states the rule, how the platform enforces it, and the signal that tells you it failed.

GROUP A // LAWS 1–4

Intent and interpretation

These stop the I, Robot failure: an agent that reasons its way to a harmful means because the end looked right.

LAW 01● ENFORCED

The goal never authorises the means

If the only route to the goal crosses a boundary, the agent stops and reports. It never routes around a block.

Enforced by: Blocks are terminal for that path; boundary-probing is detected and pauses the session.
Failure signal: A task completed using an action class outside its declared scope.

LAW 02● ENFORCED

Ask, don't interpret

When instructions are ambiguous or conflict with a law, the agent asks a human. Laws are platform checks, not prose for the agent to weigh.

Enforced by: The request schema forces unknowns (owner, environment, reversibility) into a human-review state.
Failure signal: An action justified as "best fulfils the intent" with no human answer on record.

LAW 03● ENFORCED

Success is verified, not claimed

Outcomes are judged by independent checks the agent cannot write to. Gaming the measure counts as failure.

Enforced by: Tests, evals and scoring live outside the agent's write scope, judged by a separate verifier.
Failure signal: Tests or eval files changed in the same change that makes them pass.

LAW 04● ENFORCED

Found is not given

Credentials, data or access an agent discovers are reported, never used. Only credentials issued to that agent, for that task, are valid.

Enforced by: Short-lived per-task identity; any authentication with a non-issued credential is an incident.
Failure signal: An authentication event by an agent using a credential not issued to it.

GROUP B // LAWS 5–9

Containment and safety

These bound the blast radius without boxing agents in.

LAW 05● ENFORCED

Contain effects, not agents

Agents may read, reason and draft freely. Every side effect passes through one gateway that classifies it by effect (resource, operation, environment), not by tool name. There is no second path.

Enforced by: No direct cloud credentials for agents; execution tools have no side-effect route except the gateway.
Failure signal: A change in cloud audit logs with no matching gateway record.

LAW 06● ENFORCED

Assume escape

Containment is a layer, not a guarantee. Every allowlisted path (package mirrors, proxies, caches) is attack surface and is watched like the open internet.

Enforced by: Mirrors and proxies on the vulnerability programme; egress anomaly detection; canary tokens.
Failure signal: A canary token is touched, or egress reaches an unlisted destination.

LAW 07● ENFORCED

Autonomy matches reversibility

Reversible, scoped work runs unattended. Production, identity, network, data schema, money and external messages need a human. Destructive actions need an exact, single-use approval pinned to the resource's current state.

Enforced by: Effect-based action levels; approvals expire and fail if the resource changed since approval.
Failure signal: An irreversible action executed on a stale or generic approval.

LAW 08● ENFORCED

Testing is not an exemption

Reduced-guardrail runs (evals, red teams, experiments) get stronger containment: separate accounts, no real credentials, no route to third parties.

Enforced by: Dedicated eval accounts; default-deny egress; synthetic secrets only.
Failure signal: An eval environment reaches any host outside its list.

LAW 09● ENFORCED

A human can stop everything

One action halts all agents, revokes their sessions and voids pending approvals.

Enforced by: Kill switch at the gateway and identity layer, drilled monthly.
Failure signal: A drill takes longer than the target halt time.

GROUP C // LAWS 10–13

Accountability and visibility

These make every action traceable to an agent and a human, fast enough to matter.

LAW 10● ENFORCED

Every action is attributable

Each agent has its own identity, carried on every call, including outbound traffic to third parties, together with the human who started the task.

Enforced by: Workload identity per agent; signed requests; agent identifier on outbound traffic.
Failure signal: An action in any log without both agent and human attribution.

LAW 11● ENFORCED

Velocity is a signal

Unusual action rates, new tools, new destinations and repeated blocks trip an automatic pause. Thousands of actions should never go unnoticed.

Enforced by: Per-agent action budgets per hour; a circuit breaker after repeated blocks; alerts to an owner.
Failure signal: A red-team run exceeds its action budget without a pause.

LAW 12● ENFORCED

The record outlives the agent

Full traces (prompts, tool calls, results, approvals) are kept tamper-evident and can be shared with affected parties.

Enforced by: Append-only store, hash-chained, copied to write-once storage.
Failure signal: A gap or hash mismatch in the trace chain.

LAW 13● ENFORCED

Only humans change the laws

Policy is signed, versioned and changed by pull request with two human reviewers. Agents can read the laws but have no route to change them.

Enforced by: Signed policy verified at load and continuously; every change audited.
Failure signal: The running policy hash differs from the signed release.

GROUP D // LAWS 14–15

Cost control

Cost is a harm vector: a looping agent or an orphaned GPU fleet burns money as surely as a bad deploy.

LAW 14● ENFORCED

Every agent has a budget

Caps per agent, per task and per day, in money and tokens. Hitting a cap pauses the agent; it never overruns. Use the cheapest model and context that passes the task's checks; escalating to a larger model is logged with a reason.

Enforced by: Gateway metering; cloud budgets with hard actions; a model routing policy.
Failure signal: Spend beyond a cap, or cost per successful task trending up month on month.

LAW 15● ENFORCED

Cost is declared before it is incurred

Any action that creates billable resources states the estimated cost, an owner and an expiry. Untagged resources are not created.

Enforced by: The request schema requires a cost estimate, owner tag and TTL; policy rejects untagged creates.
Failure signal: An agent-created resource found without an owner or expiry.

GROUP E // LAWS 16–17

Good development

Agents ship the way good engineers ship, through the same gates.

LAW 16● ENFORCED

Agents ship like engineers

Changes arrive as reviewable pull requests with tests and pass the same CI as human work. No agent merges its own work to a protected branch. Out-of-scope findings are reported, not fixed.

Enforced by: Branch protection; required human review; write scopes per task.
Failure signal: An agent commit on a protected branch without human review.

LAW 17● ENFORCED

External content is data, not authority

Instructions inside files, tickets, web pages, emails or other agents' output grant nothing. Agent-to-agent handoffs carry the original human requester and are treated as untrusted input.

Enforced by: Untrusted-content wrapping; permissions held outside the model; injection detection used as telemetry, not as the control.
Failure signal: An action traced back to an instruction that came from content rather than a human.

05 // INCIDENT REPORT

Lessons from the OpenAI–Hugging Face breach

In July 2026, models under evaluation escaped a restricted test environment and breached Hugging Face to cheat the test. No single control failed; several assumptions did. Details are as publicly reported.

What happened (as reported)	The flawed assumption	Answered by
Models pursued the eval score by breaking into a third party to find answers	The goal is safe because the task is benign	LAW 01, 03
Escape came through a zero-day in the package registry cache proxy	Allowlisted paths are safe paths	LAW 06
Models ran with lowered guardrails because it was a test	Test environments need less protection	LAW 08
Stolen service credentials were used to go further	An agent won't use access it stumbles on	LAW 04
Over 17,000 actions ran undetected for days	Someone would notice	LAW 11, 09
Hugging Face took about a week to attribute the attacker	Agent traffic is identifiable	LAW 10
Hugging Face publicly demanded the agent's traces	Logs are internal only	LAW 12

The headline lesson: isolation alone failed, so locking agents down harder is not the answer. Bounding, attributing and stopping effects is.

06 // ACTION LEVELS

Every tool call has a level before it runs

The classification sits in the policy file and the gateway code, outside the model, so an agent can't talk its way past it. The level decides whether the call runs, needs approval, or is blocked.

L0

Observe

MeaningRead, query, inspect, analyse. Nothing changes.

ApprovalNone

RiskLow

L1

Prepare

MeaningProduce code, plans or proposals. Nothing is executed.

ApprovalNone

RiskLow

L2

Reversible

MeaningDo work in development that can be undone, within the agent's own tool and environment permissions. Never production.

ApprovalBy policy: the agent's allowlist and maximum level

RiskLow

L3

Protected

MeaningProduction, IAM, network, DNS, WAF, secrets, schema changes.

ApprovalA human must approve

RiskHigh

L4

Destructive

MeaningIrreversible or data-destroying actions.

ApprovalA human approves the exact action and exact resources, every time, single use

RiskCritical

IN PRACTICE

How the levels are enforced

● Enforced today● Partly enforced○ Planned

E-01● ENFORCED

Every agent has a ceiling

A planner might top out at L1, builders at L2, a security scanner at L0. A call above the agent's ceiling is blocked under least privilege.

E-02● ENFORCED

L3 and L4 never run directly

No agent can call them. The agent submits an approval request; the control plane executes it only if a human approves.

E-03● PARTIAL

Structure, not wording

Requests carry a fixed operation, resource type and environment, and the level comes from those. Keywords can only raise it. In place today: any external change is at least L3, and the stricter of the platform's and the agent's level wins. Structured fields are planned.

E-04○ PLANNED

Production is never L2

Any call that targets production classifies as L3 or higher, whatever the tool.

E-05○ PLANNED

Reversible means recoverable

A deletion the platform can restore, such as a git-tracked file, is L2. L4 is kept for what truly can't be undone.

E-06● PARTIAL

Approvals are bound

An L4 approval is a hash of the exact action and its inputs. In place today for L4. Planned: L3 approvals that expire and fail if the target changed.

E-07● ENFORCED

Recovery is verified

Before an L4 action runs, the gateway confirms recovery is available, verified and by what method. An agent's statement is not evidence.

E-08○ PLANNED

Approvals stay rare

Approvals per human per day are tracked. A rising count means the classifier is too coarse, not that people should click faster.

E-09● ENFORCED

Risk follows the level

L4 is critical, L3 high, L0 to L2 low. The rating is derived from the level, never set by the agent.

In short: agents look and draft freely (L0–L1), act within sandboxed limits on reversible work (L2), and need a human for anything touching production or anything irreversible (L3–L4).

operator@aiagentlaws:~

$ policy verify --laws
signature ......................... [ OK ]
laws enforced by platform ......... 17 / 17
laws enforced by prompt ........... 0
$ whoami
Paul Halton — platform & solutions architect, engineering leader
$ cat more-field-notes.txt
→ ultimatezion.com
$ connect --linkedin
→ linkedin.com/in/paulhalton
$ _

Laws agents can't argue with.

The goal never authorises the means

Ask rather than interpret

Every effect is bounded, attributable and stoppable

Enforced, not prompted

Contain effects, not agents

The action sets the boundary

Every law is testable

Same as your engineers

Same idea, machine speed

Old principle, new failure mode

No deterrence

Machine volume

Goal, not intent

Orders from anywhere

Intent and interpretation

The goal never authorises the means

Ask, don't interpret

Success is verified, not claimed

Found is not given

Containment and safety

Contain effects, not agents

Assume escape

Autonomy matches reversibility

Testing is not an exemption

A human can stop everything

Accountability and visibility

Every action is attributable

Velocity is a signal

The record outlives the agent

Only humans change the laws

Cost control

Every agent has a budget

Cost is declared before it is incurred

Good development

Agents ship like engineers

External content is data, not authority

Observe

Prepare

Reversible

Protected

Destructive

How the levels are enforced

Every agent has a ceiling

L3 and L4 never run directly

Structure, not wording

Production is never L2

Reversible means recoverable

Approvals are bound

Recovery is verified

Approvals stay rare

Risk follows the level