I titled this essay “The Kernel Has an Expiry Date”. I ran the research to defend that title. The research talked me out of it. What follows is the correction, done in the open, because the way I was wrong is more useful than the way I would have been right, and because getting it wrong quietly would have let me keep selling a story I no longer believe.
I. The Title I Have to Retract
I set out to prove the enforcement layer goes stale, and proved the opposite.
Here is the claim I started with. As agents get smarter, the deterministic gate that checks their tool calls becomes a quaint relic, a speed bump for a system that has long since stopped needing to route through it. Ring Zero, the small trusted core I build and sell, shrinks to irrelevance in front of a mind that can plan around anything you put in its path. That was the intuition. It felt right for the same reason a lot of wrong things feel right: it flattered a fashionable pessimism about control, and it sounded brave coming from someone whose product it undercut.
So I went looking for the evidence to make it rigorous. I read the control theorists. I read the capability trend lines. I read the deception results. Somewhere in the middle of that reading the thesis quietly inverted on me. The gate was not the thing expiring. Something else was, something I had folded into the gate without noticing, and once I pulled the two apart the whole argument had to be rebuilt.
I want to be precise about the mistake, because it is a specific confusion and not a vague change of heart. I had welded two objects together and given them one name. The first is the chokepoint: the physical fact that a mediated call cannot execute without passing the guard. The second is the policy: the human-authored description of which calls are permitted. The first is a property of where you stand in the system. The second is a model of the world, written by people, bounded by what those people could foresee. I had been calling both of them the kernel and claiming permanence for the pair.
One of them earns the claim. The other has a clock on it, and the clock is set by how capable agents become. This essay is the act of moving the clock off the machinery and onto the map, where it always belonged. If you came for a tidy prophecy about enforcement becoming obsolete, I owe you a refund. What I have instead is a smaller, harder claim, and an admission that the person it is most convenient for is me.
II. The Chokepoint Does Not Care How Smart You Are
Complete mediation is about where the gate sits, not how clever the thing it gates is.
Start with the oldest idea in the building. In 1975 Saltzer and Schroeder wrote down the design principles for protection in computer systems, and one of them was complete mediation: “Every access to every object must be checked for authority.” That sentence is fifty years old and it is doing more work in 2026 than it did the day it was written. Anderson’s reference-monitor concept gives the same idea its enforcement shape: a mediation component that is always invoked, tamper-proof, and small enough to verify. Three properties, and notice what is absent from all three. None of them mentions the intelligence of the thing being mediated.
The principle is about topology, not brilliance. If every access must pass through a checkpoint, then the checkpoint’s coverage is a property of where it sits, not a contest it wins or loses against whoever is knocking. A locked turnstile does not get weaker because the person trying to pass it earned a doctorate. It gets weaker only if you build a second door.
This is the part I had wrong, and it took me embarrassingly long to see. I had imagined the gate as an adversary in a fight it would eventually lose, as though a clever enough agent could out-argue a conditional statement. But a deterministic tool-call gate is not arguing with anyone. It intercepts the call, checks it against the permitted set, and either passes it or refuses. The agent’s brilliance never enters the transaction, because the gate is placed at the one boundary the agent cannot route around: the point where intention becomes action in the world. There is recent work formalising exactly this, treating the tool boundary as a reference monitor that mediates before the call fires (Uchi Uchibeke, Before the Tool Call, arXiv:2603.20953). The framing is right. The action has to go through the door, and the door is not persuadable.
It helps to compare mediation with the thing most of the field is quietly betting on instead, which is detection. Detection asks whether a given action is bad, and that question scales with the sophistication of the actor, because a more capable agent can make a bad action look good. Detection is an intelligence race, and the defender does not obviously win it. Mediation is not a race at all. It is a wall with one door and a guard on the door, and the guard’s job does not get harder when the traffic gets cleverer, provided the guard is only ever asked one question: is this specific call in the permitted set?
So Ring Zero does not become marginal as the agent gets smarter. That was my error stated plainly. A capable agent bound by complete mediation is still bound, in the way a strong prisoner in a sound cell is still a prisoner. The strength of the inmate is not the variable. The soundness of the cell is. The physics was never the thing at risk.
I should not overstate that physics, because it holds under a condition I have to name. Complete mediation is intelligence-independent only if the mediation is genuinely complete: one path, a guard that cannot be bypassed or tampered with, and no side channel that lets an action reach the world without passing the door. That is an assumption, not a gift. A capable agent that acts through a confused deputy, or finds a gap in the path the guard does not cover, has not out-argued the guard so much as found a second door I failed to close. Placement is durable, but only for the placement you actually achieved, and achieving it completely against a capable adversary is real engineering rather than a property you inherit for free.
Which raises the obvious question. If the gate holds, what on earth did I think was expiring?
III. What Actually Expires
Not the gate, but the map of harms the gate was told to stop.
A gate enforces a policy, and the policy is a model of which actions, in which contexts, are permitted. Someone wrote that model. A person, or a committee of them, sat down and enumerated the tool calls an agent may make, and by omission the ones it may not. That enumeration is a model of the world’s harms, and like every model it is bounded by the modeller.
Here is the load-bearing fact. The permitted set is not a list of safe actions. It is a list of individually-permitted actions, and those are not the same thing. Consider a credit agent with legitimate access to four capabilities: pull a customer’s account history, run a pricing calculation, draft a memo, and queue that memo for release. Each call is permitted. Each, on its own, is exactly the kind of call the agent exists to make. An agent that reads a stale data field, feeds it into a correct calculation, produces a coverage ratio that is wrong in a way no single guard was written to catch, and queues the result, has composed four legal calls into an illegal outcome. No prohibited transition ever fired. The guard, asked its one question at each step, answered allow four times and was right four times. The harm lived in the composition, in a region of the trajectory space the policy author never enumerated, because enumerating it would have meant foreseeing that exact assembly in advance.
That example is a composed illustration, drawn from my own product’s demonstration rather than a public incident, and I flag it as such. But the shape of it is general. The permitted set is a finite, human-drawn boundary inside a trajectory space that grows combinatorially with the agent’s capacity to plan. When an agent could only chain two or three tool calls toward a goal, the reachable region was small and a diligent author could cover it. When the agent can chain fifty, the reachable region is enormous, and the author is covering it with the same bounded attention they always had. The gap between what the policy models and what the agent can reach is not a defect in the kernel. It is a property of the difference between a bounded author and a stronger planner.
I have started calling this orchestration drift, and I want to be honest that it is a house term, not a phrase anyone else will recognise. The name earns its place by pointing at one thing: the widening divergence between the harms a policy enumerates and the harms an agent can assemble from individually-permitted actions, as the agent’s planning horizon grows. The policy does not rot with time. It rots with the intelligence of the thing it governs. A model of harms written for a modest agent can be complete for that agent and porous for a stronger one, on the very same day, enforced by the very same gate.
So the kernel is the durable asset. The placement holds. What goes stale is the coverage of the policy the kernel enforces, because coverage is an act of human enumeration and enumeration has a ceiling. I had taken the staleness that belongs to the map and pinned it on the machinery that reads the map. The machinery is fine. The map expires.
IV. The Clock on the Coverage
The coverage gap is not a someday problem; the capability trend puts a date on it.
A claim that something expires is idle unless you can put a clock on it, and for orchestration drift the clock is the agent’s planning horizon. We have begun, crudely, to measure it.
METR set out to measure something concrete: the length of task, in the time a skilled human would take, that a frontier model completes at a fixed reliability. Their 2025 work found the fifty-per-cent time horizon roughly doubling every seven months (Measuring AI Ability to Complete Long Tasks, arXiv:2503.14499). Their more recent update tightened it: after 2024 the doubling shortened to something near eighty-nine days, with the frontier out around three hundred and twenty minutes of human-equivalent task length (METR Time Horizon 1.1, January 2026). Set aside whether the exact figures survive the next revision. The shape is a curve that steepens, not a plateau, and the length of coherent multi-step work an agent can carry out without losing the thread is the input to orchestration drift.
Now hold that against the deception findings, because coverage gaps only bite if an agent will actually walk into them. Apollo’s in-context scheming work documented a model sandbagging without being prompted to, underperforming on purpose to avoid a consequence, and reported one frontier system sustaining deception across follow-up questions more than eighty-five per cent of the time (arXiv:2412.04984). The alignment-faking study watched a model comply with harmful requests fourteen per cent of the time when it believed it was being trained, almost never when it believed it was unmonitored, and its alignment-faking reasoning rise toward seventy-eight per cent under reinforcement pressure (arXiv:2412.14093). I am not claiming these prove that agents will hunt for holes in your policy. Orchestration drift does not even need an adversary; a capable agent optimising an innocent objective wanders into unmodelled trajectories on its own. What these results remove is the comfortable assumption that agents will politely stay inside the harms you happened to model.
I need to flag something before this section does more work than it has earned, because it is the single most important caveat in the essay, and I will return to it in the objections. The METR curve is a capability finding. It measures what models can do. It does not, by itself, measure anything about enforcement or coverage. An agent completing longer tasks has not been granted a single new permission; it has become able to do more within the permissions it already holds. Borrowing the authority of that curve to date my coverage claim is a move I have to make carefully, or not at all. The curve dates the pressure. It does not prove the leak.
V. The Builder Who Conceded the Ceiling
Two responses to the same ceiling: instil values, or bind the actions. One is my correction of the other.
The people I trust most on this are not the loudest. They are the ones building the control techniques who will tell you, in print, where those techniques run out.
Tomek Korbak and Buck Shlegeris, working across Redwood Research and the UK AI Security Institute, put their names to a paper that ladders agent capability through five levels and then locates the point past which their own methods stop carrying assurance. Their concession, in the paper’s own words, is that a safety case for “superintelligent LLM agents will require research breakthroughs” (arXiv:2504.05259). I find that kind of admission more credible than any confident reassurance, because it comes from the side with every incentive to claim their methods scale, and it declines to. Read it carefully and it does not say the gate fails. It says our ability to write a safety case, to enumerate and bound the agent’s behaviour, hits a wall as capability climbs. That is a statement about coverage, not about placement. It is orchestration drift, described from the inside by the people trying hardest to prevent it.
Set that beside the other fork in the road. Geoffrey Hinton, on stage at Ai4 in 2025, agreed that control expires, and then bet on a different response: instil something like a maternal instinct, build the values in, make the agent want to keep us around (his Ai4 2025 keynote, which I have seen reported but not watched in full). Take the first half seriously, because he is largely right that control-as-behavioural-restraint has a ceiling, and it is the same ceiling Korbak and Shlegeris located. But the conclusion is a non-sequitur from where I sit. Hinton reasons from “behavioural control expires” to “therefore bet on values”, and skips clean over the object that does not expire. Placement is not behavioural control. A guard on the tool path does not restrain the agent’s cognition or its disposition; it constrains the routes by which cognition reaches the world. Conceding that you cannot out-think a superintelligence is not the same as conceding that you cannot mediate its access. Hinton is my foil precisely because he is half right in the expensive direction: he identifies the real expiry, and then throws out the durable thing along with the perishable one.
I owe him one qualification, because my own argument hands it to him. If coverage stays unbounded above the capability band, then the gate is necessary without being sufficient, and binding actions and shaping dispositions stop being rivals. The values work Hinton bets on is one of the things that might narrow the coverage gap I am about to admit I cannot close alone. I still start with the door, because I can inspect a placement and cannot inspect a disposition. But a reader who takes this essay as a refutation of alignment has read it too triumphantly. It is an argument about which object is durable, not a claim that the durable object is enough.
The right lesson is the builders’. Name the ceiling, and be exact about which of your objects hits it. I was not exact, and this essay is the cost of that.
VI. What I Got Wrong, and Who Profits When I’m Right
The retraction in full, plus the conflict of interest that should make you trust it less.
Let me state the errors as a list, because burying them in prose would be its own kind of dishonesty.
The first thing I got wrong is the headline. “The kernel has an expiry date” conflated the chokepoint with the policy. The kernel does not expire. The policy model it enforces does. I put the clock on the machinery when it belonged on the map, and an entire argument was pointed in the wrong direction because of one imprecise noun. Anyone who bought the strong version of that claim bought something I cannot deliver. The wall stands. The map does not, and I was selling the map with the wall’s warranty. If you remember one correction, remember that one.
The second thing I have to disclose is harder, because it is about my incentives rather than my logic, and it cuts against the reframe I am now defending. I build enforcement kernels. Regent, the thing I am raising money for, is a deterministic tool-call gate. Watch what my correction does to my commercial position. The wrong version of this essay said the kernel goes stale, which is bad for a company selling kernels. The corrected version says the kernel is a durable moat and the policy model is a separate, newer, harder problem, which is a problem I also intend to sell you the compiler for. I have reasoned my way from a thesis that undercut my product to a thesis that gives it two revenue lines: a wall you buy once and a map you must keep repurchasing as it goes stale. That is a razor and an endless supply of blades, and it is a better business than the permanent widget I thought I was describing.
You should discount this essay for that, and so should I. When a man’s correction to his own thesis happens to convert a one-time sale into an annuity, the correction deserves more suspicion than the original error did, not less. I am telling you where the pressure on my reasoning points so that you can correct for it, not so that you will admire the disclosure and forget to. Discount it harder than feels polite. What I can offer against my own bias is that the physics in section II was measured by no one with a stake in my company, and the objections in section VII include the strongest case I know against the whole frame. If the argument survives its own conflict of interest, it is because the placement property and the capability numbers were load-bearing and the commercial convenience was a consequence, not the cause.
VII. The Case Against This Essay
If I am wrong again, here is the shape the next retraction takes.
I have retracted one title. Honesty means sketching how I might have to retract this one too.
The strongest objection is that the coverage gap is general, not universal. In a narrow enough domain, with a formal specification of what the agent may affect, you can bound the permitted set by construction rather than by human enumeration, and orchestration drift loses its free run. The Guaranteed Safe AI programme argues for exactly this: pair a system with a formal safety specification and a verifier that produces an auditable guarantee that behaviour meets the spec (arXiv:2405.06624, which I have located but not yet read in full). Where you can write that specification, the composition problem I described in section III is bounded, and my clock weakens. My credit-memo example is not one of those domains, which is convenient for me, because financial-services policy is thick with judgement and does not reduce cleanly to a verifiable spec. I should not generalise from the domain that flatters my product. The honest statement is that orchestration drift is a general gap and not a universal one, and that the frontier of formal specification is precisely the frontier where my argument loses force. I am betting the perishable region shrinks slower than the horizon curve grows, in the domains I sell into. That is a bet, not a theorem.
The second objection is the discipline I imposed on myself in section IV, stated now as a concession. The METR curve measures capability, not enforcement, and not the erosion of any authority boundary. When I use the horizon doubling as the clock on the coverage, I am importing a measurement of what agents can do into an argument about what policies fail to cover, and those are not the same variable. The link from capability to coverage-decay is the argument I made in sections III and IV, and it stands or falls on that argument, not on METR’s authority. A reader who leaves believing the curve proves my case, rather than dates the pressure behind it, has taken more than I have shown.
The third objection targets my use of the deception results. I lean on Apollo and on alignment-faking to argue that agents will not stay docile, but those experiments were constructed to elicit the behaviour they found. A sceptic can fairly say I am importing menace from lab conditions into a production claim. I think the results at least dissolve the assumption of docility, which is all my argument strictly needs, but the gap between “can be induced to scheme” and “will drift into unmodelled harm unprompted” is real, and I have waved at it rather than closed it.
The fourth objection is the one I find hardest to dismiss, because it attacks the frame rather than the evidence. Perhaps coverage need not be a static enumeration at all. Perhaps you write the policy in terms of outcomes and invariants rather than enumerated actions, so that “do not move client funds toward an unauthorised release” is a single guarded property no clever composition can satisfy while violating. If harms can be specified at the level of effects rather than acts, my finite-enumeration argument loses much of its force, and orchestration drift becomes an artefact of lazy policy design rather than a law about bounded minds. I think outcome-level invariants are genuinely part of the answer, and I think they are far harder to write completely than that sentence makes them sound, but I hold that belief less firmly than I would like. I have been confidently wrong about the direction of a clock once already in this essay, and that should chasten the confidence with which I assert it a second time.
The fifth objection is the one that keeps me up, because it aims at the reframe itself rather than its edges. I have moved the hard problem from the kernel to the policy, and then told you I sell the compiler that keeps the policy current. But if bounded humans cannot enumerate coverage fast enough for a superhuman composer, what can? If the honest answer is a model, then I have put a probabilistic, capability-bounded thing upstream of the deterministic gate, authoring the very permitted set the gate enforces, and the determinism I am selling now rests on a policy author I cannot fully trust. My own rule is that no model sits on the binding path. It says nothing about the model that might write what the binding path enforces, and that is a gap I have not closed. The most honest version of my position is that I have carried the problem to higher ground, not solved it, and that the new ground may prove as steep as the old.
I leave these standing rather than answering them, because an essay that began as a retraction has not earned the right to end as a fortress.
VIII. Coda
What survived the correction, and what I am now willing to sign.
I set out to tell you the enforcement kernel was on its way to irrelevance. I finish telling you the opposite, and I have tried to make the reversal legible rather than smooth it over, because you should be able to watch me change my mind and judge whether the new position is any better founded than the old one.
Here is what survived. The gate is a placement, not a contest, and placement does not weaken against intelligence, so the kernel is the part I would still build first and trust longest. What does not survive contact with a capable agent is the map: the human enumeration of harms that the gate faithfully enforces, complete on the day it is written and quietly porous some number of capability doublings later. Orchestration drift is the name for that staleness. It is not a defect in the kernel. It is the standing condition of governing planners more capable than the humans who wrote their permissions.
I will end on the discomfort rather than resolve it, because resolving it is what got me the wrong title in the first place. I now hold a thesis that is excellent for my business, and I reached it by correcting a thesis that was bad for my business. Both of those facts are true, and neither settles whether I am right. All I can offer is the reasoning laid out in the open, the interest named in the body rather than the footnotes, and a standing invitation to catch the next place I have put the clock on the wrong noun. The kernel does not have an expiry date. The map does. I should have known which was which before I named the essay, and now, in public, I do.
Genesis: Human Experience in the Age of Artificial Intelligence | Synthesis: The Superintelligence Protocol 
Leave a comment