# Decoupling Policy Optimization from Boundary Enforcement in Sequential Delegation

*Limited-circulation discussion draft*  
*Date: 2026-07-26*  
*Companion note prompted by Matthew Dixon's recent paper on adaptive AI delegation under uncertainty*

## Abstract
Recent work on adaptive AI delegation usefully reframes governance as a sequential authority-allocation problem rather than a static oversight problem. That is an important move. This note argues for one adjacent architectural seam: policy-level delegation under uncertainty is not yet the same thing as runtime boundary enforcement. A policy may rank actions, modulate authority, and reason over belief state, but it need not be the final authority over whether a concrete action remains admissible at execution time. The narrow claim here is that, in some deployment settings, final execution authority should remain coupled to an independently grounded admissibility surface rather than to the proposer's own optimization stack. The point is architectural, not anti-probabilistic.

## 1. Starting point
Matthew Dixon's framing is valuable because it treats governance as a sequential problem rather than a static compliance wrapper. The distinction between evidence, recommendation, confidence, validation history, and governance action is structurally healthier than the flatter trust models that still show up in many delegation discussions.

This note starts from agreement, not opposition.

The question it raises is narrower:

> What keeps a safety boundary binding when the estimator is wrong, telemetry is partial, the policy stack degrades, or the proposer misclassifies the action it wants to take?

## 2. The seam
The pressure point is not whether hard constraints can be represented mathematically inside a constrained policy formulation. Of course they can.

The pressure point is architectural.

In deployment, the state estimator, telemetry stream, confidence report, policy solver, and execution substrate are all fallible runtime components. Once that is granted, a separate question appears:

> Which component has final authority over whether an action may execute?

If the same probabilistic machinery that proposes an action is also the sole authority that determines whether its own governing boundary conditions are satisfied, then the system is effectively self-policing at the very point where uncertainty is already proving difficult to model.

That is the seam this note wants to keep clean:

```txt
policy_optimization != runtime_boundary_enforcement
```

## 3. A minimal architectural distinction
The proposal is only a distinction between two roles.

### 3.1 Proposer
The proposer is the adaptive policy layer. It may:
- update belief over latent operating conditions,
- estimate the relative merit of candidate actions,
- modulate delegated authority under ordinary uncertainty,
- express confidence, fallback preference, or escalation preference.

This is the layer Dixon's paper models well.

### 3.2 Admissibility kernel
The admissibility kernel is a narrower enforcement layer. Its job is not to replanning the whole world. Its job is to determine whether the concrete proposed action is admissible under a bounded independent verification surface.

Its dispositions are intentionally small:
- `ALLOW`
- `DENY`
- `ESCALATE`

The kernel should be narrower, more inspectable, and more trusted than the proposer with respect to final execution authority.

## 4. The key claim
The claim is not that the kernel is magically omniscient. The claim is only that some authority boundaries should remain binding even when the proposer is degraded, overconfident, stale, or strategically misaligned with the boundary class that governs its own action.

Put more sharply:

```txt
the_proposer_must_not_be_authoritative_over_which_boundary_class_governs_its_own_action
```

That is the core companion claim.

## 5. Why this matters in practice
Several familiar failure modes make the seam operationally important.

### Estimator drift
Belief-state quality can degrade under distribution shift while still producing apparently coherent action proposals.

### Partial or stale telemetry
A proposer may still prefer an action even when the evidence needed to justify execution is stale, absent, or ambiguous.

### Self-reported confidence is not authority
Confidence may be informative, but it is not equivalent to admissibility.

### Underclassification
A proposer may label a high-impact action as belonging to a lower-risk class. If the claimed class is trusted directly, the architecture collapses.

These are not objections to Bayesian reasoning. They are reasons to separate optimization from final execution authority.

## 6. A bounded proof-carrying shape
One public-safe way to describe the interface is a proof-carrying proposal pattern.

The proposer may:
- bind the exact action and arguments it wants executed,
- provide evidence handles,
- provide a candidate certificate,
- suggest an expected boundary class.

But the admissibility kernel independently grounds the applicable boundary class and decides whether execution is permissible.

If the necessary evidence is stale, missing, conflicting, or insufficient to ground the boundary class confidently, the result should be `DENY` or `ESCALATE`, not silent execution.

This does not require reconstructing the proposer's full belief state. It only requires a narrower and independently grounded verification surface.

## 7. A small example
Consider a delegation system that may authorize a sensitive action only when a human operator is presently reachable.

The proposer, using a richer sequential model, infers that the operator is likely available and recommends proceeding. But execution still requires a fresh presence token and a direct liveness check. If the token is stale or the channel is down, the enforcement layer refuses execution even if the proposer's broader belief state continues to rate the action favorably.

That is a deliberately small example, but it makes the architectural topology visible.

## 8. Scope discipline
This note does not claim that every meaningful safety boundary can be reduced to a cheap verifier. Some boundaries remain semantic, contextual, or judgment-laden.

So the strong form of the claim is limited.

The architecture is strongest when:
- the governing boundary class can be independently grounded,
- the witness surface is narrow enough to inspect,
- freshness and integrity can be checked directly,
- and uncertainty can route honestly to `DENY` or `ESCALATE`.

Where those conditions fail, the honest move is not to pretend the kernel resolved the whole question. The honest move is escalation or re-entry into higher-order review.

## 9. Closing position
The point of this note is not to argue against sequential Bayesian governance. It is to argue that sequential governance and runtime enforcement should be treated as distinct layers with different trust assumptions.

In that sense, the note is meant as a companion seam:
- Dixon's framework is strong on adaptive authority allocation under uncertainty;
- this note is about what should retain final authority when execution time arrives.

The narrow public claim is therefore:

> adaptive delegation may still need a decoupled runtime enforcement seam if final authority is meant to remain binding under real failure modes.

## References
- Dixon, Matthew F. (2026). *Adaptive AI Delegation under Uncertainty: A Bayesian Governance Policy for Sequential Decision Authority*. arXiv:2606.29406.
- Anderson, J. P. (1972). *Computer Security Technology Planning Study*. Technical report, James P. Anderson & Co.
- Necula, G. C. (1997). *Proof-Carrying Code*. Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, 106–119. https://doi.org/10.1145/263699.263712
- Necula, G. C., and Lee, P. (1996). *Safe Kernel Extensions Without Run-Time Checking*. Proceedings of the Second USENIX Symposium on Operating Systems Design and Implementation, 229–243. https://doi.org/10.1145/238721.238781
- Saltzer, J. H., and Schroeder, M. D. (1975). *The Protection of Information in Computer Systems*. Proceedings of the IEEE, 63(9), 1278–1308.
- Seto, D., Krogh, B. H., Sha, L., and Chutinan, A. (1998). *The Simplex Architecture for Safe On-Line Control System Upgrades*. Proceedings of the 1998 American Control Conference, 3504–3508. https://doi.org/10.1109/ACC.1998.703255