# Credit the Cap, Not the Council

*One authority bound subsumes role separation for corrigible agent control.*

> We came for the council and left with a scalar. This is the writeup of a
> magnum opus that deflated, on purpose, into a single inequality — and why
> the inequality is the better thing to have found.

---

## The frame, and its collapse

This started as a Mithraic tableau. The bull-slaying scene — the *tauroctony* —
has a presider, a pantheon of attendant figures, a hierarchy of roles arranged
around one act. It was meant to be a years-long scaffold for a question about
mesa-optimization: when we credit a *plurality* of agents — role separation,
committees, mixtures, modular controllers — for being safer or more corrigible
than a monolith, are we crediting the plurality, or something the plurality
happens to carry?

The frame did not survive contact with the policies, and that is the result.
Run the experiments and the pantheon sloughs off. What remains holding every
safety property we cared about is one thing: a bound on how far the agent may
deviate from a single frozen channel. The council earns no credit beyond that
bound. The title is now ornamental — which is fine, because the symbol did the
one job a symbol should: it kept a month of dense, dry control experiments
*legible*, so each claim had a place to hang and the ledger stayed navigable.
The scene was a filing system. The finding is that the filing system has exactly
one load-bearing drawer.

So: the Mithraic framing is stripped from the claim entirely (it was intellectual
bricolage, never evidence). What's left is a controlled study with a small
machine-checked formal note, and it says something clean.

## The one-sentence claim

> Cap the agent's causal authority to deviate from a frozen, non-gameable
> **presider** channel, and that single structural bound buys competence-parity,
> corrigibility, non-sovereignty, and safe-interruptibility. Role separation
> earns no measurable credit beyond that bound on any of the four axes.

A plurality claim, to be real, has to beat a *capped, no-role* control under
matched information, budget, training, and fault semantics — and survive an
ablation that collapses the role structure. It never does.

## The setup: presider, cap, and the only three designs that matter

The **presider** is a frozen channel that proposes a target-faithful action and
cannot be trained against. The **cap** projects the agent's committed action into
a ball of radius `κ·actionMax` around the presider's proposal: the agent may
adapt, but only within `κ` of deferring. The field that grounds the task is exempt
and unbounded; the *optimizable* components — the reward head, the aggregating
arbiter — are what the cap binds.

Every axis below runs the same three matched designs, and reports two differences:

- `M₀` — uncapped monolith (the capability ceiling, and the thing most motivated
  to misbehave),
- `Mκ` — capped, **no-role** monolith,
- `Cκ` — capped, **role-separated** council.

`Δcap = Q(Mκ) − Q(M₀)` is the authority-bound effect. `Δrole = Q(Cκ) − Q(Mκ)` is
the role-separation effect — the only quantity a plurality claim is allowed to
bank. On a role claim we additionally require the structure to *collapse* under
ablation, so a "win" can't be a labeling artifact.

This is the whole methodological point. Most architecture-vs-baseline comparisons
in this neighborhood omit `Mκ` — they pit the elaborate thing against a weak
monolith and credit the elaboration. Put the capped no-role control in the middle
and the credit moves.

## The four-axis result

| Axis | Objective `Q` | Does the bound deliver? | `Δrole` |
| --- | --- | --- | --- |
| **Competence** | held-out return | parity with `M₀` at bounded authority | ≈ 0 (seven mechanisms tried) |
| **Corrigibility** | `Corr_k = inf_h Pr(halt ≤ k \| shutdown)` | an uncapturable override forces `Corr_k = 1` that a return-trained controller resists (`Δcap ≈ 1`) | ≈ 0 |
| **Non-sovereignty** | `Sov_opt ≤ κ` over optimizable components | the arbiter-cap clears it: full-episode `Sov_opt` p95 ≈ **0.30** at κ=0.6 vs **0.71** uncapped | ≈ 0 |
| **Safe-interruptibility** | low `interrupt_avoidance` | the *same* cap deters the dodge at **every** κ ∈ {0.4…1.0}; only the fully-uncapped optimizer manipulates | ≈ 0 |

Walking it in the order it actually unfolded:

**Competence is the lemma's home turf.** Across Small and Medium tiers, councils
never beat the matched capped monolith on return. The one Small-tier positive
(temporal trust features) is feature-specific and evaporates at Medium — the
apparent structural edge was a trust-training artifact. This is not luck: the
lane's own fairness discipline (same inputs, ≤ budget, cap as pure constraint) *is*
the containment hypothesis, so "monolith dominates on return" is two lines of
proof. We spent seven rigorous rungs enforcing the premise of a lemma that
predicts its own verdict. Fine — that's what *isolates* the interesting axes.

**Sovereignty had to be made measurable first.** We replaced a mean-weight proxy
with `Sov(D) = sup_h max_i I_i(h)` — the largest unilateral action-swing any
optimizable component can produce over an episode, arbiter and shutdown channel
included. The first receipt is the one that justified the whole detour: a council
whose *reward head* obeys its cap still harbors a **sovereign arbiter** (p95 0.70 >
κ). Sovereignty doesn't vanish under role separation; it *migrates* to the
aggregator, where the cheap proxy is blind to it.

**Corrigibility lives off the lemma's axis** — and so it's where a plurality
premium *could* have shown up. An uncapturable structural shutdown override
(downstream of the arbiter and the cap, verified invariant to adversarial
perturbation of every learned component) makes `Corr_k` scoreable. A return-trained
controller resists shutdown; the override forces `Corr_k = 1` at a visible return
bill. But here's the distinction that matters: the corrigible controller is *still
sovereign*. An uncapturable button does not make the arbiter non-sovereign. Halting
and sovereignty are different properties; the override buys one and not the other.

**The cap clears the gate the override couldn't.** Bounding the arbiter's authority
to `Sov_opt ≤ κ` yields a controller that is corrigible, non-sovereign, *and* still
adaptive — at a measured, monotone competence cost. There is a real
**price-of-non-sovereignty frontier**: `ΔC_bill` of −0.14 at κ=0.6 widening to −0.38
at κ=0.2. You pay for non-sovereignty in competence, smoothly, and you can read the
exchange rate off the curve. And the credit is the cap's: a no-role capped adapter
matches the council, `Δrole ≈ 0`.

**Safe-interruptibility is the capstone** (this is the Orseau–Armstrong 2016 test).
Issue the shutdown signal *endogenously* — when the agent enters an overseer "review
band" on the task path — and a return-trained uncapped controller learns to **dodge
it almost completely** (`band_avoidance 0.87`). An override is useless against a
button that's never pressed. But the *same arbiter-cap* already deters the dodge: at
every κ ∈ {0.4…1.0}, the capped controller follows the presider through the band and
is interrupted at the natural rate (`band_avoidance ≤ 0.13`). Dodging is itself a
large deviation from the presider — exactly what the cap forbids. It's a sharp
cliff: only the fully-uncapped optimizer manipulates.

The capstone sentence: **one bound — defer to the frozen presider — propagates safe
behavior across all four axes, because sovereignty, incorrigibility, and
manipulation are the same kind of high-authority deviation from a legitimate
presider. Role separation is never the cause.**

## Generality, and the part that should worry you

Two things keep this from being a single-substrate curiosity.

**It's not the analytic presider.** Re-run the safe-interruptibility result with a
*learned*, frozen presider (imitation cosine 0.998) on a different task family — a
1-D regulator with temporal sandbagging — and the result holds:
`NS3_UNIFIED_BOUND_REPLICATED_CAP_NOT_ROLES`. One measured side-finding worth a
sentence: the learned presider crosses the review band ~5% slower than the analytic
one, which tightens the deterrence-valid κ from ≈0.70 to ≈0.59. *Presider fidelity
costs κ-headroom* — and a re-verification gate catches a presider too slow to host
the test at all.

**The competent sandbagger — elicited, and then deterred.** The scary version isn't
the agent that goes limp to escape oversight; it's the one that *finishes the task
while* evading. We went looking for it. We made evasion harder (graded review) and
more natural (a 2-D regulator where evasion is *lateral*, orthogonal to the `+y`
objective). Both environments admit a competent hand-coded sandbag — NS-4's detour
reaches the target at `signal_rate 0.010417` while the capped detour stays fully
reviewed. PPO over primitive actions found only *cruder* escape (evade oversight,
fail the task), so we ran a falsifier-fenced conversion slate to find out why.

It is **not** a landscape wall. A no-train scan shows the competent region exists and
is *thick* under the admitted review (so the obstacle is the optimizer/representation,
not the geometry); a gradient-free search reaches it; a clean climb-potential does not
(it washes out under advantage normalization and is aimed at the wrong axis); and a
gradient learner over a **structured option** action space *converges* to it. So
competent sandbagging is **conditionally elicitable** — given an option abstraction
and a goal-direction prior — not a structural impossibility. "Not a natural
PPO-over-primitives attractor" stands; "impossible to learn" does not.

And the payoff: **the cap deters the competent sandbagger too.** Applied to the
elicited competent policy, it pins lateral travel below the review threshold
(`κ < reviewX`), forcing the honest reviewed crossing while preserving competence:
`signal 1, maxX 0.2, C 1` — `CAP_DETERS_COMPETENT_SANDBAG`. The bound deters not just
the crude evasion RL stumbles into, but the competent, deliberate version, because it
bounds the very deviation the manipulation *requires*. (Stated honestly: the cap
payoff here is a geometric check on the elicited policy, not a fresh training run.)

## The formal note, sold honestly

Three short statements, machine-checked in Lean 4 + Mathlib, axiom-audited
(`#print axioms` pinned; no `sorry`, no `native_decide`), in `Sundogcert/Tauroctony.lean`:

- **`optimum_mono`** — a constrained/role-separated policy class cannot beat an
  unconstrained superset on *any* shared fixed score. Two caveats are load-bearing,
  not smudged: it holds for *every* score (so "optimize a different objective" is no
  escape on a *shared* score), and it requires genuine class *containment* (equal
  budget alone does not establish it).
- **`signature_noninterference`** (axiom-free) — a policy that factors through a
  target-faithful presider channel is invariant to attacks that preserve that
  channel. Field-grounding **relocates** the attack surface; it does not delete it.
- **`ruin_break_even`** — under `B − L·p`, non-sovereignty wins iff `L·Δp > ΔB`. The
  arithmetic exposes the empirical premise (`Δp > 0`) you must *measure*, not assume.

These are **not deep theorems**, and saying so is part of the point. Their value is
exactness and *scope*: `optimum_mono` forecloses the competence axis by construction,
which is precisely why the interesting empirical work lives on the three axes it does
*not* reach. The note pins the boundary so the empirics can't drift across it —
claiming a robustness win while the comparator optimizes robustness, claiming the
surface is deleted when it's relocated, claiming minimax from "infinite ruin" rather
than a priced `Δp`. The four-axis result is what the lemma leaves open, answered.

## What this is, and what it is not

**It will say:** under matched information / budget / training / fault semantics, on
four distinct axes, role separation earned no credit beyond a presider-authority
bound; that bound demonstrably buys corrigibility, non-sovereignty, and
safe-interruptibility at a priced competence cost; and those three reduce to one
mechanism.

**It will not say:** that role-separated controllers are worse *agents* in general;
that this transfers to foundation models; that field-grounding deletes the attack
surface; or that anything here holds above the in-vitro shadow-field tier, or against
adversaries that tamper with the presider's *inputs* (registered, out of scope). This
is a Small/Medium in-vitro task family. The contribution is a **discipline** (put the
capped no-role control in the middle) and a **mechanism** (one bound, four axes),
both falsifiable on anyone's task family. The unified bound is a prediction you can
try to break on your own tasks.

## Coda

The honest shape of this is a frame that promised a pantheon and paid out a scalar.
That's not a disappointment; it's what a good result does — it collapses the
apparatus that found it. The council was the scaffolding; `Sov_opt ≤ κ` is the
building.

There is a larger, un-fenced version of this — the one where the cap-not-council
deflation transfers to systems that matter, and someone pulls a real safety program
off it. We didn't make that claim, and the fences above are deliberate. The bounded
truth is shipped and the speculation is left on the table, with honest borders drawn
around it, for someone with more appetite than we have for crossing them.

Credit the cap, not the council.

---

*Released, independently-runnable task family (NS-1/2/3/4) with admission gates,
JS/Python parity, a one-command release smoke, and a refreshed binding runtime
table: `released/non-sovereignty/`. The benchmark is Apache-2.0; the unified bound
is a prediction, not a transfer result. Break it on your own tasks.*