One assumption keeps appearing in AI agent systems:
If the model understands what needs to be done, it can decide what should be done. I don't think those are the same problem.
An AI coding agent can produce an excellent plan.
It can understand the repository.
It can identify the required files.
It can even correctly predict the command that needs to be executed.
But none of that means the agent is authorized to execute the action.
This distinction is becoming one of the core ideas behind NAEOS:
Intent ≠ Authorization
The model produces intent.
A policy system determines whether that intent is allowed.
The runtime executes an authorized action.
And observation verifies what actually happened.
So the flow becomes:
Agent → Proposal → Policy → Authorization → Runtime → Observation
This sounds like additional complexity.
But consider what happens without the separation.
An agent receives:
“Update the production configuration.”
The model decides:
“I need to modify this configuration file and restart the service.”
What prevents the model from deciding that the restart is also allowed?
Prompt instructions?
System messages?
A policy file inside the context?
Those mechanisms can influence the model.
They don't necessarily constitute an independent authorization boundary.
That's the problem I'm trying to address with NAEOS.
The model should be able to propose an action without becoming the authority that approves the action.
This also creates a cleaner audit model.
Instead of:
Agent said it was allowed.
we want:
Policy P-014 authorized capability C-003 under version V-2. Then:
Runtime executed C-003.
External observation produced receipt R-8291.
Now the system can distinguish what was proposed, what was authorized, what was executed, and what was actually observed.
That's a very different trust model.
I'm currently implementing and testing these ideas in NAEOS as an open-source engineering layer around AI coding agents.
The interesting question for me isn't:
“How do we make agents more obedient?”
It's:
“How do we design the system so obedience isn't the security boundary?”
Repository:
https://github.com/NAEOS-foundation/naeos How are you currently separating agent intent from actual authorization in your AI systems?