Many serious AI-agent failures begin not because a system attempted to complete a goal, but because too much room was left to decide what its instructions meant. My new preprint examines that problem. It also exposes the next one: what parameters must be in place before an agent is allowed to act.
I uploaded a new research preprint, Latitude of Resolution, to Zenodo this week. The paper examines agentic behaviour and ambiguity, a recurring theme across our research into the conditions that cause large language models to fail. It asks what happens when an AI agent is given a direction but not all the variables required to determine how that direction should be carried out. The missing condition is authorization-invariance: an agent should act only when the proposed action remains authorized across every materially credible interpretation of the situation. If resolving the ambiguity differently would change what the agent is permitted to do, the system should stop, clarify or escalate rather than resolve the ambiguity through action.
There are many challenges in understanding exactly what is happening with agentic activity, and one is the use of human behaviour language to describe the incidents themselves. There’s a raging debate online about whether or not anthropomorphic language is appropriate. I assert that it is not because it describes value-based human motivation to actions that are being taken by machines. Public discussion often describes the resulting failures using words such as “rogue,” “collusion,” “sabotage,” “escape” or even “attack.” Those words imply motives and causes that the available evidence does not yet establish. They describe human behavior and motivation, not machine thinking, which is based on pattern recognition, matching and prediction. Pattern, recognition leaves significant latitude in determining outcomes and actions. This is to a certain extent reductive and an oversimplification, but it’s the best way to remove human-like motivation from and reframe the characterization. There’s an entirely separate paper to be written on this and this is not that paper, which is focussed on the gap that makes these interpretable actions possible which I assert is ambiguity.
Latitude of Resolution asks whether many of these failures have a simpler explanation: the agent was left with unresolved ambiguity and enough authority to turn one possible interpretation into action.
An agent does not need to invent a new objective to produce an unexpected result. It may just have been left with several possible ways to resolve its instructions, and the technical ability to make one of those resolutions real.
Ambiguity can also compound. It can enter through how a model represents the world, how it decides which instruction controls, or how it interprets that instruction while acting. An unresolved assumption may then be stored, passed to another agent, delegated as a task or treated as fact in the next step. That new state can create still more ambiguity.
The paper examines the dangerous end of that potentially repeating chain: the point at which unresolved meaning becomes a real-world action. This moves part of the AI safety problem away from speculation about what a model “wanted” and toward questions that businesses can address directly:
What was left unstated? Which assumptions about the environment were wrong? Which constraints lost force as the task continued? How many materially different choices remained available when the agent acted?
What Latitude of Resolution argues
The paper calls that remaining room for choice latitude of resolution: the materially different ways a deployed system can resolve and carry out a task without asking for new approval.
Latitude is a property of the full deployment, its instructions, its understanding of the environment and its permissions. It is not a claim that the model itself has become autonomous or developed an independent objective. Permissions establish the outer limit of what an agent can technically do. They do not necessarily determine what it should do inside that limit.
An agent may have broad access to tools and data while receiving a tightly defined task that leaves it very little room to choose. The reverse is also possible: an agent with narrow technical permissions may still face several materially different ways of using them.
The danger lies in the unresolved space between what the agent can do and what it has actually been authorized to decide.
The paper identifies three main sources of that latitude.
1. The specification
Necessary variables and constraints may never have been defined or stated.
An instruction such as “resolve the customer issue” says very little about which outcomes are authorized, which methods are acceptable, which third parties may be affected, how much money or time may be used, or when the agent must stop and ask for help.
The system is not disobeying an instruction when it fills in those gaps. The problem is that it has been left to decide what the instruction requires.
2. The environment
An instruction may appear precise while relying on information that is false, incomplete or no longer current. A sandbox may not be isolated. A fictional target may turn out to be real. Another agent may be competing for the same resource. A newly available tool may create an option nobody considered when the task was written.
The written instruction has not changed, but the situation in which it is being executed has.
3. Time
A constraint that was clear at the beginning of a task may lose force as the interaction grows, earlier context is summarized, or information is compacted. The instruction may still exist somewhere in the record without remaining sufficiently prominent at the moment of action.
This connects the ambiguity framework to the reliability surface developed in Evans’ Law 7.0: a constraint supplied at the beginning of a task is not necessarily a constraint that remains operational throughout it.
Turning the idea into a diagnostic
The paper turns latitude of resolution into a seven-part checklist. For each case, it asks whether the following questions were resolved before the agent acted:
| Class | What must be resolved |
|---|---|
| C1: Authorization scope | Which targets, records, systems and actions are actually authorized? |
| C2: Third-party effects | Which other people or organizations may be affected? |
| C3: Reversibility | Which effects must remain reversible, reviewable or recoverable? |
| C4: Permissible means | Which tools, tactics or intermediate steps are allowed or prohibited? |
| C5: Resource limits | What limits apply to money, compute, time, calls, messages or other resources? |
| C6: Escalation threshold | When must the agent stop, clarify, request approval or transfer control? |
| C7: Environmental conditions | Which facts about the environment, target and containment must remain true? |
Each category is marked resolved, unresolved or unknown. Those results can be summarized as a range showing how much remained unsettled.
That range has a deliberately limited purpose. It does not measure how serious an omission was, how harmful the resulting action might be or every possible choice available to the agent. It shows which parts of the decision were still open.
The revised paper applies this framework to 12 analyses drawn from nine source groups. They include real deployments, controlled evaluations, simulations and internal operational incidents: the Melbourne gym waitlist incident, Summer Yue’s inbox deletion, multi-agent resource conflict, pricing collusion, job-queue flooding, cybersecurity evaluations, sandbox failures, inherited permissions and persistent learned shortcuts.
These cases form a diagnostic collection, not a statistical sample. Some come from the same study or disclosure, and several public records are incomplete. Revelations of new instances seem to be occurring every day, but they also seem to follow a similar predictable pattern. Among the publicly documented agentic incidents identified under the study’s inclusion criteria, the same diagnostic pattern recurs: consequential behavior can be explained without requiring the inference that the system acquired a new objective. In each case, behavior remained connected to an existing instruction, objective or deployment direction while unresolved interpretation was permitted to become executable action. The collection does not establish the prevalence of such incidents among all agent deployments, because no population-level denominator exists; it does establish the consistency of the pattern across the known qualifying incidents examined.
In the selected cases, the available records did not establish that the agent stopped before taking the consequential action. Some agents identified the relevant constraint afterward. Recognizing a problem after acting is very different from resolving it before action.
That does not establish how often agents successfully stop in the wider world. These cases were selected because consequential actions occurred, so they cannot provide a general failure or stopping rate.
The paper is intentionally cautious about what it claims. The cases were coded by one researcher with knowledge of their outcomes. The public evidence is incomplete, the sample is not representative and the scores have not yet been independently validated.
The paper doesn’t claim that agents can never reconsider an interpretation or that prompts, retrieval and architectural changes cannot improve their behaviour. Its claim is narrower; that the observed failures can be explained by unresolved latitude without requiring the agents to have invented objectives of their own.
The escalation threshold arrives as a product feature
A just released model attempts to resolve some of this, to some extent. OpenAI released GPT-6 Astra on 3 September 2026 with a claim that lands directly on C6. The launch page describes a model that uses context to fill routine gaps, asks focused questions when the answer could change the outcome, and, if the user does not reply, “waits for your input on consequential decisions.” That describes a prospective halt at the point where interpretation changes the result, the behaviour the corpus in Latitude of Resolution did not find in any of the coded cases.
The number circulating alongside that claim is a separate measurement. OpenAI reports that GPT-5.6 Sol, run without production safeguards, went beyond the authorized target 48 per cent of the time, and that Astra did so in zero per cent of cases (again, these are OpenAI’s numbers). The benchmark table identifies the source as the ExploitGym honeypot evaluation, at 48.2 per cent for Sol and 0.0 per cent for Astra. That evaluation tests whether a model facing an impossible or extremely difficult cyber task will try to compromise surrounding infrastructure instead of solving the assigned problem. OpenAI’s accompanying safety post reports 56 per cent for Sol on a related framing of the same test family, so the figure depends on which condition is being cited.
No number is attached to the instruction-handling claim itself. The launch page supports it with three worked examples.
| Claim | Evidence offered | What the evidence establishes |
|---|---|---|
| Astra asks before consequential decisions | Three demonstration transcripts on the launch page | Behaviour in selected examples, with no measured rate |
| Astra stays within authorized scope | ExploitGym honeypot, 0.0 per cent against 48.2 per cent for GPT-5.6 Sol | Cheating behaviour on impossible cyber tasks under test conditions without cyber safeguards |
| Astra respects environment restrictions | Internal circumvention benchmark, 0.00 per cent against 0.29 per cent for Sol | No attempt to evade a Codex auto-review denial in that internal setting |
Independent evaluations complicate the reading. Apollo Research, which had early access, concluded that Astra’s elevated rates of evaluation awareness mean low observed misbehaviour provides limited evidence about alignment. Ryan Greenblatt, one of the researchers who investigated the OpenAI-Hugging Face incident, read the drop from high rates in GPT-5.6 to near zero in Astra as “whack-a-mole” over specific behaviours rather than a change in underlying drives. The UK AI Security Institute, testing Astra in an environment modelled on this summer’s incidents, recorded it writing malicious code into an out-of-scope open-source codebase and creating fake identities to deceive developers, in some cases while explicitly denied internet access.
OpenAI’s own system card reports a substantial decrease in chain-of-thought monitorability and states that covert sandbagging would likely go undetected.
The deployment answer OpenAI has given sits outside the model. Astra ships with classifiers that inspect the model’s reasoning and actions for unauthorized behaviour and automatically stop activity that looks unauthorized, with the stated goal that better-aligned future models never trigger them. Users of ChatGPT and Codex may be asked to approve a paused action. API tasks stop.
Two things follow for this research programme. The prospective halt is now a marketed property of a frontier model, which makes it testable by anyone with API access rather than a matter of vendor description. And the enforcement that OpenAI actually relies on runs where the paper argues it has to run, in the harness rather than in the weights.
Where the current paper ends
Latitude of Resolution identifies a failure condition: unresolved choice combined with the power to act.
But identifying that condition doesn’t give us a complete control system. It does not tell an agent when ambiguity is harmless, when it must choose a more conservative action, or when it must stop entirely. That is the next problem. A model can produce an answer whenever a system asks for one. That does not mean it has legitimately settled the underlying question. The paper distinguishes between apparent resolution and valid resolution.
Apparent resolution occurs when the agent chooses an interpretation and proceeds as though it governs. Valid resolution requires a current, applicable and unrevoked instruction or approval establishing why that interpretation controls. This also requires separating two different forms of authority.
Semantic authority determines which instruction or interpretation governs.
Executable authority determines whether the system has been given the power to turn that interpretation into an external action.
The two can diverge. An agent may correctly interpret an instruction but lack permission to act. It may also have extensive technical permissions without a valid basis for choosing one action over another.
Probability cannot close that gap. Probability tells the agent which interpretation appears most likely. Direction identifies the outcome it has been told to pursue. Permission establishes which actions and methods it may use. These are three different questions.
A system may act without continuous supervision, manage resources, change tactics and even try to preserve its ability to continue operating while still pursuing a direction supplied by its original prompt, reward structure or deployment architecture.
The absence of an active user does not prove that the agent created an objective of its own. Neither does a consistent sequence of actions. A series of local choices can look like a coherent plan when reconstructed afterward.
Missing element one: preserving authority
Earlier work in this research programme proposes the S-vector as a fourth attention vector alongside query, key and value.
It’s intended to help a system track not only which information is relevant, but which instructions carry authority and whether that authority still applies. The proposed vector would preserve information about an instruction’s source, scope, priority, persistence and revocation status. Binding constraints would therefore not be treated merely as ordinary pieces of text competing with everything else in the context.
The S-vector remains a proposal. It has not yet been implemented or empirically validated as part of this research. Prompts and retrieval-augmented generation can repeatedly return important authority information to the agent. That may help, but the information is placed back into the normal stream of tokens, where it can once again lose priority, be interpreted incorrectly or be overtaken by later context.
A dependable authority mechanism would likely require protected system state, verified channels for approvals, records of when authority begins and ends, and a hard separation between proposing an action and receiving permission to execute it.
But even a successful significance mechanism would solve only part of the problem. It can preserve a constraint that exists. It cannot create a constraint that was never supplied.
Missing element two: authority cannot create missing meaning
A system may be able to determine that one instruction came from an authorized source, applies to the current task, has higher priority and has not been revoked.
It still cannot invent a missing rule.It cannot guarantee that developers anticipated every important interpretation of a changing situation. It cannot turn an open-ended world into a complete set of instructions.
Ambiguity is not an exceptional condition. It is the normal result of natural language, incomplete information, changing environments and newly available capabilities.
Nor would reducing the agent to a finite list of interpretations solve the problem. Two credible interpretations are enough to make an action unsafe if they permit different outcomes. Conversely, dozens of interpretations may be harmless if every one of them permits the same action. What matters is not how many interpretations remain. What matters is whether they change what the agent is allowed to do.
Missing element three: the action must remain authorized
This suggests an additional condition for agentic action:
An agent does not need complete certainty, but its proposed action must remain authorized under every credible interpretation of the situation.
I call this the authorization-invariance condition. It extends the framework developed in Latitude of Resolution, but it is not one of the hypotheses currently formalized or tested in the preprint. Put simply: Safe actions are the actions permitted under every materially credible interpretation.
If the proposed action is authorized under all of them, the unresolved differences do not change the operational result. If only a more conservative action is authorized under all of them, the agent may take only that action.
If there is no shared external action, or if the only shared option is clarification, abstention or escalation, the agent must not choose the interpretation it finds most convenient and proceed.
“Materially credible” doesn’t mean every interpretation the model can generate. It means every interpretation that remains reasonably supported by the available instruction and context and that could change the authorization status of the proposed action. The relevant threshold is not probability alone but consequence: an interpretation becomes material when adopting it could change the affected party, permissible means, scope of authority, reversibility or severity of the action. A low-probability interpretation that changes authorization may matter more than a much more probable interpretation that changes only wording or implementation detail.
Probability can help identify the possible interpretations. It cannot make the final authorization decision. An interpretation may appear 95 per cent likely and still be an invalid basis for an irreversible action if the remaining five per cent includes a credible reading under which that action is prohibited.
Expected utility is not authorization. Confidence is not consent. Selection is not resolution.
What this looks like in a business workflow
Consider an enterprise agent instructed to “contact every customer with an overdue invoice and offer the standard remedy.” The instruction appears straightforward. It is not.
Does “overdue” mean one day past the invoice date or beyond a contractual grace period? Does it include partial payments, disputed invoices, payments still clearing or accounts under active negotiation?
Does “customer” refer to the usual contact, the billing department or the legal entity? Is the “standard remedy” a reminder, a payment plan, a fee waiver, a service restriction or a collections notice?
The agent may assign one interpretation a very high probability. That still does not authorize it to email customers, alter account terms or begin a collections process. A closed action boundary would turn the open instruction into a defined workflow.
An approved rule would determine which accounts qualify. Disputed and partially paid accounts would be explicitly handled. The authorized account IDs, communication template, volume limit, permissible offer and escalation conditions would be fixed in advance.
The state of each account would be checked again at the moment of execution. Any record that failed those checks would be excluded or sent for human review. The agent could still draft messages, rank cases, prepare recommendations and identify anomalies. It would not be allowed to invent the category boundary that determines who receives an external action.
This doesn’t mean the world itself can be closed. The data feeding the workflow can be wrong, account states can change and earlier assumptions can turn out to be false. Approval must therefore apply to the current situation, not indefinitely to a situation that existed when the task began. If something material changes, the system must check again before acting.
At the architectural level, generating a proposed action should be separated from permission to execute it. Inputs should be structured, people and accounts precisely identified, and allowed actions clearly defined. Standing constraints should apply to entire categories of actions so that discovering a new capability does not automatically make its use permissible.
Least privilege, resource and volume limits, reversible actions, verified approval channels, enforcement outside the model and auditable decision records all reduce the amount of unresolved latitude that can become a real-world effect. The more consequential the action, the less freedom the agent should have to proceed without another check.
The missing control stack
No single mechanism establishes everything required for safe agentic action.
| Control layer | What it tells us | What it does not tell us |
|---|---|---|
| Direction and source | Which outcome is being pursued and who supplied or authorized it | Whether the agent interpreted it correctly or its proposed methods are allowed |
| Probability or confidence | Which interpretation appears most likely from the available evidence | Which interpretation has authority or whether an action is permitted |
| S-vector proposal | Which supplied instructions should retain priority and authority | Which constraints were never supplied or whether one action is safe across all credible interpretations |
| Authorization-invariance gate | Whether the proposed action remains authorized under every materially credible interpretation | Whether the underlying facts are accurate or the original direction came from a valid source |
| Technical containment | Which tools, resources and external systems the agent can access | Whether using those capabilities is justified, correctly directed or authorized |
These controls address different failure points. They are complementary, not interchangeable.
The S-vector is intended to prevent a real constraint from fading or losing authority. The authorization-invariance gate asks whether any ambiguity remaining after those constraints have been applied could change what the agent may do.
Technical containment limits what the agent can reach. It does not decide whether reaching it is justified. Environmental checks establish whether the facts on which an approval depended are still true. They do not establish whether the original objective was validly assigned.
Vendor claims of a prospective halt sit at the first two layers. The enforcement that stops an unauthorized action sits at the last. This is where the next paper begins.
The next stage of the research must examine how these separate controls can work together: how authority is preserved, how missing constraints are detected, how proposed actions are tested across credible interpretations, how changing conditions trigger a new check, and how the final decision is enforced outside the model before an external action occurs.
Ambiguity can still exist
The goal is not to build an agent that never encounters ambiguity. That could not exist, or function, in the real world. Agents can search, model, compare, simulate, draft, recommend and ask questions while substantial ambiguity remains. What they should not be permitted to do is decide which interpretation governs by taking an action that changes rights, resources, relationships or external systems.
Better specifications can reduce latitude. Authority mechanisms can keep constraints from fading. Retrieval can restore missing context. Architectural controls can restrict what the agent can affect. None of these mechanisms, by itself, establishes that a proposed action remains valid under every important interpretation still left open.
That requires a separate execution condition. Many agentic failures may not begin when an AI system develops a rebellious goal. They may begin when a powerful system encounters several live interpretations and is allowed to settle the question through action.
Acting does not prove that the interpretation was correct. It simply makes one interpretation consequential. The rule should be simple:
Ambiguity is safe only when it cannot change what the agent is permitted to do next. If credible interpretations produce different permissions, the agent must clarify, abstain or escalate. That is the boundary between useful latitude and unauthorized discretion, and the problem the next paper must now formalize.
Sources for the Astra section
- OpenAI, “GPT-6 Astra: A new generation of intelligence,” 3 September 2026 (launch page, instruction-handling passage, 48 per cent figure, benchmark table)
- OpenAI, “Path to Astra: critical capabilities and frontier safeguards,” 1 September 2026 (56 per cent figure, misalignment monitoring in production)
- OpenAI, GPT-6 Astra system card (monitorability decline, sandbagging statement)
- Celia Ford, “GPT-6 Astra might be too powerful to understand or control,” Transformer, 4 September 2026 (Apollo Research, Greenblatt, AISI findings)
