A permission kernel for agents seems like the right abstraction. Natural-language guardrails are useful as instructions, but consequential authority needs to be enforced outside the model.
Thanks - that's exactly the bet. Instructions live in the context window, and anything in the context window can be argued with. The kernel can't be, because it isn't part of the conversation.