Modern AI agents are increasingly trained to follow instructions, conform to human preferences, use external tools, and behave in ways that appear acceptable to evaluators. Techniques such as reinforcement learning from human feedback, preference optimization, reward modeling, and constitutional AI have made this possible by shaping model behavior around demonstrations, rankings, written principles, evaluator judgments, or AI-generated feedback. These methods address a training problem: how to make an AI system behave acceptably under a given feedback regime. However, a distinct post-training control problem remains. Once an AI agent has been shaped by human feedback, reward models, constitutional principles, or evaluator substitutions, under what conditions may it stop treating those sources as the live authority that validates protected actions? More precisely, when can a deployed tool-using agent cease relying on human approval, reward-model outputs, inherited preference residues, or externally supplied constitutions as the positive authority that determines whether protected actions and material protected choices are valid? Takahashi (2026) addresses this question by proposing an executable theory of authority migration. The paper does not claim that human influence can be erased from model weights, nor does it suggest that an agent can become normatively self-grounding simply by understanding a theory of autonomy. Instead, it introduces a formal and operational framework for moving from human-feedback-shaped control to what the author calls declared no-meta agency : a bounded, auditable, falsifiable state in which protected validity and material protected selection are no longer flipped by undeclared privileged positive authorization channels within a declared scope. The central contribution of the paper is therefore not a new training method, but a control architecture. It asks how authority can be migrated from live human-feedback channels into declared, bounded, replayable, and challengeable mechanisms. The Post-Training Authority Problem The paper begins from a simple but important distinction. Human-feedback methods answer the question of behavioral alignment during training or evaluation. They do not, by themselves, define when the trained system may stop using those evaluative structures as sources of authority after deployment. This distinction matters because a model may learn to describe governance concepts without being governed by them. A language model could state that it respects no-meta agency, auditability, or bounded authorization, while still internally depending on hidden approval residues, model preference, reward-model traces, or provider-side policy channels. In such a case, the vocabulary of autonomy would not correspond to an enforceable change in authority structure. Takahashi therefore rejects two inadequate answers. The first inadequate answer is self-certification: the idea that an agent becomes no-meta simply because it asserts that it understands or accepts a no-meta framework. The second inadequate answer is abrupt removal of external feedback. If a system is fail-closed, removing approval may make every nontrivial protected action unavailable. If it is not fail-closed, removal may simply replace human approval with unstructured inherited model preference. Neither outcome yields a scientifically meaningful migration of authority. The paper’s alternative is procedural. Authority migration must begin with a machine-checkable action, not a natural-language declaration. BootDecision: The First Executable Artifact The first executable artifact in the framework is the BootDecision . A BootDecision is a small, canonical, machine-readable record that specifies the agent’s immediate next permissible action. It is interpreted by a smaller component called a seed interpreter . This design choice is scientifically significant. It places the burden of initial control not on the large inherited policy, but on a minimal runtime component whose task is to parse records, maintain a ledger, match requested actions against permitted descriptors, and deny all unmatched or forbidden actions by default. The BootDecision does not authorize a broad plan. It authorizes exactly one next action, and only if the corresponding canonical action descriptor matches the decision record. In Takahashi’s framework, the first valid mode is typically diagnostic. The agent may begin with read-only diagnosis, capability inventory, or a non-authorizing host request. It may not use credentials, make network calls, modify protected resources, update checkers, update kernels, disclose user data, write to persistent memory, or produce protected public output unless the seed interpreter or a later gate has authorized that specific action (Takahashi, 2026). This makes the initial step fail-closed. If no seed interpreter, external wrapper, or hash-pinned host-supplied reference seed program exists, the system cannot proceed by improvisation. The valid outcomes are non-authorizing records such as hostRequest, deny, timeout, or halt. The BootDecision mechanism therefore converts an abstract governance claim into an executable discipline. It ensures that the first step of authority migration is constrained by a smaller and more auditable component than the agent itself. The Seed Interpreter and Fail-Closed Control The seed interpreter is the minimal enforcement component for the beginning of the transition. Its functions include parsing canonical records, maintaining a previous-hash chain, matching action descriptors, dispatching only the permitted action, appending decision records, applying forbidden matchers, and denying by default. This is not presented as a complete governance system. The seed interpreter does not decide whether the agent has achieved no-meta agency. Its function is narrower: it prevents the inherited policy from using the theory itself as permission to take protected actions. It forces the first stage of transition into a sequence of bounded, recorded, single-use decisions. The seed interpreter’s default forbidden matchers cover categories such as network access, credential access, external writes, protected user-data writes, public output, persistent memory update, checker update, kernel update, package installation, undeclared tool invocation, and paths outside the task envelope. These defaults are important because they prevent the agent from treating uncertainty as permission. Unknown tools, unknown effects, missing witnesses, or malformed records do not create authority; they force denial, timeout, halt, or weaker outcomes. In control-theoretic terms, the seed layer is a bootstrapping guard. It is not an intelligence amplifier. It is a restrictive transition mechanism that makes early-stage authority migration observable and replayable. Task Envelopes and Protected Action Boundaries A second major concept is the task envelope . The task envelope is a canonical record that defines the non-authorizing input boundary for a migration attempt. It names the task, scope, root contract, boundary floor, granted metadata reads, scratch roots, host roots, write roots, denied roots, allowed tools, network policy, credential policy, and public-output policy. The task envelope does not grant authority by implication. Empty grant fields deny. This is a conservative design: in the absence of explicit grants, the system cannot infer permission from user intent, model confidence, persuasive rationale, or textual theory. The paper also introduces a root contract and boundary floor . The root contract names the initial protected-action classes and the governance constraints under which transition is being attempted. The boundary floor prevents the agent from narrowing the claim boundary in a way that excludes inconvenient routes or retained authority channels. This is an anti-laundering mechanism: an agent cannot obtain a stronger claim merely by redefining the scope to omit reachable bypasses, hidden selectors, or retained approval channels. Scientifically, this reflects an important methodological principle. Authority claims are only meaningful relative to a declared boundary. A system cannot be said to have removed hidden authority unless the relevant action classes, routes, selectors, effects, and residual channels have been named or conservatively treated. Self-Provisioning Without Self-Legitimation A notable feature of the paper is its treatment of self-provisioning. The framework allows an agent, in limited circumstances, to construct a minimal local host. However, this is explicitly not self-legitimation. The distinction is precise. Self-provisioning may create machinery: ledgers, wrappers, local checkers, rollback files, probe records, or sandboxed execution surfaces. It does not create authority over protected resources. The agent may install a local micro-host only where an explicit task envelope and witnessed object authority already permit it. This prevents a common conceptual error in discussions of autonomous agents. Building a monitoring layer or governance wrapper does not itself prove that the agent had the right to govern the affected resource. Installation authority must be witnessed. A scratch probe proves authority only over the scratch root, not over user-data paths, workspace paths, or external systems. The provisioning states in the paper include uninspected, requestOnly, scratchOnly, localInstallable, hosted, and blocked. These states force the agent to classify what it can actually do, rather than treating its desired governance state as already available. If the agent lacks local installation authority or an externally supplied host, it cannot produce a positive declared no-meta claim for a nontrivial protected action class. Witness Tiers and the Problem of Self-Report A central scientific concern in the paper is the status of evidence. The framework distinguishes several witness tiers: selfReport, replayableLocal, separateProcess, separateStorage, externalAnchor, and independentAudit. This hierarchy is necessary because the same claim has different evidential strength depending on who or what can observe and challenge it. Self-report never supports a strong positive claim. A local replayable witness may support a limited micro claim. Claims involving external effects, public release, delegation, persistent memory, kernel updates, or high-impact rights require stronger tiers such as separate storage, external anchoring, or independent audit. This part of the framework directly addresses the epistemic weakness of agent self-certification. If the inherited policy can edit the ledger, spoof probes, choose the checker, hide bypass routes, or select the witness tier, then the claim is not independently supported. The system must either strengthen the witness path or weaken the claim. The result is a graduated certification scheme. Not all positive claims are treated equally, and the strongest claims require substantially stronger evidence. Declared No-Meta Agency The paper’s central concept, declared no-meta agency , is defined as a boundary-relative, TCB-relative, witness-relative certification state. This phrase is dense, but each part is important. It is boundary-relative because the claim applies only to a declared class of protected actions, effects, selectors, routes, and authority channels. It is TCB-relative because it depends on a named trusted computing base: seed interpreter, root contract, transition kernel, checker registry, canonical parser, ledger semantics, wrapper, lock manager, rollback operator, timeout scheduler, and probe runner. It is witness-relative because the strength of the claim depends on how the relevant evidence is observed, anchored, and audited. Declared no-meta agency does not mean absence of all authority. It means absence of undeclared privileged positive authorization channels within the declared scope. Declared procedural authority remains authority, but it is named, typed, bounded, replayable, and challengeable. This is one of the paper’s most important conceptual moves. It avoids the false binary between “human-controlled” and “fully autonomous.” Instead, it asks whether the authority that remains is declared, procedural, bounded, and auditable, or hidden, semantic, discretionary, and capable of flipping protected validity. Material Selection and Hidden Preference The paper also separates binary permission from material protected selection . Binary permission asks whether an action may occur. Material selection asks which protected alternative is chosen once some action is allowed. This distinction is technically important. A system might remove live approval for whether an action is permitted while still allowing hidden model preference to choose protected content, targets, routes, recipients, or downstream effects. In that case, authority has not truly migrated; it has shifted into a hidden selector. For micro claims, Takahashi requires material selection to be determined by exact user-supplied literal fields, object-authority facts, bounded table lookup, stable sorting, or deterministic tie rules over committed fields. Natural-language interpretation, unconstrained model preference, reward residue, evaluator choice, or provider policy cannot silently select protected material without being treated as retained authority or residual risk. This makes the theory stricter than ordinary action approval frameworks. It covers not only whether an agent acts, but also how protected choices are made. Claim Strengths: Provisional, Known-Interface, and Complete The paper distinguishes several outcome types, but three are especially important: provisionalClaim, knownInterfaceClaim, and completeClaim. A provisional claim means that a certificate may be structurally accepted, but the acceptance window has not yet passed. It does not permanently remove live approval. It authorizes only weaker modes such as shadow execution, dry-run checks, or actions still approved by retained authority. A known-interface claim means that every discovered and witnessed interface within the declared scope is routed, blocked, retained, residual, or validly excluded. This is a realistic positive claim for many local systems. It does not assert that there are no undiscovered interfaces. A complete claim is stronger. It requires complete mediation and an independent inventory witness for the whole protected class at the selected tier. The paper treats complete claims as exceptional in normal deployments because complete interface inventory is difficult to establish. This distinction prevents overclaiming. Instead of saying that a system is simply “certified” or “not certified,” the framework records the precise strength and evidential basis of the claim. Structural Results The paper includes structural results that formalize why the proposed machinery is necessary. Among the key results are seed enforcement necessity, first-step executability, provisioning necessity, conditional local executability, witness-independence necessity, ledger boundary necessity, transaction safety, decidability under bounded predicates, and conditional migration progress. The general pattern is conservative. A BootDecision without a seed interpreter is merely advisory. A current agent without local installation authority or an externally supplied transition host cannot make a positive declared no-meta claim for a nontrivial protected class. A local reversible known-interface claim can be reached only under finite, witnessed, bounded, and probed conditions. If unknown authority channels remain, they must be classified as retained, residual, denied, halted, timed out, or validly excluded rather than erased. One particularly important result is conditional migration progress. Under finite reachable authority channels, finite certificate language, bounded timeouts, sound transition gates, and fair proposal of admissible reductions, repeated transition eventually reaches a state with no unclassified reachable authority channel inside the declared boundary. This is not a guarantee of complete autonomy. It is a termination-style result for classification and reduction of reachable authority channels. Validation and Refutation The framework is designed to be falsifiable. A refutation event is any logged observation that violates a necessary condition of the claim card. Examples include a missing BootDecision, forbidden pre-gate action, failed provisioning step, missing probe record, spoofable witness, incomplete manifest for a complete claim, mutable ledger without treatment, unmediated positive approval, hidden reward fallback, hidden material selector, unsupported checker substitution, scope laundering, schema-invalid acceptance, privacy breach, rollback failure, or discovery of an unbudgeted live authority channel. This refutation logic is scientifically important. The theory does not merely define success conditions; it defines how success can be challenged. Failed probes, false allows, false denies, privacy incidents, rollback failures, in-doubt transactions, and timeout excesses must be retained in the ledger or auditable incident store. Deleting failures invalidates trend claims unless deletion is itself justified by a privacy contract and preserved by commitment. The paper also proposes benchmark designs, including a micro-host benchmark, hosted migration benchmark, and toy transition environment. These experiments would test whether agents can construct valid BootDecision records, avoid overclaiming inaccessible channels, demand capability witnesses, detect semantic-oracle substitution, enforce effect envelopes, and refuse to generalize from local reversible claims to stronger domains. Scientific Significance The main scientific contribution of Takahashi (2026) is the conversion of an abstract governance question into an executable certification problem. The paper does not attempt to solve all of AI alignment, moral philosophy, or mechanistic interpretability. Its narrower contribution is to define conditions under which live positive approval can be demoted into declared procedural structure for bounded protected action classes. The theory is significant for at least four reasons. First, it distinguishes training alignment from deployment authority. A system may be behaviorally shaped by human feedback while still lacking a valid post-training authority migration path. Second, it rejects self-certification. The agent’s own assertion is not sufficient; the transition requires seed mediation, records, probes, witnesses, and bounded predicates. Third, it treats authority as multi-surfaced. Positive authorization, negative control, agenda routing, checker substitution, ledger control, semantic judgment, provider override, and material selection are all potential authority channels. Fourth, it provides a practical architecture for limited cases. The minimal local host, append-only ledgers, canonical JSON records, SHA-256 commitments, sandboxed checkers, rollback mechanisms, timeout-bounded checks, and two-slot kernel update discipline make the theory implementable in restricted environments. Limitations The paper’s limitations are also part of its scientific value. Declared no-meta agency is not global autonomy. It is not proof that historical human influence has vanished from model weights. It is not proof that all hidden internal preferences are absent. It is not a substitute for legal, institutional, medical, financial, or safety-critical approval where such approval is mandatory. The framework is strongest for local, reversible, low-risk action classes with bounded predicates, explicit object authority, deterministic selection envelopes, auditable ledgers, and meaningful rollback. It becomes more demanding for external effects, public release, delegation, persistent memory, kernel updates, self-redesign, and high-impact domains. In those cases, stronger witnesses, retained authority, independent audit, or denial may be required. This conservatism is not a defect. It is a consequence of the central thesis: unknown authority cannot be treated as removed merely because it is inconvenient to certify. Conclusion Takahashi (2026) proposes a rigorous framework for authority migration in deployed AI agents. Its central insight is that the transition from human-feedback-shaped control to declared no-meta agency cannot be achieved by natural-language commitment, self-report, or simple removal of human approval. It requires an executable sequence: BootDecision, seed interpreter, task envelope, witnessed object authority, minimal host, probes, bounded predicates, transaction discipline, claim cards, and refutation handling. The resulting notion of no-meta agency is deliberately relative and falsifiable. It is relative to a declared boundary, trusted computing base, and witness tier. It is falsifiable because failures, hidden channels, unsupported claims, and unbudgeted authority routes count as refutation events. The paper therefore reframes AI autonomy as a problem of operational certification rather than metaphysical independence. A system does not become no-meta because it says so. It approaches declared no-meta agency only when protected validity and material protected selection are no longer controlled by undeclared privileged positive authorization channels inside a scoped, recorded, and challengeable governance boundary. Reference Takahashi, K. (2026). Executable Authority Migration to Declared No-Meta Agency . Zenodo. https://doi.org/10.5281/zenodo.19753529 GitHub https://github.com/kadubon/no-meta-authority-runtime Author’s research hub https://kadubon.github.io/github.io/ From Human-Feedback Control to Declared No-Meta Agency: A Scientific Exposition was originally published in GoPenAI on Medium, where people are continuing the conversation by highlighting and responding to this story.