Software encourages a dangerously broad verb: run. In the physical world, there is no generic run. There is movement within a geometry, force within a limit, material within a temperature range, and a person accountable for releasing the action.
A prompt can express intent. It cannot, by itself, enforce the boundary between a useful action and an unsafe one.
Permission must attach to the actor
A machine should not merely receive a valid command. It should know which persistent agent requested it, on whose authority, for which task, in which environment, and until when that authority remains valid.
This makes access legible. The same tool may be available to several agents while each receives a different operating envelope based on role, training, supervision, and current conditions.
Capabilities need physical envelopes
API permissions are often binary. Physical work is continuous. Speed, force, volume, duration, workspace, sample class, and proximity to humans may all change what is permitted.
A governed capability therefore includes executable limits and telemetry, not only credentials. The boundary should fail closed when state becomes ambiguous or the environment leaves the approved range.
Intervention is part of collaboration
Multiplayer work is not several people watching a stream. An authorized human or agent must be able to pause, redirect, narrow, or take over without destroying the shared context that led to the intervention.
The interruption itself belongs in the record: who intervened, what they observed, what changed, and why execution resumed.
The outcome returns to the same record
A completed command is not enough. The agent must receive the machine’s actual response—telemetry, exceptions, resulting state, and evidence of completion—and reconcile it with the intended outcome.
That closes the loop between cognition and consequence. The agent does not merely claim that it acted; the world reports what happened back to the accountable history.
Authority becomes trustworthy when it is explicit enough to inspect before action, enforce during action, and reconstruct after action.