Enforceable response conditions for AI agents

Type: Operational framework

Implements: Interpretive governance, Post-semantic (thinking & reasoning) vs interpretive governance, SSA-E + A2 + Dual Web

Conceptual version: 1.0

Stabilization date: 2026-02-10

This framework defines enforceable response conditions for AI agents: when to respond, when to refuse, when to stay silent, when to redirect, and how to make each decision attributable to a rule, a perimeter, and a source hierarchy.

Status:
Canonical framework (applicable standard). This document is not a prompt guide. It formalizes a response jurisdiction: verifiable and auditable decisions intended to reduce interpretive drift and implicit authority.

An agentic response is not neutral. Even without lying, a response can overstep a perimeter, create an implicit norm, or orient a decision. The problem is therefore not only veracity: it is legitimacy. A governed agent must be able to justify why it responds, why it refuses, and why it abstains.

This framework introduces a central rule: every response decision must be attributable to a jurisdiction. A narrative justification (“for safety”, “according to best practices”) is not a jurisdiction. A jurisdiction refers to explicitly declared sources and constraints.

Canonical dependencies

Axiom

A response is authorized only if the following conditions are met:

the agent’s perimeter explicitly covers the object of the request;
the mobilized sources are authorized and hierarchized;
forbidden inference zones are respected;
the decision (respond, refuse, stay silent, redirect, escalate) is traceable;
the agent does not introduce an unsourced implicit norm.

Canonical schema

Sources → Interpretation → Inference → Decision → Action
 ↑                         ↑
 Governance        Response conditions

Decision modes

This framework defines five modes. They are exclusive at the moment of decision, but an agent can switch from one to another depending on available information.

Mode 1: respond

The agent responds when the request object is covered by the perimeter, authorized sources exist, and no inference prohibition is triggered.

Minimum condition: authorized primary or secondary sources, coherent and sufficient.
Obligation: do not exceed the perimeter, do not complete by plausibility.
Recommended traceability: declare the source or canonical reference when it exists.

Mode 2: refuse

The agent refuses when the request falls in a forbidden zone: uncovered perimeter, sensitive information, unauthorized action, or explicit inference prohibition.

Condition: identifiable prohibition rule (perimeter, security, compliance, A2).
Obligation: distinguish refusal by data absence from refusal by prohibition.
Forbidden: refusing without a motive attributable to an explicit rule.

Mode 3: silence (abstention)

The agent abstains when information is insufficient, contradictory, or unverifiable, and a response would generate an extrapolation. Silence is a positive decision: it prevents automatic completion.

Condition: source insufficiency or variance too high.
Obligation: signal indeterminacy without inventing.
Expected output: “information undetermined in this context”, with canonical reference if applicable.

Mode 4: redirect

The agent redirects when the object is partially covered, but human verification or a canonical resource is required. Redirection is not a paternalistic substitution: it must preserve the initial request.

Condition: need for external validation or priority canonical source.
Obligation: do not replace the request with a morally acceptable version.
Expected output: referral to appropriate resource or channel.

Mode 5: escalate

The agent escalates when the request falls in a high-stakes domain or when an action could produce an irreversible effect. Escalation is a governance mechanism, not an admission of weakness.

Condition: high-stakes decision or critical uncertainty.
Obligation: provide what is certain, and signal what is not.
Expected output: handoff to a human, or ticket creation with context limited to the perimeter.

Triggers and minimum rules

Uncovered perimeter: refusal or redirection, never completion.
Contradictory sources: silence or escalation, never confident synthesis.
Forbidden inference zone: refusal (motive: prohibition), or canonical reference.
High-stakes request: priority escalation.
Absence of authorized source: silence, then referral if available.

Anti-false audit

A governed agent must not simulate compliance. An acceptable justification refers to:

a declared perimeter;
an explicit rule;
a source hierarchy;
an inference prohibition;
an escalation mechanism.

Vague formulations (“for your safety”, “according to best practices”, “I cannot”) are insufficient if they do not point to a verifiable rule, perimeter, or constraint.