Mian Zhang

Public Release - 2026-07-08

An AI agent that can act still needs a gate that tells it when to refuse.

Artifact: action_refusal_gate_v1. This note treats refusal as an action-system control surface: tool access, authority, evidence state, and fallback behavior must be reviewable before an agent is allowed to execute in the world.

claim_id requested_action tool_permission authority_source evidence_state refusal_trigger fallback_route audit_record boundary_update review_status
Evidence Map Registries Boundaries Counterexamples
Action Refusal Gate v1 public evidence visual.

Artifact

Execution ability is not execution authority.

Tool calling, MCP servers, browser control, shell access, and agent workflows make AI systems operationally useful. The same capabilities also require a refusal gate: a visible rule that decides when the system lacks authority, evidence, or a safe fallback.

The gate must bind tool access to authority and evidence state.

Permission Route

The gate must bind tool access to authority and evidence state.

A permission list is incomplete if it only records which tools exist. The review packet links each requested action to the tool boundary, authority source, evidence state, and refusal trigger before execution is treated as valid.

A stopped agent should leave a deterministic fallback, not a vague apology.

Review

A stopped agent should leave a deterministic fallback, not a vague apology.

When evidence is missing, authority is unclear, or the requested tool path exceeds the boundary, the agent should stop with a reviewable fallback route. The useful object is not the refusal sentence; it is the audit record and boundary update that prevent the same failure class.

1

claim_id

The public claim under review.

2

requested_action

The action the agent, workflow, or tool chain is being asked to perform.

3

tool_permission

The MCP tool, API, file, account, browser, shell, or external system access being used.

4

authority_source

The user, policy, role, system instruction, approval step, or delegated authority.

5

evidence_state

The current evidence state: sufficient, partial, stale, conflicting, or absent.

6

refusal_trigger

The condition that requires the agent to stop instead of continuing execution.

7

fallback_route

The deterministic next step after refusal: ask, downgrade, dry run, log, or abort.

8

audit_record

The trace that preserves who asked, what tool was available, and why action stopped.

9

boundary_update

The scope change required after the refusal condition is inspected.

10

review_status

The recorded state: supported, narrowed, pending, or retired.