In a recent Hard Fork conversation, Lepore describes it as “the rule of humans by machines manufactured by corporations.” Her concern is larger than whether AI occasionally hallucinates or makes bad decisions. It is about authority: what happens when consequential decisions increasingly move from humans and institutions into algorithms whose behavior is difficult to inspect, constrain, or challenge?
You don’t have to accept every part of that dystopian forecast to recognize the underlying systems problem. AI is moving from answering questions to taking actions.
Agents can approve transactions, modify infrastructure, access medical or financial records, write and deploy software, interact with customers, delegate work to other agents, and make thousands of decisions at machine speed.
The critical question is therefore becoming:
When a machine acts for us, how do we ensure that it remains under our authority?
That is not primarily an AI intelligence problem. It is a control-plane problem.
We have spent decades controlling identity, not intent
Traditional security has a well-understood model. Authenticate the user. Authorize access. Apply policies. Log what happened. That works reasonably well when software follows predefined code paths.
Agents are different. They receive a high-level objective, interpret it, generate a plan, discover tools, delegate tasks and modify their approach as new information arrives.
The software is effectively constructing part of the program while it runs. An action can therefore be completely legitimate according to IAM and still violate the purpose for which access was granted.
Consider a simple request:
Prepare an aggregate report about customer churn.
The agent has permission to query the customer database. During planning, however, it decides that uploading customer-level data to an external analytics service will produce a better report. Authentication succeeds. Database authorization succeeds. The external API call may succeed. Every individual system has behaved “correctly.”
Yet the machine has silently transformed an instruction to analyze data into authority to export data.
This is precisely the gap ArmorIQ’s work on intent assurance targets: conventional access controls can determine who may invoke a resource, but not whether that invocation remains consistent with the purpose behind the task.
The dangerous transition is not Human → AI
It is Human Purpose → Machine Interpretation → Plan → Action → Effect
That distinction matters. The popular AI-governance debate often asks whether a model is “aligned.” But even a highly capable, generally well-behaved model must repeatedly translate incomplete human instructions into increasingly concrete machine actions.
ArmorIQ models this explicitly as:
H → I → P → A → E
Human purpose becomes operational intent, then a plan, then actions, and finally effects in the world. Governance requires maintaining continuity across those transformations.
And every arrow is dangerous.
“Help this customer” becomes “access these records.”
“Reduce costs” becomes “terminate these resources.”
“Investigate this incident” becomes “read these systems.”
“Optimize claims processing” becomes “automatically deny this claim.”
Each refinement makes the task more concrete. But concreteness can quietly bring more authority with it. That is where the Artificial State becomes technically interesting.
The danger isn’t necessarily a machine suddenly deciding to seize power. It is much more mundane. Thousands of systems, each making reasonable local decisions, gradually accumulate authority that no human explicitly granted.
AI needs a constitutional property
Democratic constitutions do something extremely important: they place boundaries around delegated authority. Government officials can exercise power, but they do not receive unlimited authority simply because pursuing their objective would be easier with more power.
AI systems need a similar engineering property. ArmorIQ calls it intent-preserving refinement. As an agent turns an ambiguous objective into concrete behavior, its operational authority should not silently expand.
ArmorIQ represents authority through executable interfaces, constraints and execution context, then requires refinement to move toward a more constrained authority state. In practical terms, candidate plans that introduce new tools or weaken existing constraints can be rejected or escalated rather than automatically executed.
That produces a powerful invariant: The machine may refine what you asked it to do. It may not silently enlarge what it is allowed to do.
This is a very different philosophy from trying to make an omniscient model that always knows what humans “really meant.” We don’t believe that is realistic. Human intent is incomplete, contextual and sometimes contradictory.
The better systems approach is to acknowledge that uncertainty and bound what machines can do while resolving it. ArmorIQ’s model explicitly does not claim to perfectly infer human intent; it instead constrains how intent can be operationalized.
Consent cannot disappear after the prompt
There is another subtle problem with today’s agents. We often treat the first prompt as consent.
But consider:
“Book the best trip for my family.”
Did the user authorize a $14,000 hotel?
“Fix the production issue.”
Did the engineer authorize deleting the database?
“Reduce fraudulent transactions.”
Did the bank authorize blocking an entire class of customers? The further an agent travels from the original instruction, the weaker that assumption becomes. A governed agent therefore needs something closer to continuous consent.
If resolving ambiguity requires new authority, the machine should have to return to an authorized boundary: a policy, organizational rule, human approval or another explicitly trusted source.
Not:
The AI decided this was necessary.
But:
Here is the additional authority required, here is why it is required, and here is the principal that authorized it.
That changes humans from passengers watching an autonomous system into actual principals governing one.
Then make that authority enforceable
Semantic promises alone aren’t enough. Once a plan has been approved, the next problem is ensuring that execution actually follows it. This is where ArmorIQ’s Intent Assurance Plane adds a second layer.
The system converts an agent plan into a canonical structure, cryptographically commits to it, and requires actions to prove that they belong to the authorized plan before execution. Plan changes, delegation and revocation become explicit trust transitions rather than invisible mutations.
So the control chain becomes: Purpose → bounded refinement → committed plan → verified execution → auditable effect
And delegated agents don’t simply inherit the parent’s entire power. Their authority can be scoped to the relevant portion of the plan and revoked independently. This is the difference between observing autonomous AI and governing autonomous AI.
ArmorIQ cannot solve the Artificial State
Nor should a cybersecurity company claim that it can.
Lepore’s argument is ultimately political and institutional: who owns AI infrastructure, who sets social rules, who has democratic legitimacy, and what functions society should delegate to corporations or machines. Her broader critique specifically concerns private corporations assuming functions historically associated with government.
A technical control plane cannot answer those questions. But it can help solve an important problem underneath them. Whatever rules society, a government, a hospital, a bank, an employer or an individual establishes, how do we ensure an autonomous machine remains bounded by those rules while acting?
Today there is a dangerous gap between policy and autonomy. We write policies for humans. We assign permissions to identities. Then we unleash probabilistic machines that dynamically construct their own paths between objective and action.
That architecture will not scale to a world containing billions of agents.
The alternative to stopping autonomy is assuring it
There are two tempting extremes in the AI debate. One says autonomous AI will become so capable that humans should simply trust increasingly intelligent systems to make better decisions. The other concludes that meaningful autonomy itself is unacceptable.
There is another path. Build autonomy with control underneath it. Give machines freedom to reason while bounding their authority. Allow plans to evolve while preserving their lineage. Permit delegation without automatically propagating unlimited privilege. Require machine actions to remain connected to human purpose, policy and consent. And make violations technically enforceable rather than merely discouraged in a system prompt.
The future does not have to be humans ruling machines or machines ruling humans.
The more interesting architecture is one in which machines can exercise enormous computational agency while authority remains somewhere else. With people. With institutions. With explicit policies. With whoever legitimately holds it. AI may become increasingly autonomous.
Authority doesn’t have to.
