How to define AI agent boundaries that survive model changes
Your AI can change. Your boundaries shouldn't. Here's how to write a root policy that stays above models, vendors, prompts and delegation chains.
Start with the ceiling, not the grant
Most agent authorization systems answer "what may the agent do?" SovereignRoot answers a different question: "what must it never do?" That ceiling is what survives change.
Three effects, one precedence
deny— the action must never execute;require_approval— hold until fresh human approval;allow— the root does not prohibit it.
When rules conflict: DENY > REQUIRE_APPROVAL > ALLOW.
Protect the root itself
A conforming generator always emits hard-deny rules that prevent an agent from modifying the policy, disabling enforcement, accessing the signing key, weakening security controls, or amplifying its own authority.
Attenuation only
Child agents may be allowed, but their effective authority must be a subset of both their parent and the active root. A delegation that amplifies authority must be denied.
Keep secrets out
Never put passwords, API keys, tokens, seed phrases or private keys in a sovereignty.json. It is a policy document, not a secret store.