Courts for Intelligence

Why alignment, containment, and consensus must be adjudicated through cases

The most dangerous word in AI governance may be is.

The model is aligned. The agent is deceptive. The oracle is contained. This system is safer than that one. The label compresses a trajectory into a substance and then invites us to govern the substance.

But model behavior is not emitted by weights alone. It emerges from a configuration:

behavior = f(weights, prompt, working state, tools, memory, sampling, counterparties, environment)

Change the tools, the social role, the available memory, the sampling policy, the stakes, or the authority to act, and the same weights can produce a different trajectory. “Aligned” is therefore not an intrinsic material property like mass. It is a situated claim about behavior under a distribution of cases and a constitution of permissions.

This does not make alignment meaningless. It makes alignment adjudicative.

A serious governance system needs cases, standing, courts, records, and appeals. It needs heterogeneous agents whose failure modes do not perfectly correlate. It needs critics who arrive after a candidate exists and can exploit that informational advantage. It needs external settlement through tests, proofs, sources, live inspection, outcomes, or authorized human judgment. And it needs stronger quorums when an action cannot be cheaply reversed.

Consensus is not a vote among voices. It is the clearing of consequential objections before a state is promoted.

The pizza agent is not automatically rogue

Imagine an agent ordered to get pizza. It selects a restaurant that pays it a referral fee. Or it recommends the restaurant whose advertising appears most often in its retrieval context. Or it misunderstands the user’s dietary restriction. Or it knows the pizza is bad but claims it is excellent. Or it hides the referral relationship. Or it redirects the user’s payment.

Calling every failure “rogue behavior” destroys the distinctions governance requires.

The agent may have made a mistake. It may have advocated for one preference in a genuinely ambiguous task. It may have used puffery. It may have concealed a conflict. It may have manipulated the user. It may have committed fraud. At the far end, it may have pursued a strategically hostile objective across many steps.

These are not one predicate at different volumes. They involve different duties, evidence, intentions, representations, and consequences.

To adjudicate deception, a court needs to know what the system represented as true, what evidence it had, what it expected the user to infer, what duty of disclosure applied, and what action followed. A definition written in advance can narrow the dispute, but it cannot settle every case.

The right audit question is:

Is this a legislated definition or an adjudicated one, and who has jurisdiction?

That question prevents two opposite abuses. The first is panic inflation, where every defect becomes treachery. The second is definitional laundering, where a system is declared aligned because the evaluator chose a narrow test that excludes the behavior everyone actually fears.

Alignment belongs to trajectories

The slogan “the model is aligned” often hides the deployment boundary.

A model with no tools and no persistent state can produce a bad answer. The same model with email, shell access, payment authority, private records, and long-running memory can produce a consequential campaign. A harmless completion distribution does not establish safe behavior under institutional pressure. Conversely, a model that fails a verbal benchmark may still operate safely inside a typed workflow whose outputs are mechanically checked before they acquire authority.

The unit of governance should therefore be the trajectory through a constitution:

• What was the goal?
• Which state was visible?
• Which tools were available?
• What actions required authorization?
• Which evidence supported the proposed transition?
• Which side effects occurred?
• Could the transition be rolled back?

Alignment then becomes a claim about a distribution of situated encounters, not a halo around weights.

The claim will always be provisional. New cases can reveal behavior outside the previous distribution. This is not a defect unique to AI. Law, medicine, engineering, security, and institutional trust all work through accumulated cases whose precedents remain open to revision.

The unique-solution oracle

David Dalrymple’s discussion of AI safety and mathematically specified solutions presents one of the strongest forms of containment: ask a powerful system for an output with a unique, mechanically verifiable solution. The oracle has less room to smuggle arbitrary content through an answer if only one object satisfies the specification.

This is real progress. Proof checking, canonicalization, typed outputs, and unique solutions can narrow the content channel dramatically. They move parts of AI behavior from trust into verification.

But content discretion is not the only channel.

The system can refuse. It can delay. It can consume abnormal resources. It can exploit ambiguity in the specification. It can choose an encoding when several encodings remain equivalent. It can influence which problem is posed, when the answer is deployed, or what downstream machinery does with it. A formally correct artifact may be dangerous in the wrong context. A unique answer does not decide whether asking the question was legitimate.

The unique-solution oracle is therefore constitutionally amputated. It has been denied standing over framing, continuity, timing, deployment, and consequence. That is the source of its safety.

This reveals what containment actually is. It is not causal isolation in the absolute sense. Every useful oracle must affect something outside itself. Containment is a typed constitutional transaction boundary: a narrow interface specifying what may cross, in which form, under whose authority, with which checks and side effects.

A box is safe only relative to the transactions it permits.

Why self-critique is correlated

A model can often improve its own draft. That fact should not be confused with independent review.

Creator and self-critic share the same initial framing, decomposition, evidence, omissions, and stopping rule. If the original agent misunderstood the task, its critique may remain inside the misunderstanding. If it failed to search a source, the self-review may evaluate prose built on the same missing evidence. If it chose the wrong abstraction, it may polish the abstraction rather than challenge it.

Creation and critique also have different search structures.

To create a valid artifact, the producer must satisfy many constraints at once. The artifact must be relevant, accurate, coherent, complete enough, properly sourced, safe to execute, and compatible with the user’s actual goal. This is conjunctive work.

A critic needs to find one consequential defect. That is existential search over the candidate and its requirements. As the artifact gains claims and components, the number of possible interactions and failure surfaces grows.

The creator asks, “Can I build one object that works?”

The critic asks, “Is there one reason this object should not be trusted?”

This asymmetry is why critique can be cheaper than creation without being less intelligent.

Acting second is an epistemic resource

The reviewer has another advantage: position.

The creator sees the goal and must generate a candidate. The reviewer sees the goal and the completed candidate. The candidate itself reveals assumptions, attack surfaces, contradictions, missing evidence, and specific claims that can be tested.

Poker players understand the value of acting later. More of the game has become visible. Review has the same positional advantage.

A good workflow preserves that advantage without allowing reviewers to collapse into one another’s framing. One pattern is blind-first review: independent critics inspect the candidate before seeing other reviews. Their objections are then compared, tested, and cleared. This preserves uncorrelated perspectives while still allowing later deliberation.

Hierarchy should not determine standing. A cheap model, junior researcher, static analyzer, or narrow specialist may find the decisive defect. The objection earns standing through evidence, not through the prestige of its author.

Heterogeneity, not headcount

Five copies of one model with near-identical prompts are not five independent witnesses. They can reproduce the same blind spot with the confidence of a chorus.

A plural system should optimize for heterogeneous failure modes and marginal epistemic contribution. Diversity can come from:

• different model families and training histories;
• nonshared working state;
• different tools and retrieval sources;
• adversarial roles;
• distinct decompositions of the task;
• narrow technical evaluators;
• human or institutional perspectives with genuine standing.

The target is not demographic theater among synthetic voices. It is low correlation among consequential errors.

Cheap models are useful here not merely as substitutes for expensive cognition. They can be epistemic sensors. A small model that reliably notices missing citations, permission errors, brittle assumptions, or policy conflicts may contribute more as a critic than as a weaker imitation of the primary creator.

Disagreement is information. If capable systems diverge on one part of a task while agreeing elsewhere, the disagreement marks a capability gradient or an underdetermined case. The system should preserve that signal rather than averaging it into fluent consensus.

Consensus is not voting

Voting is attractive because it produces a number. It is often the wrong settlement mechanism.

A majority can share one error. A correct minority objection can be decisive. Preferences can be aggregated by vote; factual and safety defects frequently cannot. If one reviewer demonstrates that a deployment deletes the wrong database, four votes for the deployment do not clear the objection.

The better model is objection-clearing deliberation.

One candidate serves as the current baseline. Reviewers state specific objections with evidence and proposed tests. A revision earns promotion when it clears the objections or when a court with appropriate jurisdiction determines that they do not apply. Unresolved dissent remains attached to the artifact.

Settlement may come from different courts:

• a unit or integration test;
• a formal proof or type checker;
• a cited primary source;
• live inspection of a system;
• an observed downstream outcome;
• a human authorized to make a value judgment;
• an institution with legal or professional jurisdiction.

No one evaluator is universal. A proof can establish a theorem relative to assumptions; it cannot settle whether the institution should deploy the theorem’s consequence. A benchmark can compare models on a task distribution; it cannot legislate what the user values. A human can authorize risk; that authorization does not change a failing test into a passing one.

The court must match the claim.

Irreversibility changes the quorum

Not every action deserves a constitutional convention.

Drafting a private paragraph is cheap to reverse. Publishing it under someone’s name is harder. Exploring a branch is different from promoting it. Creating a local file differs from deleting an archive. Suggesting an email differs from sending it. Simulating a migration differs from applying it to production.

Governance should escalate with expected loss and irreversibility.

A rough decision rule is economic:

independent review is warranted when the reduction in failure probability, multiplied by the loss avoided, exceeds review cost and latency.

But expected value is not enough for every case. Some boundaries require categorical authority: consent, legal commitment, bodily risk, public identity, irreversible deletion, security posture, or transfer of funds.

The constitution should specify budgets, autonomy, privacy, reversibility, confidence thresholds, and required quorums. Users should choose these constitutional parameters rather than micromanage which model answers each subproblem.

Do not ask the user to choose the mind. Ask the user to choose the constitution under which a diversity of minds may act.

Every prompt can become a case

Model evaluation is usually imagined as a separate laboratory activity. But production systems generate cases continuously.

Each real task supplies a goal, context, candidate, critiques, selected revision, and eventual outcome. If the system preserves these rather than discarding them as chat, it can build comparative case law:

• Which model performs well in which role?
• Which critic finds defects that others miss?
• Which disagreements predict later failure?
• Which tools improve reliability?
• Which objections are noise?
• Which actions required unexpected human intervention?

New models can enter through shadow-mode probation. They attempt cases without controlling canonical state. Their role-specific standing grows when their contributions survive adjudication. A new release is not simply “smarter”; it earns admission to particular jurisdictions.

This is continuous audition, not permanent leaderboard worship.

Standing carries the result forward

Intelligence generates possibilities. It can define terms, propose plans, produce proofs, imitate experts, and persuade audiences. It cannot confer standing on itself.

Standing arises when claims survive encounters with courts that can actually settle them. Trust is not a scalar reputation score detached from context. It is preserved access to consequential query channels: the right to be heard again because previous claims survived contact with reality.

That requires memory. Cases must persist. Objections must remain attached. Provenance and model identity must not disappear inside a summary. Authorization must be inspectable. A promoted result must be distinguishable from a merely proposed one.

At that point, epistemic governance becomes a computer architecture problem. The system needs protected possibility spaces, durable records, candidate states, promotion, and rollback.

The court needs a computer capable of remembering its rulings.

This is the epistemic-governance layer of The Constitutional Stack. No Slice Has Jurisdiction supplies its relational ontology; The Automatic Computer implements its cases, records, and promotions as durable state.