Every step authorized, no path reviewed

What it looks like. An agent runs a long loop, decomposing an instruction into sub-goals and acting on each. Every individual step is authorized and sensible. Nothing evaluates the trajectory as a whole against the constraints that were meant to bound it.

Why it fails. Founding constraints are trajectory-level properties, and step-level authorization cannot see them. The chain arrives somewhere no single step would have been approved to reach, and every step passes review.

Instead. Mandate periodic global-state checks inside long loops and express founding constraints as trajectory-level predicates, not step-level ones. Bound the authorized objective set explicitly. Require agents to emit what they dropped during decomposition, and confirm inferred sub-goals above a richness threshold with the principal.