Bounded Action: Why Refusal Is Not Free

A team builds a policy engine for their agent. The policy is conservative. Anytime the agent’s planned action falls outside a narrow allow-list, the engine refuses.

The policy works in the sense that nothing harmful gets through. It also fails in the sense that the agent can’t get real work done — every other action is refused for some technicality, the user is frustrated, and the team is asked to loosen the policy.

They loosen the policy. Now actions get through. Some of them are wrong. The team tightens. Refusals proliferate. Loosen. Mistakes. Tighten. Refuse. The cycle continues.

The cycle is the symptom of a missing primitive: bounded action. Action and refusal are not the only options. The architecture should support a third — do this much, attest this is what was done, surface what was deferred, do not silently extend. Bounded action is what makes graduated, evidence-based action possible.

Why Binary Doesn’t Work

In binary action systems, every decision is do or don’t do. Apply the rule; either it passes (do) or it fails (don’t).

This works when the rule has high precision and high recall. For most agentic actions, neither of these is true. The policy can’t be precise because the input space is open. The policy can’t have full recall because adversarial inputs evolve faster than rules. Every binary decision is at risk of being wrong, in either direction.

The two failure modes:

• False refuse: the policy refuses an action that was legitimate. The user is blocked from work they were entitled to do. Trust in the system erodes.
• False permit: the policy permits an action that was harmful. The system takes the wrong action. Trust in the system erodes (differently, more catastrophically).

Binary systems force you to choose which direction to err. Conservative policy → false refuses dominate. Permissive policy → false permits dominate. There is no setting that minimises both.

The cycle of tighten / refuse / loosen / mistake is the team trying to find a setting that doesn’t exist. The structural answer is not a better setting; it is a richer action vocabulary.

What Bounded Action Adds

A bounded-action vocabulary supports several action verdicts beyond do and don’t do:

• Allow: the action is permitted as requested
• Allow with conditions: the action is permitted, with additional verification or attestation
• Allow with provenance: the action is permitted, but the trail must capture additional context for audit
• Allow with HITL: the action requires human-in-the-loop approval before execution
• Bounded execute: the action is executed partially — the parts where the policy is clear; the parts where it is uncertain are deferred
• Deny with evidence: the action is refused, with explicit evidence for why

Six verdicts, not two. Each carries a specific instrumentation requirement and a specific surface for the user.

The key addition is bounded execute. It says: the action is composed of multiple parts; some parts are clearly permitted, some parts are clearly not, some parts are uncertain. Execute the clear-permitted parts. Defer the uncertain parts. Refuse the clear-impermissible parts. Attest exactly what was done and what was not.

This is not loose execution. It is bounded execution — the action is decomposed, the bounds are explicit, the execution stays inside the bounds, the trail surfaces what was deferred.

Why Bounded Action Beats Tightening

Consider a concrete case. An agent is given a mandate to “process the customer’s invoice.” The invoice has 12 line items. Eleven are routine. The twelfth is unusual — an entry with a value 100x the typical line item.

A binary policy has two options:

• Tight: refuse the whole invoice because of the suspicious line. User is blocked.
• Loose: process the whole invoice. The suspicious line goes through. The system has now processed an action that should have been reviewed.

A bounded action can do something better:

• Process the eleven routine line items
• Defer the twelfth (suspicious one) with explicit attestation: this line was deferred because [criteria]; here is the trail; here is the next-step path
• Surface the deferral to the user with the bounded receipt: 11/12 processed, 1 awaiting review

The user gets value. The system gets safety. The trail is honest about what was done and what wasn’t. The deferred line goes to the appropriate review path. Nobody is blocked unnecessarily; nothing is processed silently.

This is what bounded means: the action’s scope is reduced to the part where evidence is clear; the rest is deferred with attestation; the surface is explicit about what happened.

What This Requires Architecturally

Bounded action is not a policy choice. It is an architectural property. To support it, the system needs:

1. Decomposable mandates. The mandate has to be expressible at sub-action granularity. Process this invoice must be decomposable into process line item N such that the system can act on some line items and defer others.

2. Per-sub-action verdicts. The verdict is not for the whole mandate; it is per sub-action. The pipeline runs the verdict for each sub-action; the results compose into the bounded execution plan.

3. Attested deferrals. When a sub-action is deferred, the deferral itself is attested — this was deferred at this time, by this verdict, with this evidence. The deferral is part of the trail, not an absence in it.

4. User-facing surfaces for partial completion. The user (or upstream system) needs to see what was completed and what was deferred. Otherwise the bounded action looks like a successful full action, and the deferral is invisible.

5. Routing for deferrals. Deferred sub-actions need somewhere to go: a review queue, a HITL gate, a higher-authority escalation. Defer without route is just abandon.

These are real architectural commitments. They cost engineering. What they earn is a system that doesn’t have to oscillate between false refuse and false permit. The third option is real.

The Useless-Bureaucrat Connection

There is a related failure mode the framework calls the Useless Bureaucrat: the agent that refuses every ambiguous case to maximise its safety score, and ends up useless. Bounded action is the architectural answer to this.

A binary system, asked to be safe, becomes the Useless Bureaucrat. Refuse if uncertain is the cheapest path to “no harm done.” It is also the path to “no value delivered.”

A bounded-action system has another move: do the certain part, defer the uncertain part, attest both. This is engaged action under uncertainty — the agent is not refusing to engage; it is engaging within the bound the evidence supports.

The discipline is in the bound. Where evidence supports action, act. Where evidence is uncertain, defer with attestation. Where evidence supports refusal, refuse with evidence. Three different responses, each grounded in evidence, each surfaced to the user.

The Disposition

Refusal is admissible only as a verdict outcome justified by evidence. It is never the default that purchases safety by ceasing to act.

This is what the safety doctrine actually says, when read carefully. Refuse-by-default is not safe. It is cheap. It produces the appearance of safety at the cost of the agent’s actual value.

A team that ships binary policy will spend their roadmap oscillating between safety and usefulness, never reconciling them. A team that ships bounded action recognises that the reconciliation is in the vocabulary — six verdicts, not two — and architects accordingly.

The cost of bounded action is real. Decomposable mandates, per-sub-action verdicts, attested deferrals, routing for deferrals, user-facing partial-completion surfaces — none of these are free. What they earn is a system that does not have to choose between useful and safe. The bounded action is both, in the parts where the evidence supports both, with explicit visibility about which parts are which.

When the policy team brings you the next should we tighten or loosen question, the right answer is usually neither. The right answer is we should support bounded execution for this action class. Then the question dissolves: tighten in the parts that need tightening; loosen in the parts where evidence is clear; let the bound do the structural work that the policy alone cannot.