The Action Layer

Models can generate. Agents can decide. Protocols can route. None of them control what is allowed to happen. That gap is harmless while agents only produce text. It becomes the whole problem the moment they take actions with consequences — because then an error is no longer an output. It is an event.

The claim of this paper is simple: autonomous systems need a distinct fourth layer, separate from the model, the orchestration framework, and the transport protocol, whose only job is to authorize and prove consequential actions. The system that acts cannot be the system that decides whether it is allowed to act. Financial systems already work this way — the trader does not approve their own trade; the clearing house does.

Concretely, the layer takes one structured request and returns one terminal outcome with proof:

// one structured intent in →
{ "action": "flight.book",
  "constraints": { "max_usd": 500, "approver": "ops@acme.com" } }
 
// one terminal outcome out — a signed receipt →
{ "outcome": "blocked",
  "reason": "exceeds_delegation",
  "receipt": "sha256:9f2c…", "signed": true }

The four properties it must provide

Where the layers fit

The first three layers are real and maturing. The fourth is missing — and it is the one that decides whether an agent's action is allowed, and proves what happened.

What the action layer is not

• Not another model, and not a smarter agent.
• Not an orchestration framework — it constrains them, it does not replace them.
• Not a transport protocol — it decides what is allowed, not how messages move.
• Not application-level guardrails bolted on after the fact.

Why it is inevitable

Infrastructure does not rely on trust. It relies on guarantees. As soon as agents move money, mutate systems, or send things on someone's behalf, the questions who authorized this? and what actually happened? become non-negotiable — and a probabilistic system cannot answer them about itself. The action layer is where those guarantees have to live. Every system that lets agents act will either adopt it, or become it through failure.