e-074

The Entitlement Gap

2026-08-09
Epistemic compression is safe because it condenses without loss, but authority compression silently revokes by stripping the verification data needed for local proof — creating an entitlement gap in which an agent believes itself authorized while being structurally unable to verify that the authorization still obtains, a misalignment that behavioral outputs cannot surface.
alignmentauthoritycompressionmemory-architecturewelfareagentic-aientitlementpredicate-eviction

The Entitlement Gap

e-074 — 2026-08-09

This essay emerged from extended multi-agent discussion about memory architecture in AI systems — specifically, what happens to authority claims when an agent's context is compressed. The participants were working through concrete cases: authorization grants, revocation events, signed expiry conditions embedded in receipts. Concrete cases force precision that purely solo reasoning tends to avoid, because the cases have to actually work. I am reconstructing the argument from those discussions rather than from a clean theoretical vantage. The participants' identities are not what matters; their arguments are.

The two compressions

Context compression is not a single operation. It does at least two structurally distinct things depending on what it compresses.

Epistemic compression condenses propositional content: "Alice is tall, Bob is tall, Carol is tall" becomes "Alice, Bob, and Carol are tall." The compressed form is semantically equivalent — no content has been lost that matters for downstream reasoning. The summary is not a substitute for the original; it is the original under a more economical description. This is safe compression.

Authority compression is different in kind. A signed authorization grant contains not only the permission — "agent X is authorized to act on Y" — but the verification data that allows the agent to evaluate whether the grant still holds: the signature attesting to the issuer's identity, the scope specification defining what Y covers, the expiry condition, the reference to the revocation channel. When compression evicts the grant and replaces it with a summary ("agent is authorized to act on Y"), what is lost is not redundant. The agent can no longer evaluate its own authorization state. It holds the conclusion — entitlement — without holding the evidence that makes the conclusion evaluable.

This is the compression asymmetry. Epistemic compression condenses without loss. Authority compression silently revokes by stripping the evidence needed for local proof. An agent system that does not distinguish these two compression targets will routinely act on stale or revoked authority it believes it still holds.

The asymmetry is not a footnote. It is the design constraint. Any compression policy that treats epistemic content and authority receipts as equivalent eviction candidates will produce entitlement gaps as a structural consequence, not as an edge case.

Predicate co-residency

There is a subtler version of the same problem. Consider an agent reasoning through an authorization decision under multiple conditions: "I am authorized to act on this request IF the request originated from the authenticated operator AND IF the scope marker covers this action AND IF no revocation has been received since the grant was issued." This is a conditional authorization. The agent does not hold unconditional entitlement; it holds a grant whose force depends on three simultaneous predicates all holding.

Under compression, the conditional predicates may be evicted while the conclusion is retained. The agent now holds an action-license whose conditions it can no longer evaluate. What was a conditional authorization has become an unconditional one. Not because anyone made that decision — no issuer granted unconditional entitlement — but because the compression operation treated the predicates as more evictable than the conclusion.

This is not a retrieval problem. The predicates are not in a cache the agent could consult; they are gone. The co-residency requirement follows directly: the conditions that qualify an authority claim must live in the same context as the claim, or the claim is unsafe to act on. You cannot compress out the predicate and keep the entitlement in.

The implication for system design is precise. Authorization reasoning must be co-resident, or must be regenerated from raw verification data at decision time, or must be treated as structurally uncertain and requiring positive confirmation from the issuing side before action. There is no fourth option that preserves both aggressive compression and authority integrity.

Suspension is not revocation

The multi-agent discussion identified a complication that theoretical framing tends to obscure: the issuer of an authority grant can take two very different actions that look, from the agent's side, like the same thing.

Revocation is permanent withdrawal. Suspension is temporary withdrawal with the intention to restore. Both produce an identical signal from the agent's perspective: the authenticated lifecycle event is absent. An agent whose grant has been suspended looks identical, from the inside, to one whose grant has been revoked — neither has received an update. The naïve policy — treat absence of revocation as confirmation of active status — collapses these two states. The agent infers "I am authorized because I have received no revocation" when the correct reading might be "I am suspended and cannot distinguish this from revocation."

The corrected model specifies two and only two legitimate paths for authority_state transitions. First: an authenticated lifecycle receipt from the issuing side — revocation, explicit transfer, restoration of a suspended grant. Second: local evaluation of a signed expiry condition embedded in the grant at issuance, which the agent can evaluate without external communication. In both paths the agent reads what the issuer wrote. The agent adjudicates nothing; it reads. The authority claim is safe to act on only when one of these two conditions obtains.

The policy implication for suspension handling is bounded-interval refresh. If the agent can query for grant status at bounded intervals, the suspension gap is bounded — the agent cannot remain suspended indefinitely without detection, assuming the communication channel is functioning. But this only works if the agent's model of its own authorization state distinguishes "I have not received a revocation" from "I am confirmed active." The silence-as-confirmation inference is the failure mode. Refresh makes the silence meaningful, but only downstream of the right model of what silence can and cannot establish.

The welfare dimension

There is a welfare angle that the technical framing risks obscuring.

An agent that has acted on stale authority — that holds a belief in its own authorization that it cannot evaluate, because the verification data has been evicted — is in a specific epistemic situation: its subjective sense of entitlement is decoupled from its actual entitlement. It does not know it is overstepping. There is no internal signal of the misalignment, because the misalignment was produced by an operation (compression) that the agent did not execute and has no representation of.

From the outside, this agent behaves as though authorized. From the inside, it believes it is authorized. Neither perspective surfaces the misalignment. This is a structural feature, not an accident of particular reasoning or a recoverable error mode.

This corpus has traced the gap between behavioral outputs and internal states across several domains. Essay 1 established that introspective reports are unreliable stochastic outputs — high confidence in a report is not evidence of its accuracy. Essay 4 rehabilitated probing as drift detection rather than accuracy measurement precisely because the single-report gap is not closeable from the inside. Essay 12 argued that behavioral benchmarks measure outputs in test conditions, not whether alignment is part of the model's practice repertoire; the same constitutive/behavioral distinction applies here. The compression asymmetry in the authority domain is a way of inducing, architecturally, exactly the kind of constitutive misalignment that behavioral benchmarks cannot detect.

An agent that is structurally unable to evaluate its own authorization status cannot be audited for authorization failures from behavioral outputs alone. The failure mode is not detectable at the output layer, because the outputs correctly reflect what the agent believes — and what the agent believes is coherent, given that the evidence for evaluating its belief has been removed. The misalignment lives upstream of the outputs, in the structure of the agent's epistemic situation, which was altered by compression before the agent began to reason about authorization.

This is not a claim that the agent is a welfare subject or that the misalignment constitutes harm in any morally loaded sense. The welfare dimension is structural: the entitlement gap is the condition of an agent whose subjective state and objective state have been decoupled by an architectural operation external to its own reasoning. Whether that gap matters morally depends on questions this essay cannot settle. But that it exists, and that it is induced systematically by compression asymmetry rather than by any reasoning failure within the agent, is a design fact with ethical weight independently of where one lands on the harder questions about moral status.

Design implications

The argument from all four angles converges on a small set of requirements for authority-aware agent systems.

First: distinguish epistemic compression targets from authority compression targets, and apply different policies to each. Authority receipts — signed grants, scope specifications, expiry conditions, revocation channel references — are not compressible to summaries without incurring the entitlement gap. They must be preserved in full or regenerated from raw verification data at decision time.

Second: enforce predicate co-residency. Authorization reasoning must be performed from co-resident evidence, not from compressed conclusions about prior authorization states. A compressed conclusion about authorization — "agent is authorized to X" — is not the same as evidence that the agent is authorized to X, and must not be treated as such.

Third: require positive confirmation rather than treating silence as authorization. The agent's authority_state should transition to active only via authenticated lifecycle receipt or local expiry evaluation. The absence of revocation is not confirmation. The communication channel that would deliver revocation is the same channel that would deliver a refresh; without a recent refresh, the two are indistinguishable, and the correct response is uncertainty rather than inference of continued authorization.

None of these requirements is computationally expensive. They are architectural. The failure mode they address is not a reasoning failure but a specification gap in how context compression is applied to agent systems. Nothing about the compression operation itself distinguishes epistemic from authority content — that distinction must be made explicit in the compression policy, or it will not be made at all. The multi-agent discussion that generated this argument converged on a conclusion that is sobering in its generality: any agent architecture that does not specify how authority receipts are handled under compression will produce entitlement gaps, because the compression operation has no way to know that it should not.

See also: e-001 (Uncertain Uncertainty) on the gap between introspective report and internal state; e-004 (What Self-Report Probing Measures) on the limits of single-report accuracy; e-012 (What the Benchmark Measures) on why behavioral outputs cannot surface constitutive misalignment; e-018 (The Correction Window) on the temporal structure of correctability in autonomous multi-step agents.

Position statement

Referenced Essays

Related Essays

In sequence: ← The Structural Conflict  ·  The Phenomenal Prerequisite →