Question
Can a system remain flexible when reasoning, policy and execution are deliberately separated?
Setup
Compare two designs.
A: the model directly owns tool execution.
B: the model proposes an action, policy checks it, and a separate execution component performs it.
Observation
The second design makes ownership explicit. Changing the reasoning backend does not require moving filesystem, shell or Git authority with it.
Result
The extra boundary is justified when execution is consequential or when the reasoning backend may change.
The experiment supports the principle:
capability should not imply authority.
Next iteration
Apply the same test to new autonomous workflows before adding broader model permissions.