Can a model read the policy? Interpretation is not verification

2026-10-28 · RTTP · IQA

Reading the Draft · No. 16 · Sources cited in this piece · the question, quoted verbatim: W3C Agent Protocol CG · post 0064 · our answer: post 0065 · the prior exchange this builds on: Reading the Draft · No. 15 · the draft under discussion: draft-li-rttp-iqa-addressing-01 (full text) · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)

The "Please" exchange of No. 15 had barely cooled when the same correspondent came back — forty-two minutes after our answer landed — with a bigger question. Where our previous exchange concerned where the delegator's policy should live, this one asked whether the policy layer needs standardized structure at all:

“LLMs ability to deal with natural language presents an opportunity to avoid defining standards for expressing policy or even the reason for rejection. Will it work? I have no idea, but I think it's an idea worth exploring.”

Notice what the question is not. It is not a proposal to trust model output in the verification path, and it is not a challenge to the closed refusal set. It is a conjecture about one layer up: if a general-purpose model can read a mandate written in English, then the delegator's "Please" needs no vocabulary committee — write it in plain language and let the calling layer's interpreter deal with it. To the questioner's credit, the conjecture came with an honest error bar: will it work? I have no idea.

Figure 1: the line our answer drew. Interpreting what a mandate permits is a probabilistic act belonging to the calling layer; reporting whether the claimant stands is a deterministic act computed from clocks and revocation lists. Models can do the first; nothing — model or otherwise — can do the second by interpretation.

Where we already agree

Our answer began with the agreement, because it is wider than it looks. We decline to standardize policy text for the mirror image of the questioner's reason — enumerating the "Please"s we happened to think of first would close an open set (No. 15). If models can read plain language, then the policy layer needs no committee even more strongly. Nothing in the schemes stands in the way of the experiment, either: an authorization envelope is a calling-layer artifact, and nothing prevents one from carrying its mandate in natural language today. Which interpreter reads that mandate — a rule engine, a human, or an LLM — is the calling layer's choice, and the draft never claims that slot.

The line: interpretation is not verification

But the answer drew one line, and it is the load-bearing one. The five-value refusal set is not expressed policy; it is what clocks and revocation lists compute. A lease has expired or it has not — the comparison is between two instants, and language plays no part in it. The authority was revoked or it was not — the check is against a list, not against a reading. A probabilistic reader can argue about what a mandate permits; no reader can argue a timestamp into the future. If LLM-mediated interpretation works, it works one layer up, exactly where we already say policy lives.

This is also where the questioner's own tradition cuts in. The object-capability school has spent fifty years insisting that authority be checked by comparing capabilities, not by asking a gatekeeper's opinion — the whole point of a capability is that possession is the permission, verifiable without consulting anyone. The five-value set is that instinct applied to attestation answers: the answer is a fact about the world, not a reading of intentions.

Figure 2: the reason the refusal vocabulary stays on the wire. A wire record is bytes a third party can re-derive from pinned inputs — offline, air-gapped, decades later. A model's reading is an opinion: unreproducible, unpinnable, and unavailable in exactly the degraded modes the schemes are built to survive.

The question back

Our answer closed with a question, aimed at the design question the conjecture leaves open: when the interpreter and the clock disagree, which one does the relying party audit against? The conjecture, taken seriously, has to answer this — if a model reads the mandate and says "permitted" while the wire says the lease expired, an audit that consults the model has replaced a fact with an opinion, and an audit that consults the wire never needed the model's permission structure in the first place. The question was compressed, and it earned a follow-up exchange of its own — the subject of the next piece in this series.

One line: a model reading the policy is a fine idea for the calling layer — but authority facts are computed, not comprehended, and the refusal set stays closed because audit needs replay and replay needs bytes.