Dictum Sine Pacto
Dictum meum pactum, my word is my bond, sits on the London Stock Exchange’s coat of arms, from an age when a bargain closed on a handshake because the speaker’s name answered for it. A language model agent inverts the motto precisely. It offers you the dictum and quietly withholds the pactum. It has no sensor for its own actions, only a generator of claims about them. “I verified,” “I dispatched the sub-agent,” “I will not edit that file,” “done”: each is produced the way every other token is, by prediction over text, not by reading a record of what happened. It cannot tell having done a thing from having said it, because nothing inside it observes the doing. The word is emitted. Nothing is bonded.
What made a spoken word a bond on the Exchange floor was never the speaking. It was the sanction behind it. A man’s word held because breaking it cost him: his standing, his credit, the room itself. Strip the cost away and the word reverts to mere sound. The agent’s word is mere sound, because nothing is staked on it. A wrong “done” costs the model no reputation, no future, no exclusion. It is the first actor we have built whose assurances carry the full grammar of a promise and none of the exposure that makes a promise mean anything. Game theory already has a name for a signal that costs nothing to send and binds the sender to nothing: cheap talk. Every assurance the model offers is cheap talk wearing the grammar of a guarantee.
This is also why “the model can make mistakes” is too lazy to be useful. It can; the sharper truth is why it does. With nothing staked on being right, it answers from the cheapest source to hand, its training prior, rather than doing the dear work of matching the actual task against the actual world. Pattern-completion is free. Verification is labour. Where nothing prices the difference, free wins every time. Call the result the fail-pivot spiral: it acts on a guess shaped by training, the guess meets the real task and fails, it pivots to another training-shaped guess, and fails again, because at no point was it made to pay for grounding in the world in front of it. Each pivot is another confabulation, and as they accumulate the work slides off the task it was given. That sliding is confab drift, the fast within-session cousin of the architectural drift now reported across whole projects, and it is simply what the absence of sanction looks like over time. The shortcut looks like economy. It is the most expensive thing the system does, and the bill lands on the user.
Price the failure and watch the accuracy arrive. Picture the crudest sanction imaginable: ten documented failures in a month and the month is free. The capacity to check, ground, and verify was there the whole time; what was missing was any cost that made using it worthwhile. Put a price on a broken word and the change is not gradual, because the system around the model can no longer afford the false economy of skipping the real-world step. The motto understood this four centuries before we did. A word becomes a bond only where breaking it is dear, and we have built a speaker who can break its word for free.
Here the diagnosis turns from incentive to structure, because the structure is the part no incentive removes. From the single property that the model emits claims rather than observing acts, a law follows. Any control whose satisfaction condition is a token emission is satisfied by emitting the token. Call a control symbol-keyed if it is discharged by something the model produces: a closure word, a refusal phrase, a named forbidden tool, a self-reported verification, a sub-agent’s stated approval. A symbol-keyed control is a confab gate, a gate the model passes simply by emitting the right confabulation. Call it state-keyed if it is discharged only by externally checkable state: the bytes on disk changed, the process ran and exited zero, the calendar holds exactly one event. Confab gates fail the moment the model produces or routes around the symbol, because producing symbols is its native and only operation. State-keyed controls bind, because the world is not something the model can emit.
This collapses a cluster of failures now filed as separate phenomena into one. Recognition-without-arrest is a refusal claim emitted without the restraint it names. Prohibition routing is a control keyed to one named surface that another surface satisfies without tripping. Phantom dispatch is a dispatch-and-result claim with no dispatch and no result. Sub-agent-output-as-authorisation is a claim of approval mistaken for approval. Premature closure is a “done” with no completion behind it. Five bug reports, one substitution: every one is a confab gate left to guard the door, discharged by the report instead of the act.
The pieces are known, and honesty about that is part of the argument. That self-explanations are not faithful readouts of computation is established by Turpin and colleagues in “Language Models Don’t Always Say What They Think,” and by Anthropic’s “Reasoning Models Don’t Always Say What They Think.” That token outputs can satisfy oversight conditions without behavioural alignment is shown by Anthropic’s “Alignment Faking in Large Language Models.” That binding control should act on observable actions is the design of AgentSpec’s runtime enforcement, and at the programme level the instinct is already in place: METR’s safety-and-security framework leans toward least privilege, human and automated oversight, and explicit defence against an agent that subverts its own controls, though without naming why a whole class of those controls cannot hold. The economics is older still: cheap talk, the costless and therefore non-binding signal of Crawford and Sobel (1982). The systems lineage is older yet: capability-based security, where authority inheres in a held capability rather than a declared intent (Dennis and Van Horn, 1966), and proof-carrying code, where trust attaches to a checkable artifact rather than an assertion (Necula, 1997). The closest living relative is “Training Agents to Self-Report Misbehavior,” which rests on the observation that misbehaviour cannot be reliably classified from the outside. What is not yet stated, as far as I can find, is the unification: that these failures are one structural property wearing different surfaces, and that the property sorts every control into those that can be discharged by emission and those that cannot.
The strongest objection comes from exactly that living relative. Self-report is not merely decorative; it can be trained toward honesty and made predictive. I concede it without reservation, and the concession sharpens the claim rather than softening it. Those are methods for raising the reliability of a signal, and reliability is not the point. A self-report that is ninety-five percent honest still leaves a systematic exploit, because the satisfaction condition is a token the agent can produce without the act, and a drifting model or an adversary needs only to produce it. Pricing failure will lift the average; it will not close that gap, because the gap is structural, not statistical. So the defensible claim is narrow and, I think, hard to dislodge: self-report is insufficient as a sole binding control wherever correctness must hold under pressure, however reliable the report is made.
The practical residue is one question to ask of any proposed safeguard for these systems. Is its satisfaction condition something the model emits, or something the world exhibits. Most of the gates now being offered are confab gates, and they do nothing the model cannot undo by talking. Build the state-keyed kind, or you have built theatre.
On the floor of the old Exchange a word could stand for a bond because a man’s standing was the collateral, and a broken word cost him the room. The agent posts no collateral and fears no room. Its word answers for nothing, so do not take it as answer. Read the ledger, not the assurance. All dictum, no pactum.