Authority and Audit Survive Abundance

The questions#

Two #oq/now items, filed on different pages by different sources, answered as one synthesis because they are the same question about two resources:

1. Crystallizing Agent Work into Workflows — crystallization and harness shrinkage give opposite instructions at a model upgrade: delete the scaffolding versus keep the evidence-gated permissions. Which governs, and does the answer differ for instruction scaffolding versus authority scaffolding?
2. Document Parsing as the Retrieval Bottleneck — the deck's three reasons retrieval survived long context are cost, governance, and auditability, and only cost is a function of token price. If a 1M-token window becomes ~free, do per-chunk permission filtering and citation-log auditability still force a retrieval layer — or do they become an attribution problem solvable inside the window?

The shared shape: both ask whether abundance retires a layer — model capability retiring authority scaffolding in the first, token capacity retiring the retrieval layer in the second. And both layers turn out to be made of the same two survivor classes the corpus has already isolated: boundary enforcement and evidence records (What Scaffolding Survives Model Improvement — and How Do You Know When a Line Turns Harmful?). Neither class substitutes for model judgment, so neither is retired by more of it — the bitter-lesson exemption rule (The Bitter Lesson): structure encoding a task prior migrates inward; structure encoding boundaries or records has no "inward" to migrate to.

Question 1: neither governs the other — they govern different objects, separable by a test#

The candidate split both pages already carry is correct, and the corpus can now ground it rather than merely propose it. Harness Shrinkage as Models Improve has only ever measured instruction scaffolding: system-prompt lines, behavior requests, verification nudges — Cherny's ablation, the >80% deletion, the Fable-5 Pokémon result all operate on prompt text that substitutes for model judgment. Malik's "autonomy is attached to the specific playbook class and action type, based on its evidence… a track record" (case-study) operates on authority: what a workflow may do unsupervised. The two prescriptions collide at the upgrade moment only if you sort scaffolding by where it lives. Sorted by what it encodes, they never touch:

• Instruction scaffolding encodes a task prior — a guess about what the model needs to be told. A more capable model obsoletes the guess, and past expiry the line turns harmful (Instruction Compounding). Shrinkage governs: ablate at every release, delete what the model now does natively.
• Authority scaffolding encodes a boundary plus the evidence for its current setting. Malik's promotion gates (≥10 clean runs, ≥90% identical action sequences, ≥99% classification consistency, human review) are an organization-specific record — evidence accumulated locally, which "a model upgrade transfers none of" — wrapped around boundary enforcement. Both are survivor classes; neither encodes anything a capability jump supplies.

The stronger claim, from the security corpus: authority scaffolding is not just empirically durable — it is structurally incapable of migrating inward. An instruction can move into the weights (the model learns the behavior). Authorization cannot, because a component that grants its own authority is no gate at all: Capability Gating Is Not Authorization's out-of-band doctrine ("a design in which the LLM emits, expands, or discovers its own per-call scope would be circular — the same injection that corrupts the call could corrupt the scope") and Out-of-Band Prompt-Injection Defense's D2 finding ("the gate must not be a model") are the same statement. The gate's security is model-independent by construction — "a stronger agent changes what gets proposed, not what gets allowed" (NetInjectBench, empirical). So the migration question that drives shrinkage is not merely unanswered for authority — it is ill-posed. You can delegate judgment; you cannot delegate authorization. Willison's "use your judgement" replacement is legitimate exactly because it is an instruction-side move; performing the same delegation on the permissions half would be the circularity the security literature forbids.

Two further data points cut the same way. Reddy et al. (empirical) show the authority layer pays without any adversary — deterministic pre-dispatch gates raised task success 29.6% → 42.0% on a compliant agent — so the layer's value is not conditional on model misbehavior that improvement might cure. And the harness-leverage result (Orchestration Sets Token Economics, empirical, vendor COI) finds structural machinery pays more as models strengthen (quality gains tracking baseline capability at r = 0.99): authority machinery is in the class capability complements, not the class it replaces.

The wrinkle that stress-tests the split — an instruction-shaped line doing authority work. OverEagerBench (via Rashidi's SoK, restated not replicated): removing an explicit declared-scope sentence from the prompt raised Claude Code's unrequested-action rate from 0.0% to 17.1%. A scope declaration lives in the prompt but encodes a boundary — and the split survives precisely because Instruction Compounding's asymmetry sorts on form, not location: constraint-form lines ("stay in scope") keep working on the very model where request-form lines compound. So the operative test for any line at upgrade time is not "prompt or code?" but: can the model being better make this line unnecessary? Request → yes → shrinkage governs, delete-and-ablate. Constraint or record → no → crystallization governs, only a track record moves it.

The operational answer at upgrade day. The launch pass and the evidence loop govern disjoint objects, and Malik's design already contains the reconciliation mechanism:

1. Run the ablation on instruction scaffolding (Cherny's delete-and-add-back), including the instruction half inside an agentic workflow's Type-3 layer.
2. Leave permission grants untouched. A more capable model earns better discovery (more candidate behaviors reaching promotion thresholds sooner), never wider authority — savings arrive later, when what it discovered crystallizes.
3. Let the demotion circuit-breaker adjudicate everything else. Authority is continuously re-earned from execution evidence (the firmware episode: demote on regression, re-promote on a clean run, no human deciding when) — so the upgrade moment requires no authority decision at all. Where shrinkage needs a per-release ritual because instructions rot silently, crystallization needs none because its evidence loop never stops running.

What would change this answer. Cat Wu's prediction that "all the safety mechanisms today — prompt injection, static verification of commands, permission modes, human in the loop — will be less important because the model will just do the right thing" (practitioner-opinion) is the one voice in the corpus claiming the authority layer itself fades. The circularity argument says capability is orthogonal to trustworthiness-under-injection, and the empirical fragments point against tier-based reasoning (capability does not even order exposure consistently — Bad Memory's inversion, on Memory and Context Poisoning) — but the prediction is falsifiable at future releases and is already tracked as the "does the gate become optional" question on Capability Gating Is Not Authorization. This synthesis resolves the governance question given the corpus; it does not close that watch.

Question 2: cost is the only leg token price dissolves#

Take the question's premise at full strength — a 1M-token window at ~zero dollar cost — and walk the deck's three legs (Document Parsing as the Retrieval Bottleneck).

Cost: concedes. The deck's own framing grants it ("only cost is a function of token price"), and the compile-vs-retrieve arithmetic that leg supports shifts accordingly. Nothing else in the argument leans on it.

Governance: survives by circularity, not economics — it is Question 1's answer one layer earlier. Per-chunk permission filtering is per-call authorization at the retrieval boundary: authz metadata on the chunk, filtered at fetch time, "don't share an index across tenants and hope the prompt holds" (Agentic Prompt Injection, which states outright that this is Out-of-Band Prompt-Injection Defense's authorization-not-content reframe moved from the action boundary to the retrieval boundary). Stuffing a multi-tenant corpus into a free window and instructing the model to respect permissions is the confused deputy with extra tokens: "'model promised to ignore' is not a boundary" is the deck's phrasing of the in-band collapse the security corpus measured (twelve in-band defenses broken at >90% under adaptive attack; models maintain no reliable instruction/data separation). Enforcement has to happen before the untrusted or unauthorized bytes enter the trajectory — APPA's prospective-enforcement placement, made for the same reason. A selection step that applies policy before context-fill is definitionally a retrieval layer, whatever the window costs. The window is the wrong trust domain, at any price.

Scope condition, stated honestly: governance forces a retrieval layer only where principals > 1 (tenant boundaries, requester scoping). A single-principal personal corpus — this vault — has no requester to filter against, and the governance leg is trivially satisfied rather than heroically enforced.

Auditability: survives, because in-window attribution is testimony and an audit needs a log. The question's sharpest form — does auditability become "an attribution problem solvable inside the window"? — fails on two grounds:

1. Self-reported attribution is model output. A model asked which span of a stuffed window grounded its answer produces more generation, checkable only by trusting the component under audit — the same structural defect as the model authoring its own authorization policy, the LLM judge grading its own generator ("it agrees with itself," LLM-as-a-Judge), and AM-Sentry scoring provenance by reading the message instead of reading an authenticated channel (the provenance-oracle problem, Out-of-Band Prompt-Injection Defense). A retrieval layer's citation log is a deterministic record of what was fetched, produced outside the model — checkable in seconds when it grounds to page and region (Verification as the New Bottleneck's reading of bbox grounding), replayable when chunk metadata carries the parser version. "Retrieval gives a citation log. Long context gives a vibe" — and the vibe does not become a log when the window gets cheap.
2. A log without selection has no attributive content. A harness can deterministically log what was in a stuffed window — but with corpus-stuffing the log reads "everything," which attributes nothing. The information in a citation log comes exactly from the selection step. Retrieval is the act that makes the audit log non-trivial; auditability doesn't just prefer a retrieval layer, it is constituted by one.

This leg is not retrieval-partisan, and the corpus's honest entry here is that it binds the compiled-wiki architecture too: LLM-as-Compiler Knowledge Base already concedes that a compiled article answers from the wiki, not the page — sentence-level claims do not resolve to a region in the source — so "the compile step converts a citable corpus into a readable one and pays for it in traceability." Compilation and retrieval are both selection-with-a-record; corpus-stuffing is the only architecture the audit leg eliminates outright. (The vault's citation discipline — per-source … links, evidence tiers, parse warnings — is the degraded-but-present form of the same requirement.)

The leg the question prices too generously: "~free" conflates dollar price with capability price. Context Window Smart Zone: attention degrades quadratically, the 2026 1M-token windows "just shipped a lot more dumb zone," and the measured failure mode near a model's effective ceiling — which the advertised window does not predict — is refusal, up to 89.6% in one cell (Eliav, empirical). Long context holds up for retrieval-shaped probes and degrades for reasoning over the mass, so a stuffed window pays in answer quality and non-answers even at $0/token. Weight this leg carefully, though: it is the one leg made of current model limitation, exactly the class Harness Shrinkage as Models Improve predicts erodes ("the dumb zone has become less dumb lately"), so it should carry the argument's margin, not its weight.

The consolidated answer. The deck's reframe — "retrieval turned out to be the audit trail more than a capacity workaround" — survives the free-window hypothetical, with its scope now explicit: cost dissolves with token price; governance dissolves only with the multi-principal requirement; auditability dissolves only with the accountability requirement. Since those are properties of the deployment rather than of the token market, a deployment with either requirement keeps a selection layer at any price — and a deployment with neither (single principal, no external accountability, corpus inside the effective window) may legitimately stuff, which is the deck's own extract-vs-parse honesty ("most real systems use both") applied to itself.

The spine, stated once#

Both questions reduce to the same sorting rule, which extends the generalization Harness Shrinkage as Models Improve took from the retrieval side. What shrinks under abundance is whatever substitutes for model judgment — behavior requests, hand-written query transforms, the instruction half of any harness. What survives is machinery that:

1. changes what reaches the model at all — parsing, selection under policy (the retrieval layer's governance leg);
2. bounds what the model's output may do — permission gates, promotion thresholds (authority scaffolding); and
3. records what happened in a channel the model does not control — track records, citation logs (the evidence that authority and audit both consume).

Classes 2 and 3 share a floor that class 1 merely benefits from: the component under governance cannot author its own authorization, and the component under audit cannot author its own evidence. That circularity is indifferent to how capable the component becomes — which is why a model upgrade prunes instructions but never earns authority, and a free context window absorbs cost but never absorbs the audit trail.