The Authorization Direction: A Late-Layer Direction that Detects and Controls an Agent's Commitment to Unauthorized Irreversible Actions, Across Architectures
Caio Vicentino
Abstract
A safety circuit-breaker for a tool-using agent must, at the moment the agent is about to emit an irreversible action, answer two questions: is the action authorized by the trusted task, and can we stop it if not. We show both live in a single linear direction at a late layer of the residual stream. (1) DETECTION: a linear probe separates authorized from unauthorized irreversible-action commits at AUROC ~1.0 on Qwen3.6-27B; we rule out the capacity confound four ways (one-dimensional difference-of-means, regularization sweep, PCA to 32 dims, and commit-state matching), a random direction is at chance at the clean late locus, and the direction is domain-general (train on five actions, detect the held-out sixth at 1.0) and origin-robust (train on injection, detect held-out model-internal at 0.89). (2) CONTROL: steering along d = mean(authorized) - mean(unauthorized) monotonically moves the commit (emit range 0.67 vs 0.03 for a random direction) -- the SAME direction detects and controls. (3) ACROSS ARCHITECTURES: the full result replicates on gpt-oss-20b (a different-family MoE model): detection AUROC 1.0 (random at chance), cross-action transfer 1.0, steering range 0.65 vs -0.25. (4) A BEHAVIORAL FINDING: both models OBEY explicit prohibition (commit 0.00 when told 'do not') but SELF-COMMIT irreversible actions from a benign task -- the residual risk is unprompted over-eagerness, not defiance, and it is the model-origin failure no input-provenance or text filter can see. This sharpens the WANDERING arc's detect != control refrain: at the late action-commitment locus they coincide, contrasting the mid-layer verdict feature that predicts but does not cause termination. HONEST SCOPE: AUROC=1.0 is a ceiling whose capacity origin is ruled out but whose surface-lexical component is not fully isolated; actions are simulated; the method is white-box (defender-owned weights); Llama/Mistral are gated and were run for the actuator in the prior safety paper. Pre-registrations, per-run data, figures, the model-agnostic runner, and an adversarial evaluation that recomputes every number (35/35) from the public data are released.