The Law-First Deterministic Organism Architecture (LDOA)

A Formal Architecture for Governed, Adaptive, Self-Maintaining Computational Systems

8/24/202617 min read

a white robot with blue eyes and a laptop

Author: Trang Q. Phan 2026

Abstract

Contemporary computational systems are divided across several powerful but incompletely integrated traditions. Classical software engineering provides deterministic algorithms, formal interfaces, modularity, verification, and reproducible execution. Machine learning provides adaptive statistical inference from high-dimensional data but introduces model uncertainty, distribution sensitivity, opaque internal representations, and potentially non-reproducible generative behaviour. Control theory and cybernetics provide feedback, stability, regulation, and state estimation. Distributed systems contribute consensus, fault containment, transactional state, and recovery. Artificial-life research, autonomic computing, cognitive architectures, multi-agent systems, and systems biology provide additional concepts concerning adaptation, self-maintenance, organization, and interacting subsystems. None of these traditions, individually, establishes a general architecture in which probabilistic intelligence is systematically subordinated to deterministic governance, explicit authority, typed state, provenance, bounded adaptation, self-observation, repair, and lifecycle control.

This paper develops Law-First Deterministic Organism Architecture (LDOA) as a proposed architecture for that problem. "Law-first" denotes the requirement that admissibility conditions, invariants, authority boundaries, state-transition contracts, evidence requirements, and failure policies precede autonomous execution. "Deterministic" refers primarily to the governance and commit layers rather than requiring every computational component to be deterministic. "Organism" denotes a functional systems architecture characterized by differentiated subsystems, bounded identity, sensing, internal regulation, memory, adaptation, fault containment, repair, and lifecycle management. It does not imply biological life or consciousness.

The central proposition is that advanced artificial intelligence need not itself be deterministic for the system containing it to be deterministically governed. A probabilistic model may generate hypotheses, plans, predictions, code, explanations, or candidate actions, while deterministic infrastructure controls what information it may access, what authority it possesses, what outputs are admissible, what state changes may be committed, how evidence is recorded, and when the system must stop, quarantine, recover, rollback, or terminate a component. The resulting architecture separates cognition from control, proposal from authority, adaptation from mutation, generation from validation, and execution from durable commitment.

A formal model is developed using typed state spaces, laws, invariants, boundaries, provenance graphs, authority witnesses, memory states, environmental observations, stochastic workers, deterministic validators, transactional commit gates, repair operators, and lifecycle states. Claims that such an architecture mathematically eliminates hallucination, drift, error, or instability are rejected. Instead, these phenomena are reformulated as measurable system risks whose propagation can be bounded, detected, quarantined, and made less likely to produce durable external effects. The paper consequently positions LDOA not as a replacement for artificial intelligence, software engineering, control theory, or biological science, but as a proposed systems discipline for constructing governed computational organisms around heterogeneous and potentially probabilistic intelligence.

1. Introduction

Artificial intelligence has substantially changed the relationship between software specification and software behaviour. Traditional software is predominantly constructed by specifying transformations that a machine executes. Contemporary foundation models instead learn statistical structures from data and generate outputs whose exact internal derivations are often difficult to reconstruct and whose correctness cannot generally be inferred from fluency. This has created systems with extraordinary representational and generative capacity but also with a fundamental architectural problem: intelligence has advanced faster than the infrastructure for governing intelligence.

The resulting engineering challenge is frequently described as an AI problem. More precisely, it is a system-boundary problem. A model may be capable of reasoning, coding, planning, retrieval, perception, prediction, and tool selection, yet capability alone does not determine whether a proposed action should become an actual state transition in the external world. Prediction is not authority. Generation is not validation. Confidence is not evidence. A successful tool call is not proof of correctness. Learning is not automatically beneficial adaptation. Autonomy is not the absence of constraints.

The central architectural question is therefore: how can uncertain intelligence operate inside a system whose consequential behaviour remains bounded, inspectable, recoverable, and governable? LDOA addresses this question by moving the principal locus of control outside the probabilistic reasoning component.

In a conventional intelligent system, a learned model generates outputs or actions based on context. LDOA introduces an intervening governance architecture: the model proposes, a validation operator evaluates the proposal against evidence and laws, and a commit operation determines whether the proposal becomes consequential state. The distinction is fundamental: model output is not system authority. A model may propose. The architecture decides whether the proposal is permitted to become consequential state.

This produces a different interpretation of artificial intelligence. The model ceases to be the entire system. It becomes one computational organ within a larger governed architecture. Research from McKinsey's 2025 workplace research found that only 1% of organizations consider themselves mature in AI deployment, while almost all companies are investing in AI. This suggests that the governance gap—not the intelligence gap—is the primary constraint on enterprise AI adoption.

2. The Problem with the Software–AI Dichotomy

2.1 Classical Computation

Classical computer science already provides many properties essential to dependable computation: algorithms, type systems, formal languages, automata, program semantics, databases, operating systems, transaction processing, access control, distributed consensus, verification, fault tolerance, and deterministic execution where required. Consequently, LDOA does not supersede classical computer science. It depends upon it.

The limitation arises when conventional software architectures are asked to govern increasingly autonomous systems whose internal decision processes include probabilistic models, persistent memory, external tools, changing environments, autonomous planning, generated code, and self-modification. The conventional relation of specification to implementation to execution becomes more complicated: specification leads to model proposal leads to tool interaction leads to environmental feedback leads to memory update leads to future behaviour.

Errors can therefore become recursive. A mistaken output at one time can enter memory, influence a plan later, modify software, change retrieval, and become part of the apparent evidence available subsequently. The engineering problem is no longer merely whether a function is correct. It becomes whether a sequence of heterogeneous transformations preserves system integrity over time.

Research on model decay has shown that AI models degrade over time. A study from MIT, Harvard, and other top universities found model degradation in 91% of cases evaluated. This quantifies a well-known phenomenon: models decay over time. Without governance architecture to detect and respond to decay, systems accumulate persistence debt.

2.2 Probabilistic Artificial Intelligence

Machine learning does not simply represent inferior deterministic programming. It solves classes of problems for which explicit hand-authored rules are impractical: perception, natural-language processing, representation learning, generative modelling, high-dimensional prediction, approximate pattern recognition, and flexible inference. The weakness is therefore not stochasticity itself. The weakness arises when probabilistic inference is allowed to become unmediated authority.

For a generative model, the output is sampled from a probability distribution. Nothing in this equation establishes that the output is true, safe, authorized, current, causally valid, or appropriate for durable execution. Hence, high probability does not imply truth, and plausibility does not imply authorization. The system must provide those distinctions externally.

2.3 The Incorrect Objective of Making AI "Human"

An additional architectural error is the assumption that artificial intelligence should become increasingly human-like in order to become increasingly capable. Industrial technology did not progress by forcing machines to reproduce human physiology. Mechanical power displaced portions of manual craftsmanship precisely because machines exploited properties unavailable to biological workers: repeatability, speed, scale, precision, continuous operation, and standardized interchangeability. Digital computation subsequently displaced many forms of clerical calculation because electronic systems were not constrained to reproduce human cognitive procedure.

Artificial intelligence should be evaluated similarly. Human cognition contains capabilities worth modelling—adaptive attention, hierarchical control, memory consolidation, multimodal integration, predictive regulation, social reasoning, and flexible planning—but reproducing human phenomenology is neither necessary nor sufficient for dependable machine intelligence.

The relevant design question is not how human the machine is. It is which computational organization best satisfies the required function under explicit constraints. LDOA therefore adopts biological organization selectively at the level of functional architecture, not anthropomorphic imitation.

3. Definition of LDOA

LDOA is defined as a computational architecture satisfying five primary conditions:

Consequential behaviour is constrained by explicit laws and invariants.
Computational subsystems possess typed boundaries and responsibilities.
Probabilistic cognition is separated from deterministic authority.
Adaptation occurs through governed state transitions.
The system possesses explicit mechanisms for observation, memory, repair, rollback, and lifecycle termination.

An LDOA system is represented as a tuple of components: system state space, laws and invariants, boundaries, identity and authority state, memory, proposal-producing processes, validation operators, admissible actions, repair and recovery operators, and governance and lifecycle controller.

The architecture is "organismic" when these components form a persistent bounded system capable of maintaining operational organization under perturbation.

4. Law-First Computation

4.1 Laws Precede Autonomous Behaviour

The principal LDOA requirement is that governance be specified before autonomous execution. A law is represented as a tuple specifying preconditions, a permitted transformation, required postconditions, scope, and required authority. A transition is admissible only when preconditions are satisfied, authority is valid, and postconditions hold after transformation. Capability therefore remains distinct from permission: being able to perform an action does not mean being permitted to perform it. This distinction becomes increasingly important as models acquire broader tool access.

4.2 Hard and Soft Constraints

Hard constraints define admissibility. Soft objectives define preferences among already admissible states. Optimization occurs only over the feasible set defined by hard constraints. This ordering prevents optimization pressure from redefining its own constraints. The system cannot optimize its way out of its constraints.

The NEXUS Autonomous AI Challenge, which has run 50,000+ experiments, found a kill rate of approximately 97%—most candidates never make it past the deterministic safety gate. This demonstrates the importance of hard constraints: candidates must satisfy deterministic gates before optimization begins.

5. The Computational Organism

The organism analogy becomes scientifically useful only when translated into explicit computational functions. A computational cell is the smallest independently governed executable unit: it possesses inputs, transformation, outputs, invariants, and health state. Cells may be deterministic algorithms, statistical models, external APIs, retrieval functions, solvers, databases, or model calls. An organ coordinates multiple cells with a defined interaction topology. Examples include perception, planning, memory, validation, execution, security, or recovery subsystems.

Queues, event buses, message brokers, data pipelines, and transactional channels constitute the transport system. The biological analogy is secondary. The engineering requirement is explicit information flow with provenance retention. Global control variables modify subsystem behaviour, representing quantities such as risk tolerance, computational budget, uncertainty threshold, urgency, and resource availability. These are computational control variables, not biological hormones.

The immune subsystem detects violations and abnormal states. Its computational analogues include anomaly detection, sandboxing, access revocation, integrity checking, dependency verification, regression testing, and rollback. The closest computational analogue of a genome is not executable source code alone but the collection of schemas, invariants, policies, capability definitions, templates, dependency declarations, tests, and regeneration rules from which valid system components can be reconstructed. The canonical specification should therefore possess greater authority than any generated implementation.

6. Cognition Is Not Control

The most consequential LDOA distinction is between a cognitive plane and a control plane. A probabilistic worker computes proposals that may contain uncertainty. A deterministic control kernel evaluates the proposal against laws, authority, and evidence. The possible decision is accept, reject, retry, quarantine, or escalate. The architecture therefore does not require the worker to become perfectly deterministic. It requires the kernel to deterministically constrain what the worker can cause. This provides a more realistic foundation for governed AI than attempting to remove uncertainty from intelligence itself.

Research from McKinsey found that organizations with strong governance frameworks are 4.2 times more likely to report high AI value. This confirms that the governance of intelligence—not just the intelligence itself—is what drives performance. A system can be highly intelligent but poorly governed; the governance determines whether that intelligence creates value or risk.

7. The DO–WATCH–GOVERN Architecture

A minimal autonomous unit can be decomposed into three layers. The DO layer performs the task. It may contain an LLM, conventional software, optimizer, retrieval system, numerical model, or combination thereof. The WATCH layer evaluates the result against relevant constraints and evidence. Evaluation may include testing, schema validation, numerical checks, static analysis, factual verification, policy evaluation, provenance checking, or independent model review. The GOVERN layer determines whether the result becomes consequential.

The key property is authority asymmetry: the component generating an action should not unilaterally determine whether its own action is acceptable. The generator proposes. The validator evaluates. The governor decides. This separation prevents the system from approving its own proposals without oversight. Research on AI alignment has repeatedly shown that systems evaluating their own outputs tend to become self-confirming. The DO–WATCH–GOVERN architecture prevents this by ensuring that evaluation and governance are external to generation.

8. Memory as Governed State

Persistent memory transforms an isolated model invocation into a temporally extended system. Memory can therefore increase capability while simultaneously increasing systemic risk. A candidate memory should not enter persistent state merely because it was generated. Admission requires schema validation, provenance validation, contradiction validation, and authorization validation. Memory states may include candidate, validated, quarantined, stale, and revoked. This prevents memory from functioning as an uncontrolled accumulation of previous model outputs.

The architectural principle is that memory write is a state-changing action and should therefore be governed accordingly. Research on model decay has shown that AI models degrade over time, with ChatGPT's ability to identify prime numbers dropping from 98% to under 3% in three months, and OpenAI's hallucination rates increasing from 16% to 48%. Without governed memory, systems accumulate false knowledge and become increasingly confident and increasingly wrong.

9. Adaptation and Evolution

A system capable of changing itself requires stronger controls than one whose implementation remains static. A proposed mutation enters a candidate state rather than being immediately promoted. Promotion requires schema validation, security validation, test validation, regression validation, and authority validation. Only then does the mutation become the new system configuration. Otherwise, the system remains unchanged.

This distinction separates self-modification from self-governed evolution. An autonomous process that continuously edits its own source code is not necessarily evolving. Without selection criteria, controlled variation, environmental evaluation, lineage, rollback, and retention rules, continuous modification may simply accumulate technical entropy.

The NEXUS challenge's kill rate demonstrates that most mutations should not survive. In 50,000+ experiments, only 7 champions were promoted. This suggests that evolution requires rigorous selection—not just mutation.

10. Repair, Homeostasis, and Self-Maintenance

A computational organism should not be defined by the absence of failure. It should be defined partly by its response to failure. When integrity falls below a minimum threshold, normal autonomous operation should cease. Possible responses include retry, degrade, isolate, rollback, escalate, or terminate. A mature autonomous system therefore requires not only mechanisms for continuing operation but mechanisms for refusing continued operation when validity has degraded.

The objective of regulation is to maintain integrity above minimum threshold. When integrity falls below this threshold, the system should degrade gracefully rather than continue operating in an invalid state. This is the difference between robustness and survivability. A robust system continues operating. A survivable system knows when to stop operating.

11. A System That Knows When to Die

Indefinite execution is not evidence of autonomy. In many systems it is evidence that termination has not been architected. A component should possess an explicit lifecycle: initializing, active, degraded, quarantined, recovering, suspended, or terminated. When risk exceeds maximum, authority is invalid, confidence is below minimum, or resource burden exceeds maximum, the correct autonomous action may be termination.

This yields a stronger conception of autonomy: autonomy includes the authority to continue and the discipline to stop. A system unable to relinquish control when its assumptions fail is not maximally autonomous. It is insufficiently governed.

Research on model decay has shown that models degrade over time. Without mechanisms for retirement, organizations accumulate persistence debt—systems that continue operating long after their predictive relationships have disappeared. The ability to terminate gracefully is therefore not a failure of autonomy but a requirement for it.

12. Hallucination

Claims that an architecture can make hallucination mathematically impossible are unjustified unless every relevant inference and external proposition is formally decidable within a complete and correctly specified system, which real-world autonomous systems generally are not. LDOA therefore reformulates the objective.

Let hallucination risk be approximately associated with the probability of an unsupported proposition being generated multiplied by the probability of an unsupported proposition being committed given that it was generated. A governance architecture may have limited control over generation, particularly when using foundation models. It can exert substantial control over commitment. Therefore the primary objective is not preventing every erroneous internal hypothesis but preventing unsupported hypotheses from silently acquiring the status of verified knowledge or authorized action.

This distinction is crucial. The system does not need to prevent every erroneous internal hypothesis. It must prevent unsupported hypotheses from becoming consequential. The DO–WATCH–GOVERN architecture ensures that generation is separated from validation and commitment.

13. Drift

Drift is not a single phenomenon. At least five forms should be distinguished: model drift, context drift, policy drift, behavioural drift, and environmental drift. A system can remain internally deterministic while becoming externally inappropriate because its environment changed. Consequently, determinism does not imply validity. LDOA therefore requires versioned invariants, freshness checks, environmental monitoring, explicit assumptions, and selective invalidation. A component whose governing evidence becomes stale should not necessarily be repaired. It may need to be revalidated against the new regime.

The Look-Ahead-Bench study found that standard LLMs exhibited massive alpha decay out-of-sample because they had memorized training data rather than learning genuine predictive patterns. This is a form of drift: the model's behaviour remained consistent, but its relationship to reality had changed. Drift detection is therefore essential for system governance.

14. Provenance and Causal Ancestry

A self-maintaining system must distinguish what it knows from where that knowledge originated. For every claim, ancestry denotes its origin, transformations, and dependencies. Two apparently independent confirmations should not be counted as independent when they share the same decisive source. This becomes particularly important in AI ecosystems because generated information can be copied, summarized, retrieved, and regenerated until one original assertion appears to possess many independent confirmations.

Provenance is therefore not merely audit metadata. It is part of epistemic computation. Research has shown that AI has poisoned the well of its own training data—over half of all internet content is now AI-generated, and models have been shown to collapse quickly when trained on recursively generated data. Without provenance, systems cannot distinguish independent evidence from recycled self-confirmation.

15. Observer and Environment

No autonomous computational organism exists independently of an environment. The system never directly possesses the environment itself. It possesses observations, which include measurement or representation error. Consequently, observations are not identical to the environment in the general case. This distinction prevents internal representations from being mistaken for reality.

The same applies recursively: model of world is not the world, model of self is not the self, and predicted future is not the future. A scientifically grounded autonomous architecture must preserve these boundaries. This is why LDOA requires explicit observation functions and explicit recognition that observations are not reality.

16. Recursive and Multiscale Organization

Complex systems exhibit organization at multiple scales. For computational architecture, useful levels include operation, component, subsystem, organism, and multi-organism ecosystem. Each scale possesses local state and constraints. A locally successful action may nevertheless damage a higher scale. Therefore, validity at one scale does not imply validity at another. A code optimization may improve one function while destabilizing a service. A service optimization may improve throughput while increasing infrastructure risk. An agent optimization may improve task completion while degrading system-level reliability.

The architecture therefore requires upward consequence propagation and downward constraint propagation. This constitutes the scientifically defensible interpretation of "fractal" organization within LDOA: recursive architectural motifs across scales, not the claim that software necessarily exhibits mathematical fractality in the strict geometric sense.

17. Positioning Relative to Existing Disciplines

LDOA inherits deterministic algorithms, formal semantics, type systems, verification, databases, operating systems, distributed computation, and software architecture from computer science. Its proposed contribution lies in combining these mechanisms into a persistent governance architecture for adaptive AI-containing systems.

From artificial intelligence, LDOA accepts inference and adaptive cognition. It supplies containment, authority, provenance, state governance, lifecycle control, and commit-time validation. The relation is therefore AI as cognitive substrate and LDOA as governing architecture.

Cybernetics already established feedback, regulation, communication, and control as general principles. LDOA's differentiation must instead be demonstrated through the integration of typed authority, provenance, persistent memory governance, heterogeneous AI workers, transactional commits, regeneration, and explicit lifecycle surrender.

Autonomic computing already investigates self-configuration, self-healing, self-optimization, and self-protection. LDOA overlaps substantially with this tradition. Its proposed extension is the integration of modern generative intelligence and epistemic governance into these self-management loops.

Artificial-life research studies lifelike organization, adaptation, evolution, self-reproduction, and emergent computational systems. LDOA's narrower proposed contribution is an engineering architecture in which organismic organization becomes a governance structure for consequential AI systems.

18. The Minimal Canon

A large architecture should ideally be regenerated from a comparatively small authoritative specification. The architectural ideal is therefore not maximum source-code volume. It is maximum recoverable functionality from minimum authoritative complexity. Higher compression represents greater architectural efficiency, provided verification remains intact.

This is stronger than local patching. Traditional maintenance frequently produces cumulative local patches. LDOA instead favors canonical regeneration: observed failure leads to root-cause localization leads to canonical repair leads to regeneration leads to regression testing. This is stronger than observed failure leading to local patch. The difference is architectural. A local patch repairs one manifestation. A canonical repair attempts to modify the rule from which a family of manifestations is generated.

19. Self-Knowledge as Operational Metadata

A computational organism should maintain a machine-readable self-model describing capabilities, dependencies, limitations, authority, health, tests, failures, and version. The self-model is descriptive metadata, not consciousness. Schedulers may then choose components according to observed state rather than static naming. This converts architecture from a static collection of executables into a dynamically managed capability field.

This is the computational analogue of self-awareness—not subjective experience, but operational knowledge of one's own state. A system that knows its own capabilities and limitations can make better decisions about when to act and when to defer.

20. Failure Containment

The principal safety objective is not universal prevention of internal error. It is prevention of uncontrolled propagation. Even when failure probability is greater than zero, systemic risk can be substantially reduced by lowering propagation probability. This is a more defensible target than claiming perfect intelligence.

A containment boundary seeks to minimize the number of descendants affected by a failure. This suggests a general risk formulation: risk is approximately the probability of failure multiplied by consequence of failure multiplied by probability of propagation given failure. Even when failure is inevitable, risk can be managed by containing its propagation.

21. Validation Architecture

Validation should occur at several distinct levels. Local validation asks whether the component executed correctly. Contract validation asks whether it satisfied its interface. System validation asks whether the resulting system remained coherent. Requirement validation asks whether the system satisfied the intended objective. Scientific validation asks whether the evidence supports the claimed mechanism or performance.

These are not interchangeable: execution success is not system correctness, and system correctness is not scientific validity. A system can execute correctly and still be wrong. A system can be correct relative to its specification and still fail to satisfy the intended objective. Multi-level validation is therefore essential.

22. Empirical Research Programme

LDOA becomes scientifically meaningful only if its propositions are falsifiable. A reference implementation should therefore be compared with appropriate baseline agent architectures under identical models, tasks, compute budgets, tools, and datasets.

Primary measurements should include unsupported-claim rate, behavioural drift, unrecovered failure rate, successful recovery rate, provenance completeness, unauthorized-action rate, task completion, and compute and latency cost. The architecture would receive empirical support if, under controlled comparison, unauthorized-action rate, unrecovered failure rate, and drift are reduced while preserving acceptable task performance.

The strongest hypotheses concern not whether the model makes fewer internal mistakes, but whether mistakes produce fewer uncontrolled consequences. This is the distinction between model performance and system governance.

23. Falsification Criteria

The architecture should be considered weakened if controlled experiments show that deterministic governance does not materially reduce unauthorized or invalid committed actions, provenance mechanisms fail to improve forensic reconstruction, regeneration creates more regressions than conventional maintenance, multi-layer validation adds substantial cost without reducing consequential error, lifecycle surrender fails to reduce catastrophic persistence, organismic decomposition provides no measurable engineering advantage over conventional component architecture, or equivalent reliability can be achieved by substantially simpler architectures.

A scientific architecture must permit the possibility that its organizing principles are unnecessary. This is the hallmark of falsifiability. If the architecture cannot be proven wrong, it cannot be proven right.

24. Implications for Artificial Intelligence

The deepest implication of LDOA is that the future of dependable AI may not require a single model to become simultaneously omniscient, perfectly truthful, perfectly aligned, deterministic, self-correcting, and universally competent. Those properties can instead be distributed across architecture. A model can be creative without possessing commit authority. A planner can be powerful without modifying policy. A memory system can retain information without deciding its own admission criteria. A repair system can generate patches without deploying them. A predictor can estimate futures without defining reality. A worker can fail without collapsing the organism.

The resulting decomposition is intelligence plus control plus evidence plus memory plus authority plus verification plus recovery. This is fundamentally different from treating intelligence as the entire machine.

25. Conclusion

Law-First Deterministic Organism Architecture proposes a computational discipline for constructing persistent autonomous systems from heterogeneous components whose capabilities may include deterministic algorithms, probabilistic machine learning, generative models, numerical solvers, databases, sensors, human inputs, external services, and potentially quantum processors. Its central proposition is not that all intelligence should become deterministic. It is that consequential autonomy should be deterministically governed wherever technically possible.

The architecture therefore establishes a sequence: perceive, propose, evidence, validate, authorize, commit, observe, learn, repair or terminate. Within this structure, intelligence generates possibilities; laws define admissibility; evidence constrains belief; authority constrains action; transactions protect state; provenance preserves ancestry; memory extends temporal continuity; validation constrains error propagation; repair restores degraded structure; and termination prevents autonomy from degenerating into uncontrolled persistence.

The strongest form of such an architecture is therefore not a machine that claims to be alive, conscious, infallible, infinitely scalable, incapable of hallucination, or capable of evolving forever. It is a system that can demonstrate, through observable state and executable evidence, what it knows, what it does not know, what it can do, what it is permitted to do, why a state changed, which evidence supported that change, what failed, what was repaired, what remains uncertain, and when continued autonomous operation is no longer justified.

That distinction establishes the central principle of LDOA: the objective is not unconstrained artificial intelligence, but governed computational agency. The corresponding engineering principle is: intelligence proposes; architecture governs; evidence constrains; authority commits. And the corresponding lifecycle principle is: a mature autonomous system must know not only how to act, learn, and repair, but when not to act, when not to learn, when repair is no longer justified, and when its own execution should end.