Under what declared conditions is this action allowed to begin?

Most people assume a single AI:

User → AI → Result

One AI judges, executes, and is responsible for accuracy.
This framework separates that into two layers:

User → Permission Layer → Performance Layer → Result

Permission Layer: Is this action allowed to begin?
Performance Layer: How is this action carried out accurately?
What sits inside each layer — AI model, agent, or hardware logic — is a separate question.

The Permission Layer does not judge accuracy. It only judges whether the declared conditions are met.

So the question is not:
"Can the machine brew coffee accurately?"

The question is:
"Are the declared conditions met to begin this action now?"

If the manufacturer has declared: "A cup must be placed before brewing begins" — the Permission Layer checks that condition. If the cup is not detected, the agent says: "Cup not detected. Please place a cup and try again."

Whether the coffee is brewed well after that is the manufacturer's responsibility. That belongs entirely to the Performance Layer.

We do not ignore accuracy. We reduce accuracy-related questions into declarable items — start events, end events, and target values. Whether those are implemented correctly remains the manufacturer's responsibility.

And perhaps this is where AI alignment also becomes a product quality problem.

In physical products, AI alignment is not only a model problem. If a manufacturer's product can be executed by an AI agent, declaring how that product's actions are meant to be understood and bounded is part of the manufacturer's quality responsibility.

Otherwise, the Permission Layer has nothing to check against — and the AI will fill the missing structure through general inference.
Model knowledge can help interpret.
Declared conditions must authorize execution.

There is a common leap in these discussions that I think comes from this missing layer.

Because most people's reference point for AI is prompts and vibe coding:

Prompt: User says something → AI responds → almost always executes
Vibe coding: User requests change → code changes → execution is assumed

The default is execution. Refusal is the exception.

So when people hear "AI can execute physical actions," the logic jumps directly:

AI can make coffee
→ AI can do anything
→ AI can press the nuclear button

There is no middle step. Because in the single-layer model, there is no middle step.

But physical execution is a different structure entirely:

Prompt → almost no refusal conditions → always executes
Vibe coding → limited scope → mostly executes
Physical (general) → Permission Layer → executes only if conditions are met
Physical (high-risk) → Permission Layer → much stricter conditions required
Nuclear button → entirely separate political, military, and legal structure

The nuclear button is not an AI execution problem. Human society already handles that through entirely separate structures.

The reason the leap happens is this.

If you assume a single AI layer with no refusal structure, scale is the only variable. Bigger action, same logic. That is frightening, and reasonably so.

But if a Permission Layer exists, the question changes completely.

It is no longer:
"Will AI press the button?"

It becomes:
"Under what declared conditions is this action allowed to begin?"

That is not a question of fear. That is a question of design.
And design is manageable.

Physical AI Safety: Ownership and Execution Boundaries