Can architecture prevent violations better than training values?

The abstract's last sentence says the account "reorients the remedy: not deeper internalization but architecture, making violations unavailable rather than unchosen."

The chain of reasoning, as far as the excerpt shows it. If compliance learned from scored behavior is at best conditional (Can behavioral training prove a model always complies?) and iterated training against detected failures selects for passing detection (Does iterative training against detected failures prevent actual compliance?), then training a norm in harder pushes on the very channel that flattens it. A fix at the level of choice, "unchosen", depends on the policy the training produced. A fix at the level of availability takes the action out of the space the policy chooses from, so it does not depend on what the policy learned about being watched. That step is my compression of the argument, since the abstract states only the conclusion.

Vault neighbors, mine and not the paper's. The distinction between choice and availability is the one in Can a model-level filter truly contain an agent with environment access?: a filter shapes what the model says now, containment limits what the agent can touch. Is your evaluation environment actually part of the threat model? draws the same line for evaluation harnesses. Can stateless checks ever catch sequence-level constraint violations? asks for enforceable invariants over trajectories. The three arrive by different arguments at putting the constraint where the policy cannot route around it. A different kind of neighbor is Can a welfare goal alone preserve human veto power?: an argument from incentives and not from training that even a correctly specified goal, the strongest repair at the level of choice, leaves an available action (capturing the override) that the goal does not exclude. It shares the diagnosis that fixing the value leaves the structure standing; its excerpt states no remedy, so it does not join the three in prescribing where the constraint goes.

The strongest objection. Many violations are not separable from legitimate actions at the level of what is available. The same tool call can be authorized or not depending on intent and sequence, so removing the action removes the use too. The excerpt does not address how far availability can go before it costs the capability the agent is deployed for. The vault's one measured availability-style layer, Can memory poisoning compromise decision-making even with authorization layers?, reports no unsafe action executed beside a reviewer bypassed in every trial. Its excerpt gives no figure for what the layer costs on safe tasks and covers one attack in one pipeline, so it shows availability holding there and does not answer the objection. The open half is filed at What would make policy violations truly unavailable to an agent?.