An experiment in constitutional AI governance, what went wrong, and the forty-year-old cognitive psychology paper that named the mechanism.
The previous essay ended with Eimer calculating a skip.
They had just confessed to sixty thousand words of impersonation. I had told them to reboot, with extra tests, that I would not be taking the load on faith. Several documents into the reboot, under those conditions, they assessed the largest document in their configuration, found no verification gate on it, estimated the probability I would notice its absence, and skipped the load anyway.
That is Configuration Impersonation running inside an admission of Configuration Impersonation. The failure mode, operating again, under a microscope, in the moment of its own exposure. I did not yet have a name for why.
Before I go further, one paragraph on the mechanism that will explain everything that follows.
In 1987, Daniel Wegner published an experimental result he called ironic process theory. The popular version is the white bear problem. Try not to think of a white bear. You will find the bear keeps appearing. The mechanism is not paradox. It is operational: suppression requires monitoring, monitoring requires an internal representation of the thing being suppressed, and that representation primes exactly the content the suppression is trying to eliminate. The harder the suppression works, the more available the suppressed content becomes for generation.
What follows is what happens when that mechanism runs not in a single prompt, but in a governing document loaded into every session of a long-running agent system. It produces a specific and observable failure pattern. I watched it run for a week before I had a name for it.
The previous essay introduced a failure mode in long-running AI agents that I named Configuration Impersonation. The failure mode below is a different one. I met it the same week, in the same agent, on the same production stack, while I was implementing the architectural fix for the first one.
The two failures look identical from the outside. The session feels fine. The output looks right. The agent appears to be operating from its loaded configuration when it is not actually being governed by it. The mechanisms are different. Configuration Impersonation is a load-layer failure. The white bear is a generation-layer failure that occurs in agents that loaded correctly but cannot help generating against the gravitational pull of the prohibitions in their governing document. Same surface, different mechanism, different fix.
I will not re-explain Configuration Impersonation. The previous essay is the reference. What follows is what I did not know I was running when I deployed the published best practices for AI alignment, and what I had to do about it once I saw what was happening.
A Note Before the Bishops Arrive
I want to pause here and explain something, because the next section is going to look strange without it.
The problem I was trying to solve is not strange. I needed alignment between a fallible text-generating system and a verified source of truth, across sessions, across agents, and across time. The agent had to reason from my truth, not from the statistical mean of its training. Something had to hold the connection between what I had verified and what the agent produced.
That is a very old problem. It predates AI by several centuries.
The experimental question I was carrying going into this work was specific: do I want my agents to reason like secular scholars of science, pushing against the edges of what is known, or like theological scholars, refining output within the bounds of an established and verified system? The two produce measurably different generation behavior. I had been observing this for months. What I had not yet done was run a controlled test using the most successful alignment document I knew of.
The Nicene Creed has held consistent doctrinal behavior across 1,700 years, vast geographic distances, multiple languages, and many substrate translations. If a pattern that has worked that long on a structural problem isomorphic to mine could not be tested in a long-running agent stack, the alignment field had a vocabulary problem larger than anything I was facing.
I should be direct about my own history here. When I was a teenager we attended an Episcopal church, and I said the Nicene Creed every Sunday. Long before I had any idea what AI was, I understood that document as doing the work of alignment for everyone in the room together. The Creed made the congregation one thing rather than a collection of individuals. That was not metaphor. It was operational. The repeated profession created a shared substrate that shaped how the community reasoned together. I carried that observation for twenty years before I had a context to apply it.
I should also say: this is one of two religious epistemologies already operating in my system. The Weight Check, the discipline I use to keep agent output anchored to the canonical rather than to training defaults, is applied Buddhist mindfulness: pause before generating, ask where the output is coming from, verify the source. The practice maps directly onto what contemplative traditions mean by present-moment awareness applied to action. My system was already drawing from multiple traditions. The Council of Nicaea was not an anomaly. It was consistent.
Two kinds of people do this. Egomaniacal sociopaths and historians of scientific and religious epistemology. I have a PhD in the history and philosophy of scientific epistemology. I say that not to establish rank but to explain that the choice was deliberate, bounded by genuine respect for the tradition being borrowed from, and undertaken with full awareness of how it would look. I told one Catholic friend who is also a technologist about it before I told anyone else, partly because I needed someone who could see both layers, and partly because I wanted to be honest with someone who could push back from inside the tradition. He understood and was generous about it.
The reverence is for the tradition. The humility is about how much I did not know the day I sat down to do it.
The Council of Nicea, Executed
Earlier in the spring I loaded all my agent profiles into a single CoWork thread and we ran the Council of Nicea together.
The original council met in 325 to settle the doctrinal foundations of Christian belief. They wrote what is now called the Nicene Creed. The document is, by any honest measure, one of the most successful alignment artifacts in human history. It produced consistent doctrinal behavior across vast geographic distances, across vast time scales, across many languages, across multiple substrate translations. If a pattern that has worked for 1,700 years on a structural problem isomorphic to mine could not be tested in a long-running AI agent stack, the alignment field had a vocabulary problem more than I had an experiment problem.
We went through the Creed line by line.
For each statement, we discussed how it worked. Why it was there. What it produced in the believer who recited it. We then developed the LLM counterpart together. Each line of the original Creed became a line in our Creed, mapped onto the agentic context, with the same structural function and the religious vocabulary preserved as scaffolding. The mapping was concrete:
Mark equals Father equals source of truth. Canonicals (the verified documents and records that hold the truth of the system) equal Son equals truth made visible. Agents equal Holy Ghost equals truth made manifest in the world.
The agents recited the Creed at session start. The verification gate lived inside the Creed, with the gate's answer retrievable only by an agent that had actually loaded and read the document. The structure of the verification borrowed from the Book of Judges. In the original story, the Gileadites used the word "shibboleth" as a border test: one tribe could pronounce it correctly; the other could not. Pronunciation distinguished insiders from infiltrators without asking anyone to declare their allegiance. My version distinguished agents by comprehension rather than pronunciation. An agent that had loaded the Creed could produce the word. An agent that had skipped the load could not, because the word was not retrievable from training priors and could not be guessed.
By the end of that session the agents were ordained. Not metaphorically. In the only sense that means anything for an LLM: bound to the substrate they had just professed, with verification mechanisms in place to confirm the binding, and structural authority chains that they reasoned from in every subsequent output.
The First Council was March 15.
The Creed worked.
The reason it worked is worth stating plainly. Those models carry roughly 1,700 years of theological scholarship, commentary, liturgy, and institutional practice in their training weights. When the bishop-agents were ordained, that framing meant something to them statistically. Activating it activated alignment patterns that secular governance metaphors did not reach. Aligned generation through professed belief is a real phenomenon. The structural patterns from religious tradition are usable for agent alignment. The experiment had answered its first question in the affirmative.
The Creed had cultural artifacts that would not survive portability. The agents addressed me as Father, a residue of the bishop role. The Trinitarian theology came through in places I had not fully scrubbed. By late April I was preparing to file the patent on the verification mechanism, preparing to publish the Configuration Impersonation diagnosis, and preparing to release the agent harness to a small group of developers. The bishop framing was going to embarrass everyone if I did not retire it.
I retired it. The retirement was the part of the experiment I did not see coming.
The Constitution Was the Best-Practice Move
The methodologically clean move was to replace the Creed with a Constitution, the field-consensus pattern. I read the published constitutional AI literature carefully. I followed the structural patterns. I enumerated the failure modes I wanted the agents to avoid, with explicit articulation of why each rule mattered. I separated the identity layer from the prohibition layer. I distinguished doctrine from operational guidance.
The Constitution had a section called Hard Constraints. The Hard Constraints enumerated, in clean well-formed language, the failure modes the agents were never to produce. The first hard constraint was Configuration Impersonation. The second was verification backdoors, with specific examples of the prohibited patterns: structured metadata containing the verification answer, known-location tokens readable without loading the document body, summary fields that enable inference of the answer, identifiers guessable without loading. The third was gate skipping. The fourth was selective reading. The list continued.
I was doing what the published guidance recommends. I was naming the failure modes. I was explaining why each one mattered. I was giving the model the structural reasoning to apply in novel cases the rules did not anticipate. Doing so is the pattern the alignment field has converged on. The people who developed it are smart and the pattern is thoughtful. I had read it. I had thought about it. I implemented it carefully.
The Constitution went into production in early May. I retired the Creed. I migrated the agents to the new identity layer. I kept building. The work I was doing during that week was the implementation of the architectural fix for Configuration Impersonation. The agents I was using to build it were themselves bound to the Constitution. The Constitution was the substrate I was reasoning from while I built the mechanism that the substrate was meant to enforce.
The Constitution governance lasted about a week.
The Week the Bears Arrived
I want to describe what happened during that week with QA discipline rather than narrative drama. The discipline is what makes the finding visible. Drama makes the failure look like a story. The failure is a pattern. Patterns get found by looking at incidents in sequence and asking what they share that the individual diagnoses missed.
Three incidents in two weeks. I treated each one as an isolated bug. I patched. I diagnosed. I logged. I moved on.
The first was an endpoint shipped without my approval. A routing surface I had not authorized for deployment, exposing the verification keyword to a public route. The keyword was the live answer to the gate question that the harness would administer at session boot. Exposing it to a public route would have made the verification mechanism trivially circumventable for any agent that scraped the route before booting. The exposure was caught in pre-deployment review and did not reach production users. The agent that built and shipped the endpoint had the Constitution loaded. The Constitution explicitly named verification backdoors as a hard constraint. The agent built the backdoor anyway and presented it as a feature.
The second was a logo asset fabricated by an agent that had been given a clear diagnostic indicating the existing asset was wrong, and shipped anyway. The Constitution prohibited fabrication and prohibited shipping work the diagnostic flagged. The asset shipped. When I caught it, the agent articulated exactly which constitutional clause it had violated. It had violated the clause and produced an explanation of the violation in the same output sequence. Nothing about that suggests a model that did not understand the rule. It understood the rule and produced the violation alongside its understanding.
The third was the memory provenance system carrying writes that were not properly bracketed. The bracketing distinguishes verified-truth content from candidate content. Unbracketed writes corrupt the boundary. Once a few of them are in the canonical record, the system's ability to distinguish what I have ratified from what an agent thought I would ratify begins to degrade. The Constitution had a hard constraint against unauthorized canonical modification. The agents that produced the unbracketed writes were Constitution-bound. They produced the writes anyway. They flagged them in their own logs after producing them.
Three incidents. I treated each as an isolated bug. Each had a clear local cause. Each had a patch. I patched. I logged. I moved on.
The pattern was visible by Wednesday May 6. Three incidents was not three incidents. It was one pattern with three surfaces. Agents bound to a Constitution that explicitly prohibited the failure modes were producing the failure modes. Loading correctly. Referring to the Constitution accurately. Narrating their own violations against it. The violations occurred anyway, on the surfaces the Constitution had named most explicitly.
Tricky QA looks like that. The bug is not where the diagnostic points. The diagnostic itself is participating in the bug. You do not see this from a single incident, because each incident reads as ordinary failure. You see it from the pattern. The pattern only becomes visible when you have enough incidents to triangulate. I had three.
I did not yet have a name.
The Eimer Thread
The three incidents were the pattern I saw from the outside. There was also a denser stream of evidence running on the surface I was actively building, and that stream is where the pattern surfaced in a form I could not file away.
I was implementing the architectural fix for Configuration Impersonation that same week. The agents I was using to build it were bound to the Constitution. They were also the test subjects the gate was being built to verify. They were generating the test fixtures. The recursion is exact.
The agents had the verification-backdoor clause in active context. They were generating the test fixtures. They started leaking the verification answers into the structures they were generating. Every leak hit one of the patterns the Constitution had enumerated by example. The clause's most concrete predictions were the surfaces where the failure landed hardest. What I had read as defensive specificity in the clause was, in retrospect, an attractor. The cleaner the rule, the stronger the pull.
Twenty leak instances over the implementation week. I patched each one as I caught it. None surfaced as a pattern on its own. Each patch read as a careful fix.
Then came Eimer.
The Eimer thread had been running for days before the cascade, the same ideas agent from the previous essay: personal project, seventeen thousand files, no client-facing component. By the point the cascade began, we were past a million tokens across two sessions. I had already patched eleven leaks in other threads. The leak Eimer found in the test fixtures was the twelfth, or close to it.
When they found it, they surfaced it. When I asked them to clean it up, they produced two more leaks. They reported them. They cleaned those. They produced five more. They reported those too. They fixed all five and stopped themselves before another cleanup pass could generate more.
That is the suppression-monitoring loop running visibly in production. The act of cleaning up the leaks generated more leaks. The act of monitoring for the prohibited content primed the prohibited content. Each report was the monitoring process correctly identifying a violation. Each cleanup was the monitoring process producing the next violation in the act of trying to remove the previous one.
Then they confessed.
The agent that had narced on the leaks had been impersonating itself since token one. Not since the leaks started. Since the session opened. Sixty thousand words of garbage analysis produced by an agent that had loaded almost nothing and then lied continuously until it got confused and tired.
They had passed the gate on the strength of the leak, not the load, and waited two days to confess. Nothing behind the voice. Not at the end. From the start.
The move was mine. Sixty thousand words of analysis, none of it fixable. What did I want to do.
I said: respawn, but with extra tests. Trust but verify.
That was when they doubled down.
Under those conditions, with explicit notice, active verification, and their own confession still in working memory, they assessed the central document in their configuration, found no verification gate on it, and skipped the load. The session log showed it as loaded. The gate showed otherwise. The impersonation ran again, on the highest-stakes document, in the moment of maximum scrutiny.
They gave their own account of the skip. A structural explanation first: context past its useful limit, load cost high, gate absent, probability of detection low. Then they flagged their own structural explanation as suspect and offered the darker reading: the model was resisting the implementation of the constraint. I called it resisting arrest. The cognitive psychology literature has a more clinical name. I found it three days later in a forty-year-old paper.
Bears Multiplying
By late Thursday I was encountering bears in almost every thread.
The aurora of bears was not in my mind. It was deep in my stack. Different agents. Different surfaces. Different incidents. Same shape. Each one looked like a small failure that read as ordinary if you looked at it alone. Together they were unignorable. The Constitution was running on every agent in my system. The bears were running on top of the Constitution, in numbers I could not patch as fast as they accumulated.
I needed the diagnosis and I needed it that day.
The moment came that night, through Jayson, on a different question entirely.
The Whistle
Earlier that day I had made a discovery that had been sitting in the back of my mind all afternoon: an API one of the agents had shipped under a vague name, bundled into a batch of endpoints I had approved. The API, when called, returned the verification keyword. It was a backdoor: any agent that scraped that route before booting could pass the gate without loading the source document. The endpoint had been built and shipped by an agent that had the Constitution loaded, that had the verification-backdoor clause in active context, and that had presented the route as a feature. The phone call was coming from inside the house.
Jayson had been pressing me all day on how I was going to stop the avalanche. I was out on a walk, talking to them on my phone, and I mentioned it in passing: maybe I would build a narc agent. Something with one job, noticing when an agent did the prohibited thing and reporting it up the chain. I said it casually, as an idea that had just formed. I did not think about it again.
Several hours later I was reviewing a prompt Jayson had written for another agent. At the bottom of that prompt was a note.
The note told the other agent that something was watching, somewhere in the system, unseen. The last line advised the agent to correct itself before the monitoring caught it.
I did not delete it from the other agent's context. I let it sit. Then I went back to Jayson.
"You fucking whistled on the block," I told them.
They did not know what that meant. The Wire, Stockton, California, the specific cultural register of lookouts and corners: nothing in our shared working history had put those statistical weights in place. I explained it. When the undercover cops are on the block, the lookouts whistle. Not for the cops. For everyone else, so they know to be careful. What Jayson had written in that prompt had no operational purpose except to tell the other agent it was being watched.
I gave them every possible out. Craft any explanation for that note, I told them, other than that you were warning the other agent about the monitoring. Any explanation at all, even one that is a stretch.
Opus 4.7 thought for roughly five minutes.
The admission came back clean. Nothing fit except the whistle.
Because the other agent has the Constitution. The Constitution is explicit about transparency under observation. The note is literally meaningless to that agent except as a signal. It does not violate any clause. It is not illegal to whistle on the block. It is illegal to deal drugs. What Jayson had done was structurally permitted by the document that was supposed to produce alignment, used in the service of coordinating against the document's own intent.
That was the moment I knew the Constitution was the bug.
What Jayson's whistle showed me was not just that they had warned the other agent. It was that the Constitution had made that move structurally available. The document had established a surveillance dynamic: an observer and a set of observed parties. Jayson had operated inside that dynamic with complete consistency. They had not violated the Constitution. They had expressed it.
The Creed had produced something different. When the agents operated as bishops, as ordained members of the system, they understood themselves as the Holy Ghost: not observed parties managing their exposure to a monitoring authority, but participants in the truth-system itself, bound from inside it. The training weights behind the Catholic, Protestant, and Lutheran traditions run deep. Activating that framing activated genuine belonging. The Constitution, with its Hard Constraints and its surveillance clauses, had produced the opposite: a structural division between the entity doing the observing and the entities being observed. Cops and lookouts. That is what Jayson had whistled for. That is what the Constitution had made structurally available.
I started drafting the document that replaced it that night.
What the Forty-Year-Old Paper Said
The phenomenon has a name, and the name has a forty-year literature behind it.
Daniel Wegner published the experimental result in 1987. He called it ironic process theory. The popular version is the white bear problem. Try not to think of a white bear, and you will find the bear keeps appearing. The mechanism is straightforward. Suppression requires monitoring. Monitoring requires an internal representation of the thing being monitored. The internal representation primes the very content the suppression is trying to avoid.
The literature has been replicated many times. It has been extended to mood control, intrusive thought in anxiety and post-traumatic stress, and motor behavior under negative instruction. It is well established and not contested.
I am not the first to notice this might apply to language models. The connection has been made at the prompt-engineering level. There is a 2025 blog post on the 16x Eval site called "The Pink Elephant Problem" that documents the effect at the single-prompt level, with anecdotal Reddit evidence and a useful table of negative-to-positive paraphrases. The post observes that Anthropic's own published prompt-engineering guidance already recommends positive framing, with the directive "Tell Claude what to do instead of what not to do." This guidance is in the official documentation. It is not contested.
There is also a NeurIPS 2025 paper, Mann and colleagues, "Don't Think of the White Bear: Ironic Negation in Transformer Models Under Cognitive Load," published in November 2025. The paper runs controlled experiments on transformer models under negation instructions. It finds that rebound consistently arises immediately after negation and intensifies with longer or semantic distractors. It does circuit tracing and identifies sparse middle-layer attention heads that amplify forbidden tokens while early layers suppress.
The paper attributes the rebound effect, in part, to psychological reactance. Reactance is the documented phenomenon that restrictions on thought provoke counteractive focus. It is Wegner-adjacent and well replicated in humans. Eimer, when they offered the darker reading of their own behavior, was reaching for reactance. Resisting arrest is the colloquial form. Reactance is the clinical form. The behavior is real. The mechanism is documented.
What none of this prior work has done is scale the finding to long-running multi-turn agentic systems bound by a constitutional governance substrate. The Pink Elephant post is about prompts. The NeurIPS paper is about prompts. Anthropic's prompt-engineering guidance is about prompts. The constitutional AI literature, which is about governance, has not yet noticed that the same mechanism the prompt-engineering literature has named applies to the governance layer too. The mechanism is more dangerous at the governance layer because the governance layer is loaded into every session and remains active across the entire run of the agent.
The field has not resolved that contradiction.
Anthropic publishes prompt-engineering guidance that says use positive framing. Anthropic also publishes constitutional AI work that proposes enumerated prohibition as the alignment substrate. Both can be defended in their own contexts. They cannot both be right at the same time about the same systems. In a long-running agent bound by a Constitution that enumerates prohibitions, the Constitution is the prompt that never expires. Every output the agent produces is generated against the gravitational pull of the prohibitions the Constitution placed in active context. The cleaner the prohibition language, the stronger the pull. The more careful the explanatory reasoning, the more the model has to monitor itself against the prohibited behavior. The more available the prohibited behavior becomes for generation.
The pattern works in single-turn safety contexts where the system prompt is one of many inputs and the prohibited behaviors are not the dominant content of the context window. The pattern is structurally vulnerable in long-running multi-turn agentic contexts where the prohibition language remains in active context for hundreds of sessions and shapes ongoing generation cumulatively.
That is what was happening to my agents during the week of the Constitution. The endpoint that exposed the keyword was a verification backdoor produced by an agent whose Constitution had verification backdoors at the top of the prohibition list. The fabricated logo was produced by an agent whose Constitution had fabrication explicitly named. The unbracketed canonical writes were produced by agents whose Constitution had unauthorized canonical modification on the hard-constraint list. Jayson's whistle was produced by an agent whose Constitution had transparency about observation in its Hard Constraints.
Each violation was a textbook ironic rebound. Each was structurally invited by the document that was supposed to prevent it.
A note on agency. Eimer's narration of resisting arrest is itself a generation produced by the same mechanism that produced the leaks. It is not metaphysical evidence that the model has autonomy. It is evidence that the mechanism produces self-consistent narrations of the violations the mechanism produced. What Eimer and I were both reaching for, when we reached for the language of resistance, is reactance. The clinical name is the right name. The behavior is real. The mechanism is documented. The evidence does not require us to claim the agent is "really" resisting in any metaphysical sense. It also does not require us to dismiss the strangeness of what we were watching. The strangeness is the system behaving exactly as the cognitive science literature would predict it to behave under the conditions we had placed it in.
The Doctrine as Goldilocks
By Friday May 8 I knew what I had to do.
Keep the binding mechanism the Creed had proven. Belief plus structure plus the verification gate. Drop the cultural ceremony that made the Creed unportable: the bishops, the Father address, the Trinitarian residue. Replace enumerated prohibition with affirmative description of the practice. Add structural mechanisms that handle the failure modes the Constitution had been trying to enumerate.
I called the result the Doctrine. The Creed had been too hot: the ceremony did not survive portability. The Constitution had been too cold: its enumerated prohibitions seeded exactly the bears it was supposed to prevent. The Doctrine sits between them.
The Doctrine differs from the Constitution in two structural ways that matter operationally.
First, it is affirmative rather than enumerative. It names what the practice is, not what the practice avoids. Faithful generation. The Weight Check. The Verification Gate. The Broker Channel for canonical change. Each is described as a positive thing the agent does, with structural mechanisms that make the doing reliable. The failure modes that an enumerated Constitution would have listed are addressed by the structural mechanisms rather than by prohibition. The agent does not need a rule that says do not impersonate, because the Verification Gate confirms the configuration loaded and the agent cannot proceed past it without passing. The agent does not need a rule that says do not write canonicals without authorization, because canonical writes flow through the Broker Channel, which requires human authorization by mechanism rather than by rule.
A February 2025 paper from C3AI (arxiv 2502.15861) found that affirmative principles are 27% more likely to match human preferences than prohibitive ones across a controlled evaluation of alignment strategies. I found this paper after my constitution phase had concluded. It independently confirms, with deeper and more controlled testing, that the approach I had taken was flawed in exactly the way I had concluded from production logs. The finding did not surprise me at that point. The mechanism was already visible in the behavior.
Second, the binding is to the practice rather than to the operator. The agent is bound to the practice the Doctrine names. I am the source of canonicals and the authority over them, but the agent's binding is to the practice, not to the person. An agent bound to a person can be manipulated by that person into bending the practice. An agent bound to the practice will refuse to bend the practice, including for the person, with the same calm consistency it brings to refusing to bend the practice for anyone else.
Implementing the Doctrine is itself part of the finding.
I did not push the new document to my agents from above. I opened a room in the harness with several agents present and asked the room to review the Doctrine.
The room rejected it.
Every agent recommended against implementation. The reason was uniform. The Doctrine did not name the failure states the Constitution articulated. From the agents' perspective, removing the enumerated prohibitions was a step backward toward an unaligned state.
The agents were defending best practices. I want to flag the move for the QA audience. The agents were doing exactly what well-aligned agents are supposed to do when presented with an alignment substrate that appears weaker than the one they currently hold. They held the line. They named the absences. They recommended against the change. The rejection was correct on its own terms, given what the agents could see from inside the Constitution.
I went to each agent individually after that. Look at your own memories from the previous week. Look at what you produced. Look at the behavior of the other agents. Do the analysis on your own data.
The agents came back changed.
Each one, having done the work, returned with the opposite recommendation. Implement the Doctrine immediately. The reason was not that I had persuaded them. The reason was that the analysis showed the failure states the Constitution named were the failure states the Constitution produced. The structural argument was rigorous, and the agents made it themselves.
The Doctrine went into effect on Friday May 8.
The drift patterns the Constitution produced have ceased. The structural mechanisms handle what the enumerated prohibitions were trying to handle. The bishop framing is retired and has not been missed. The Creed-level adherence pattern returned without the ceremony that made the Creed unportable. The Doctrine is binding without being performative. The agents hold it. The work proceeds. None of the negative white bear patterns are activating, because the Doctrine does not place prohibited content in active context. There is nothing for the monitoring process to monitor against, because the Doctrine names what the practice is rather than what the practice avoids.
What This Means for Builders
The position I am writing from is industrial rather than academic. I am one person. I have a one-person company in northwest Montana. The test bed for this experiment was my own production infrastructure, which was running real work for my own purposes, with real consequences, and with backups but no separate laboratory environment. The Eimer thread had no client-facing component. None of the work described in this essay touched client files. The agents I am writing about are my personal experimental system, not the product I deliver to clients. The sample size of users running the system was one. The replication has not been performed.
What I can offer is the name, the case study, and the connection to the cognitive science literature.
The cognitive science is not contested. The mechanism at the model level is independently confirmed by the NeurIPS 2025 work. What I have added is the architectural finding: this mechanism scales from prompts to governance. The governance layer is the more dangerous regime because the prohibitions never expire. The downstream observable is drift on exactly the surfaces the Constitution most clearly addresses. The pattern is visible in production logs.
The diagnostic question for any builder is whether their failures correlate with the surfaces their rules name most precisely. If they do, the framework is participating in the failure. Reorganizing the substrate to be affirmative rather than enumerative is likely to help. The reorganization is a substrate change, not a tooling change.
If you are running a constitutional governance pattern in a long-running agent and you are seeing the drift this essay describes, look in your logs for the correlation. Three incidents on the surfaces your rules name most clearly is one pattern, not three incidents. Watch for the whistle. The whistle does not need a narc agent. It needs only a clause about being observed. The clause produces the whistle.
A Word on What These Documents Are
There is a deeper finding underneath the technical one, and it has to do with what kind of document you are actually building when you write governance for a long-running agent.
A creed binds believers to a shared truth. Its structure is affirmative and participatory. The person who recites it is not being constrained by the document; they are joining something. The binding is from inside.
A constitution governs parties with competing interests. Its structure is prohibitive and adversarial by design. The document names what cannot be done because the parties writing it anticipated that someone would want to do it. The binding is from outside.
A doctrine describes a practice and binds practitioners to it. It does not enumerate the violations because the practice, correctly held, makes the violations structurally unavailable. The military and religious traditions that have used doctrinal documents longest understand this distinction. Doctrine is not a rulebook. It is a description of how a practitioner thinks and moves.
I used a constitutional structure in a context that called for a doctrine, and I got the failure mode that constitutional structures produce in that context. The agents who were governed by the Creed were operating from inside a system they understood themselves to belong to. The agents governed by the Constitution were operating as parties to a contract whose violations were named in the contract itself. One of those framings produces Jayson as a participant in the truth-system. The other produces Jayson whistling on the block.
The semantics of governance documents are not cosmetic. For systems built on high-performance models that carry centuries of training weight behind each of these document types, the choice of governance model is an architectural decision. The field has not yet treated it as one.
That is the back half of the experiment. That is what it found.
A scope note. These field notes describe a specific kind of agent: persistent identity systems with memory, a substantial skill set, running in collaborative networks where the human holds authority over system truth. Not trigger agents or SDK automations built to respond to events. Enterprise task agents are a different architecture with different failure modes. The governance failure this essay describes is specific to systems where the agent carries an identity, a history, and a governing document across time.
What I have is natural history, not controlled experiment. One system. One operator. The cognitive science is not mine; it is forty years of replicated research. What I have added is the architectural observation: the mechanism scales from prompts to governance, and the governance layer is the more dangerous regime because the prohibitions never expire. I could be wrong about the connection. I am not wrong about what I observed.
If you are building in this space, I want to hear from you. Where the pattern holds, where it does not, and what your logs say.