Scope — What May This Touch?
1. Scope: what may this touch?
Scope is the only discipline you can exercise before the system does anything.
Scope comes first because it is the only discipline you can exercise before the AI does anything. Every other discipline responds to work already produced. Scope decides whether the work should be attempted at all.
The construct
Scope — the specification of what an AI-augmented workflow may touch, may not touch, and must escalate.
Three zones, not two. Most scope statements name only the first.
| Zone | Contains | Failure when missing |
|---|---|---|
| In bounds | Systems, datasets, actions the AI may act on | The AI does nothing useful |
| Out of bounds | What it may never touch, under any instruction | Expansion, invisibly |
| Escalate | What requires a human decision first | Silent judgment calls you never see |
The out-of-bounds list is the one that does the work. A scope statement naming only what is permitted has not constrained anything — it has described an intention, and intentions do not survive contact with a capable system.
Why least privilege applies here
The security literature settled this fifty years ago. Saltzer and Schroeder's principle of least privilege holds that every component should operate with the minimum privilege required to do its job — not the privilege it might one day need, not the privilege that is convenient.
The reasoning transfers better than the rule does. Least privilege is not primarily about preventing malice. It is about limiting the blast radius of ordinary error. A component with narrow access makes small mistakes. The same component with broad access makes large ones, without behaving any differently.
That is precisely the AI case. A capable model given wide scope does not become malicious. It becomes expansive — and expansion looks like helpfulness right up until someone has to undo it.