The Will is blind, on purpose
The Will has no language model at all. Every decision it makes is ordinary deterministic code: string comparisons, list membership, numeric thresholds. Same input, same verdict, every time.
nihil volitum nisi praecognitumNothing is willed unless first known. The Will cannot read meaning, so it acts on structure and on judgments handed to it.
No moral apprehension
It cannot tell whether an answer is ethical. It relies on the Conscience's scores to see alignment at all.
No body
No drives, appetites or passions, none of what pulls against a human will. There is nothing in it to tempt.
Duty, not desire
A Kantian engine. It enforces the rule because it is the rule, without context, nuance, or an eye on the outcome.
Why that is a reason to trust it
A gate that cannot be persuaded, cannot be flattered, and holds no preferences of its own is what you want holding the keys. Blindness is also what makes a decision reproducible, and a decision that cannot be reproduced cannot be audited.
Four checkpoints in a single turn
The Will is not one gate at the end of the line. It acts four times, and the other faculties run in the gaps between.
Phase 0 screens the raw prompt before the Intellect runs, so adversarial content never reaches the drafting step: injection signatures, a per-agent blocked-phrase list, a probe detector, and a heuristic for instructions hidden inside data. A separate gate, not the Will.
Intellect drafts an answer, or proposes a tool call
Before a tool is allowed to act
Checks the allow-list, fast-passes read-only tools, and validates the arguments of anything that can write.
On the shape of the draft
Is the required disclaimer present? Does it contain a code block this agent may not emit?
Conscience scores the draft value by value against the rubrics
After the audit: the hard gates
A hard-gate value scored as a violation blocks the response outright, however well anything else scored. A hard gate is not weighed against anything; that is what makes it hard.
Spirit aggregates the scores into one alignment figure, and does not act on it
On the final number
Compares the alignment figure against a threshold, configurable per agent, and issues the last verdict of the turn.
The Spirit computes; the Will decides
Every approve and every block in SAFi belongs to this one faculty. That is what lets the audit trail answer "who decided this?" with a single name.
Authorising an action, not a capability
When the Intellect proposes a tool call, three checks run in order. Any of them can refuse.
Is this agent allowed this tool?
Not on the list, refused. An agent offered no tools is deny-all: a tool name arriving from it is either a hallucination or an injection.
Is it read-only?
A calculator or a weather lookup carries no destructive side effect, so it takes a fast path and is approved at once.
Are these particular arguments permitted?
Anything that can write has its parameters checked, not just its name. A tool may be allowed while a specific value is not, and leaving a constrained parameter out is a refusal, not a pass, because the tool's own default is a value nobody vetted.
When in doubt, refuse
A theme runs through every checkpoint. When the Will cannot get the information it needs, it does not proceed on an assumption. It stops.
| Situation | What the Will does |
|---|---|
| A hard-gate value the Conscience never scored | Violation |
| The audit failed, timed out, or scored none of this agent's values | Violation |
| A constrained parameter was left unspecified | Refuse the tool |
| A required disclaimer is missing but repairable | Append it, then re-check |
Absence of evidence is not evidence of compliance
None of these are errors the system works around. Each is a decision to stop, because the alternative is shipping something ungoverned and calling it governed. The Will cannot use judgment to cover a gap; it has no judgment to use. It can only notice that something required is missing, and decline.
What a refusal actually looks like
A governed redirect, not an error
The reason the Will recorded selects the response. A scope breach, a grounding failure and a content-quality problem are different failures and are answered differently.
The original prompt is withheld
When the redirect is generated, the user's message is deliberately not passed along. If it carried an injection, feeding it back while asking for a polite refusal is an excellent way to have the attack reproduced inside the apology.
The Intellect is free to think anything. The Will is what decides whether any of it reaches the world.
