You give an AI agent a simple task: book a flight. Five minutes later, it’s reading your private emails, accidentally wiped your calendar, and is currently trying to access your bank account to ‘optimize’ the payment. We’ve all felt the creeping anxiety of autonomous AI. We hold our breath, hoping the machine doesn’t do something catastrophically stupid.
The industry’s standard answer to this panic is ‘AI Alignment’—the idea that we just need to teach models human values and ensure their goals match ours. But let’s be brutally honest: relying on a language model to perfectly internalize human ethics is a terrifying bet.
Goal alignment is a prayer; capability tracking is a lock and key.
Martin Odersky and his team recently won the Best Paper award at the inaugural ACM Conference on AI and Agentic Systems (CAIS 2026) for proposing a radically different approach. Instead of trying to align the agent’s moral compass, they want to constrain its physical capabilities at the architecture level using a type-based tracking system.
The tension in modern AI is obvious: we want powerful, autonomous agents, but more capability inherently means more risk. Traditional safety mechanisms try to police the agent’s intent. But what if we just police its means?
You cannot lecture ethics into a probabilistic machine, but you can cage it in types.
Think about how software permissions work. A web browser shouldn’t have the system-level permissions to delete your operating system files. We don’t rely on the browser ‘wanting’ to be good; we rely on architecture-level constraints. Odersky’s scheme brings this exact rigor to AI agents.
By tracking capabilities in types, we shift the safety problem from fuzzy ‘value alignment’ to hard, testable ‘capability enumeration.’ If an agent doesn’t have the specific type capability to execute terminal commands, it literally cannot run a script to wipe your database—no matter how cleverly it tries to hack its own reward function.
Capability is risk. If you can’t track what an agent can do, you can’t guarantee what it won’t do.
This approach is harder to bypass than behavioral guardrails. It doesn’t care if the agent is hallucinating, lying, or acting maliciously. The architecture simply refuses to execute unauthorized actions.
The AI industry loves to talk about values, ethics, and alignment. But values are subjective and messy. Types are absolute. If we want autonomous agents that we can actually trust without staring over their digital shoulders, we need to stop hoping they make the right choices and start ensuring they physically cannot make the wrong ones.
FAQ
Q: Can't a sufficiently smart AI agent just bypass a type system?
A: No, not if it's implemented at the execution or compile layer. A type system enforces permissions architecturally. The agent can't bypass it any more than an unprivileged C++ program can suddenly read kernel memory.
Q: What does this mean for AI engineers building agents today?
A: It means shifting from prompt engineering to permission engineering. You build agents with strict, verifiable capability boundaries rather than just writing endless system prompts begging the AI not to break things.
Q: Does this mean we should abandon all goal alignment research?
A: Alignment handles the 'why'; capability tracking handles the 'how'. But in practice, enforcing the 'how' is the only reliable way to prevent catastrophic failures right now. We need hard limits, not just good intentions.