A system's ability to perform an action is not permission to perform it. This is the one rule the rest of the architecture derives from. As models grow more capable, the temptation is to treat capability as license: the agent can send the email, so it sends it. Logos refuses that step.
Three distinct things
An agent's output is a proposal. A proposal is not an authorization. An authorization is not, by itself, the action. Logos keeps these separate by construction. The model proposes, an accountable person authorizes, and only then does the runtime execute. Capability lives in the first step and never crosses into the second on its own.
Authority comes from a person
Authority originates from a named, accountable principal, never from the model and never from the volume of past approvals. A standing policy can let a class of actions run without a fresh approval, but that policy is something a person authored, scoped, and can revoke in a single act. The accountability does not move to the machine; it stays with the person who set the policy.
Why this is load-bearing for agents
Every downstream guarantee depends on this line. Attribution is possible because there is a person to attribute to. Revocation is possible because authority was granted, not assumed. An audit record means something because it records a decision a person owns. Remove the principle and the agent's actions become orphaned: powerful, and answerable to no one.