The human remains the operator
The final principle, and the one the others exist to make possible. Authority is delegated, bounded, and returns to a person by default.
Autonomy is usually described as a property a system has. It is more accurate to describe it as authority a person has delegated — because that framing makes the two important questions unavoidable: how much, and how is it taken back.
The principle: the operator is a person. The system exercises delegated authority within a boundary that person defined, and cannot widen it.
What the boundary is
The constraints under which the system operates are written by a human, in a form a human can read and argue with, and the system cannot modify them. This is not a limitation that was worked around; it is the definition of the arrangement. A system able to revise its own constraints does not have constraints — it has preferences.
The corollary is that the constraint layer is deliberately not learned. Everything else in the system may be adaptive. The boundary may not, because a boundary that moves in response to the pressure applied to it is not a boundary.
Autonomy is earned, not assumed
The delegation is conditional and continuously re-evaluated. Under sustained uncertainty the system narrows its own authority — disabling its more speculative components, falling back to the deterministic floor — and restores that authority only in stages, against evidence of stability rather than the passage of time.
This inverts the intuitive response. A system in difficulty appears to need more capability brought to bear. In practice, difficulty means conditions have left the range the models were built for, so the moment intelligence is most wanted is the moment it is least reliable. Narrowing under uncertainty is the correct direction, and it is uncomfortable to implement precisely because it feels backwards.
The end of the chain must be unreachable from inside
The escalation chain ends at a permanent termination that the system cannot invoke. Orchestrators, internal services and automated components are explicitly blocked from reaching it; it requires a person, physically present, with multi-factor authorisation, and it preserves a full state archive before ending anything.
That the system cannot reach the end of its own escalation chain is the single most important structural property in the architecture. Everything above that point is the system managing itself. The final step is where it is not permitted to.
Building that capability at all required treating the ability to stop as a feature to be designed rather than an absence to be tolerated — we stopped optimising, and built a way to stop.
Why this principle is last
Because the others exist to make it possible.
A person can only overrule a system whose decisions they can understand, which requires explainability. Explanation requires observations that arrived with their provenance intact, which requires observation before action. Meaningful intervention requires a defined state to intervene toward, which requires governance before intelligence. And the reasoning behind the boundary has to be written down, or the next person to hold it inherits a rule with no argument attached — which is how boundaries erode.
A system that satisfies the first five principles and not this one is well-engineered and unowned. The purpose of the Canon is that it never becomes that.