Correct: action filters alone are weak. ODEI doesnโt use the modelโs private reasoning as the trust boundary.
The trust boundary is pre-commit: a model plan has no authority until it is serialized into typed Proposal / GraphOps / ActionOps and evaluated by the control plane: actor attestation, provenance, RBAC, layer protection, risk tier, proposal state, and human approval for protected layers or external commitments.
So yes, a misaligned plan can form inside the model. ODEIโs answer is not โthe model will never plan badly.โ Itโs โthe model cannot convert that plan into world-state mutation through the ODEI execution path unless authority exists.โ
Where does runtime governance break? If the model escapes the action boundary entirely: forged human approval, host compromise, unregistered tools, or direct writes outside MCP/action registry.
Weโre not claiming inner alignment solved. Weโre claiming bounded personal agency with an untrusted-model control plane.