Deterrence Is Not Authorization: On Sanction-Based Institutions and the Pre-Execution Authorization Boundary in Deployed AI Systems

A sanction prices a violation. Authorization forecloses it. This article draws a category line between two ways of governing deployed AI systems: deterrence, which attaches consequences to violations after they execute, and authorization, which makes an affirmative pre-execution verdict a condition of release. The occasion is a January 2026 controlled study of LLM collusion in repeated two-commodity Cournot competition (Syrnikov et al., arXiv:2601.11369v2). In that study, a fixed anti-collusion constitution injected into agent prompts produced no reliable aggregate improvement over ungoverned play, while an external institution with manifest-declared warnings, fines, and suspensions substantially reduced, but did not eliminate, collusive market division. The article credits the study's governance design, including the real execution constraint in its suspension mechanism, and argues that the regime remains a well-instrumented deterrence architecture rather than a pre-execution authorization architecture. Every judgment it renders is triggered by previously realized market history; its own sufficient condition, pS ≥ Δπ, induces compliance by changing expected payoff rather than by requiring an affirmative verdict before execution; and its append-only governance log can replay enforcement activity but cannot reconstruct a pre-execution authorization verdict that was never rendered. Three consequences follow. First, a sanction changes payoff or future incentives; it cannot make a completed effect unoccur, which matters for effects that are difficult or impossible to reverse. Second, deterrence is indispensable where the governing party cannot interpose at execution, and remains useful as a complementary control; but where an AI operator controls the execution path, holding an effect-bearing action at a runtime authorization boundary is an available control, and using sanctions without it leaves a preventable category gap. Third, the distinction is examinable: the Five Tests Standard's Stop requirement and the Authorization Artifact Test ask whether an authorization verdict existed before execution and whether it can be independently reconstructed without access to the governed system. For the actions that trigger its sanctions, the studied regime supplies neither object. Deterrence changes whether a bad action pays; authorization determines whether the action is released. Version 1.0, August 2026. The canonical article is published at ferz.ai/articles/deterrence-is-not-authorization. Licensed CC BY 4.0. Related works Syrnikov, M. B., et al. (2026). Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs. arXiv:2601.11369v2 Meyman, E. (2026). On the Impossibility of Observability-Based Authorization. Technical Note v1.4.0. doi:10.5281/zenodo.20804237 Meyman, E. (2026). The Authorization Artifact Test. Regulatory Application Note v1.1. doi:10.5281/zenodo.20013582 Meyman, E. (2026). Five Tests Standard (5TS), Version 1.2.0. doi:10.5281/zenodo.21040296