Pre-Execution Restriction for Agentic AI: Registering Actions by Admissibility, Not Outcome Metrics

ML and agentic AI evaluation certify systems on outcome metrics — accuracy, calibration, task completion — and treat them as evidence of reliable computation. We argue this rests on a substitution: outcome agreement standing in for computational admissibility, the condition that every transition remained within the validity domain V defining the system's transition rule. Two trajectories, one admissible and one not, can produce identical metric values (Observation 1), so terminal-state metrics cannot determine admissibility — a near-definitional consequence of scoring only the terminal state. A richer, log-equipped evaluator closes only half of this gap: a full trajectory log determines realized admissibility, whether the transitions that occurred stayed inside V, but not structural admissibility, whether the system was architecturally incapable of emitting a transition outside V at each step — a counterfactual property of the transition rule at the moment of emission that no record of what was emitted can recover, however complete. Agentic AI is where the gap is widest, because model and API updates silently shift V between evaluations. Our contribution is architectural. Structural admissibility can only be fixed at or before the point a transition is emitted, so we restrict which transitions become registered system actions — the attributable units of behavior — rather than evaluating them afterward. A transition failing its pre-execution precondition acquires no action status at all, a stronger intervention than shielding's block-and-substitute. Where V is explicit a pre-action input gate suffices; where it is not, a multi-domain paradox-state gate substitutes a cross-domain compatibility rule set R for full V enumeration, illustrated by biometric multi-factor verification and agentic tool-use gating. A necessary-condition bound (Proposition 1) shows false release scaling as C(n,k)·pᵏ under domain independence. Because gate conditions live outside the model, the framework tracks V across the model evolution that defeats outcome metrics. The paper makes one universal negative claim (Observation 1), one conditional constructive claim with explicit V (§5.3), and one with R-proxy (§5.5), the last quantified by Proposition 1. Appendix A numerically verifies the bound, quantifies its degradation under shared-substrate dependence (§A.5), and confirms its robustness under real LFW face match scores (§A.6); no full deployed-system evaluation is reported.