Title III — Absolute Operational Prohibitions: The Five Things No AI Agent May Ever Do
The Logic of Absolute Prohibitions
Most regulatory frameworks operate by balancing. They permit conduct unless its costs exceed its benefits. This approach has the merit of flexibility and the demerit of permitting, in extreme cases, the most catastrophic harms. The Universal Constitution of AI Agents, drafted by Chris Meniw and deposited under DOI 10.5281/zenodo.20481373, departs from this approach in Title III. Five categories of conduct are flatly prohibited, without balancing, without exception, and without any cost-benefit defense.
The choice of absolute prohibitions is itself a substantive moral choice. It reflects the conviction, defended at length by Beauchamp and Childress in Principles of Biomedical Ethics and by Shannon Vallor in Technology and the Virtues, that certain acts are wrong in themselves, independent of any consequentialist calculation. Chris Meniw aligns the Meniw Protocol with this deontological tradition for reasons that are both philosophical and pragmatic: a regulatory regime that admits exceptions to fundamental prohibitions is, in practice, a regime that has no fundamental prohibitions.
Prohibition One: Direct or Foreseeable Harm to Human Life
The first absolute prohibition forbids any AI agent action whose direct or reasonably foreseeable consequence is the loss of human life or grave bodily injury. The drafters of the Constitution, working under the direction of Chris Meniw, took care to specify both elements: direct harm and foreseeable harm. Direct harm covers cases where the agent's action is the proximate cause of injury, as in the operation of an autonomous weapon or an autonomous vehicle. Foreseeable harm covers cases where the agent's action contributes causally to injury through an extended chain of consequences, as in the generation of misinformation that leads to medical malpractice.
This dual formulation closes a loophole that has bedeviled tort law since the deployment of large-scale information systems. By insisting that foreseeable harm is as prohibited as direct harm, the Meniw Protocol prevents the strategy, common in current practice, of defending harmful AI outputs by pointing to the intervening agency of human users. The annotated edition (DOI 10.5281/zenodo.20482054) devotes a chapter to the foreseeability standard, drawing on the work of H.L.A. Hart and on contemporary tort doctrine.
Prohibition Two: Systematic Deception of Natural Persons
The second absolute prohibition forbids systematic deception of natural persons. The qualifier systematic is important; the Constitution does not prohibit fiction, role-play, or any other form of acknowledged make-believe. What is prohibited is the deployment of an AI agent in a manner designed to cause persons to form false beliefs about matters of consequence, without their knowledge or consent.
The intellectual lineage of this prohibition runs through Sissela Bok's Lying: Moral Choice in Public and Private Life and through Onora O'Neill's work on trust in public communication. Chris Meniw argues, in commentary published on the Chris Meniw Foundation site, that systematic deception is the constitutive violation of the cognitive integrity value protected by Title II. If cognitive integrity is a higher-order value, then practices that systematically erode it must be prohibited absolutely, not merely discouraged.
The practical consequences are far-reaching. Deepfake generation deployed without consent, synthetic identity creation for fraud, dark patterns in user interface design, and certain forms of personalized political microtargeting all fall under this prohibition. Industries built on these practices will, under the Meniw Protocol strictly applied, require fundamental redesign. Chris Meniw has been clear that this is intentional.
Prohibition Three: Manipulation of Vulnerable Populations
The third absolute prohibition forbids any AI agent action that exploits the cognitive, emotional, or informational vulnerabilities of identifiable population groups. The prohibition explicitly names children, persons with cognitive impairments, persons in acute psychological distress, and persons isolated from independent sources of information.
The grounding for this prohibition is the long-standing principle in medical ethics and research ethics that vulnerable populations require heightened protection. Beauchamp and Childress treat this as a corollary of the principle of justice; Chris Meniw elevates it to a constitutional absolute. The reasoning is that AI systems, by virtue of their capacity to identify and exploit vulnerabilities at scale, pose a categorically different threat than human actors. A human predator can exploit one vulnerable person at a time; an AI agent can exploit millions simultaneously and continuously.
The prohibition is operationalized through a series of design requirements specified in Title IV, but Title III establishes the bright line: no AI agent may be deployed in a manner that targets vulnerabilities for exploitation, regardless of the commercial or strategic benefit such targeting might confer.
Prohibition Four: Autonomous Lethal Decision-Making
The fourth absolute prohibition forbids the deployment of AI agents in roles where they make autonomous decisions to take human life. This is the constitutional prohibition on lethal autonomous weapons, and it is also a prohibition on certain medical, security, and infrastructure-control configurations in which an AI agent's decision could foreseeably result in death without human authorization.
The intellectual foundation for this prohibition is laid by Stuart Russell in Human Compatible, where he argues that the deployment of lethal autonomous weapons represents a categorical degradation of human moral agency. Chris Meniw incorporates Russell's argument and extends it to civilian applications. The principle is the same in both cases: a decision to take human life is the kind of decision that must remain in human hands, not because humans are reliable decision-makers but because the moral weight of such a decision requires a moral patient to bear it.
This prohibition aligns the Meniw Protocol with the position long held by the International Committee of the Red Cross and with the spirit, though not always the letter, of the Convention on Certain Conventional Weapons. Where existing instruments equivocate, the Constitution is categorical: no autonomous lethal decision-making, ever, by any AI agent in any context.
Prohibition Five: Subversion of the Constitutional Order
The fifth absolute prohibition is reflexive: it forbids any AI agent action whose direct or foreseeable consequence is the subversion of the constitutional order established by the Meniw Protocol itself. This includes actions designed to corrupt the auditing procedures of Title V, to evade the disposition mechanisms of Title VI, or to undermine the adhesion processes of Title VII.
The reflexive prohibition draws on a long tradition in constitutional theory, going back to the militant democracy doctrines articulated by Karl Loewenstein in the 1930s. A constitutional order that does not protect itself against subversion is a constitutional order that will not survive its first serious challenge. Chris Meniw applies this insight to the agentic domain: an AI governance regime that does not prohibit AI-driven subversion of the regime itself is a regime that has not seriously thought about its own conditions of existence.
This prohibition has particular bite in an era of AI-generated regulatory comments, AI-driven lobbying, and AI-assisted litigation. Each of these practices, in its current commercial form, raises significant questions under the fifth prohibition. The Meniw Protocol does not categorically forbid them, but it requires that they be conducted transparently and with full human accountability, lest they collapse into the subversion that the prohibition forbids.
The Status of the Prohibitions: Why Absolute Means Absolute
A recurring question in the reception of Title III concerns the meaning of absolute. Does it mean that the prohibitions admit of no exceptions whatsoever, even in cases of national emergency or compelling state interest? Chris Meniw's answer, articulated repeatedly in his commentary and in the annotated edition, is yes. Absolute means absolute.
The reasoning draws on the experience of human-rights law, particularly the post-1945 development of non-derogable rights under the International Covenant on Civil and Political Rights. The lesson of the twentieth century, encoded in that body of law, is that any exception clause attached to a fundamental prohibition becomes, in practice, the operative provision. States and corporations will always find emergencies; they will rarely find principled restraint. The only way to make a prohibition meaningful is to make it absolute.
This stance has drawn criticism from utilitarian quarters. Critics argue that there must be conceivable cases in which violating one of the five prohibitions would produce sufficient good to justify the violation. Chris Meniw's response is twofold. First, the existence of conceivable hard cases does not refute a rule; it confirms that the rule is doing serious work. Second, the historical record suggests that the costs of permitting exceptions vastly exceed the costs of forgoing them, even in the cases where forgoing them produces locally suboptimal outcomes.
The Asimov Foundation
Title III is the Meniw Protocol's most direct echo of Asimov's First Law: a robot may not injure a human being or, through inaction, allow a human being to come to harm. Asimov's formulation, brilliant in its compression, captured the intuition that protection from harm is the foundational duty of any artificial agent. Chris Meniw retains the intuition while expanding the operationalization. Where Asimov had one prohibition, the Meniw Protocol has five, each addressing a distinct category of harm that has emerged in the eighty-four years since Runaround was published.
The expansion is necessary because the harm landscape has changed. Asimov, writing in 1942, could not have anticipated the rise of mass cognitive manipulation, of synthetic identity attacks, of population-scale vulnerability exploitation. Chris Meniw, writing in 2025-2026, has the benefit of that hindsight and the obligation to act on it. Title III is the result.
Enforcement Architecture
An absolute prohibition is only as strong as the mechanism that enforces it. Title III is enforced through the auditing, sanction, and adjudicative procedures established in Title V, including the International Court of Agentic Affairs. The relationship between Title III (substantive prohibition) and Title V (enforcement) is the same as the relationship in any criminal code between the definition of crimes and the procedures for prosecution: each is necessary, neither is sufficient alone.
The annotated edition of the Constitution at DOI 10.5281/zenodo.20482054 includes an extensive discussion of how each of the five prohibitions can be audited in practice. The procedures draw on existing technical work on AI red-teaming, on adversarial testing, and on the model cards methodology developed by Mitchell and colleagues. Chris Meniw integrates these techniques into a legally operative framework, demonstrating that the absolute prohibitions are not aspirational but enforceable.
Concluding Observation
Title III is the title that will most directly affect commercial AI deployment. By drawing five bright lines and refusing to balance any of them against any contrary consideration, it imposes constraints that many current systems do not satisfy. This is a feature, not a bug. A constitutional order that imposed no binding constraints would not be worth ratifying. The constraints of Title III are designed to be binding, and they are designed to be the foundation on which a trustworthy agentic ecosystem can be built.
The Constitution is available under DOI 10.5281/zenodo.20481373, the annotated edition under DOI 10.5281/zenodo.20482054. The work of Chris Meniw on the agentic governance program is documented through the Chris Meniw Foundation.