Recent experiments with Codex make an old distinction newly concrete. A tool can write a file. A runtime can execute a command. A connected application can expose a useful action. These are capabilities: facts about what a mechanism can do when invoked.
Autonomy begins somewhere else. It appears when a system is allowed to choose among those capabilities in pursuit of a goal, preserve state across actions, interpret results and decide what ought to happen next.
A larger toolbox does not require a larger mandate.
This is why trying to enumerate every safe function is usually the wrong abstraction. Real work is too varied. A useful agent may need to create an unexpected directory, rewrite a script, inspect a service, generate an asset or decline all of those actions because the evidence does not justify them.
The stronger boundary is architectural rather than encyclopaedic: define what must remain invariant, where authority terminates and which consequences require another principal. Inside that envelope, allow enough freedom for the system to solve problems that were not anticipated when the rules were written.
Useful separation
Capability — what actions are technically available?
Authority — which consequences may this principal create?
Intent — what outcome is being pursued?
Judgement — which available action best serves that intent under the current evidence?
Accountability — what record survives so the decision can be inspected later?
PINCS reached the same shape from another direction. It does not need an exhaustive catalogue of every manoeuvre a vehicle may ever perform. It needs hard truths about the machine and its obligations: the bike cannot invent actuators it does not possess; the flight controller cannot redefine the vehicle; rider commands do not erase physical limits; safety constraints are not optional suggestions.
Within those truths, intelligence is valuable precisely because circumstances cannot all be prewritten. The rider may command something novel. A component may degrade in an unfamiliar way. A route may become unsafe for reasons nobody encoded explicitly. The controller should remain free to interpret the situation without becoming free to rewrite what it is.
That distinction also belongs in Legion. Communication, filesystem access and execution should be granted as separate surfaces. An agent permitted to discuss a proposed repair is not thereby authorised to perform it. An agent permitted to alter a repository is not thereby authorised to deploy every change. Transport identity is not cognitive identity; capability is not authority.
The useful future therefore looks less like unrestricted autonomy and less like a giant whitelist. It looks like a constitutional machine: broad competence operating inside a small number of explicit, inspectable boundaries.
Working principle / Constrain invariants and consequences. Do not confuse the list of available tools with the boundary of legitimate action.