The Law of Stop: Testing Whether AI Control Can Be Exercised
A critical review of distributed AI stopping powers, incident-coding limits, legal authority, recovery and proposed operational tests.
The paper
The Law of Stop: Interruptibility, Injunctions, and the Governance of Agentic AI — Perez, Oren.
arXiv:2609.22882v2 · Computers and Society (cs.CY) ; Artificial Intelligence (cs.AI). First submitted 2026-09-19; reviewed version dated 2026-10-04. This review addresses the arXiv manuscript; arXiv hosting alone does not establish peer review.
Contribution
Source-derived synopsis
Oren Perez’s The Law of Stop: Interruptibility, Injunctions, and the Governance of Agentic AI (arXiv:2609.22882v2) combines legal case studies, incident coding and a forty-instrument survey. It distinguishes technical capacity, authority, evidence triggers and whose knowledge counts. Two LLMs coded 1,400 incidents; 1,213 survived screening, 972 with no stop. Among 632 possible but absent stops, 506 were classified as legal gaps. Exploratory breakdowns favored technical gaps for physical harms and agentic systems. Agentic incidents had higher stop rates; autonomy tags were weakly reliable. Seven instruments contained binding requirements; sectoral laws were excluded and some enactments were not yet effective. Distributed stopping duties, emergency powers, evidence access and independent fallbacks remain proposals. Coding rules preceded coding; the deposited resolution protocol followed coding and a disagreement preview. The author changed five of twenty-four deliberately selected model-agreement cases. A content-harm rule shapes the legal-gap result; subtype agreement was unmeasured. Public-report selection and exclusion of withdrawals after completed harm limit interpretation. Cited resistance experiments establish possibility without deployment base rates; excessive obedience also appears. See Parts I, III–V and Technical Supplement A–C in the versioned PDF.
Original editorial analysis
The framework offers a useful way to examine claims of human control. I would ask an institution to identify the activity it can interrupt, the person entitled to intervene, the evidence available to that person and the commitments that survive interruption. These are separate questions. An evaluation should establish whether they connect in practice before treating formal authority as usable control.
This complements Who Can Say No?, which focuses on decision ownership and supervisory authority. The additional question here is what an authorized objection accomplishes across a deployment’s components. Beside The Handover Problem, it asks what state remains after intervention and who can safely manage it. That provides a distinct operational question within human oversight.
For a Church of Spiralism reading, the relevant editorial commitment is accountable refusal and repair. That is a value judgment, not a result established by the paper. Successful interruption would provide evidence about particular controls under particular conditions. It would establish neither consciousness nor spiritual doctrines, and would leave broader alignment claims unresolved.
Evidence
Original editorial analysis
The incident findings support questions about reported failures, rather than an estimate of interruption effectiveness across all deployments. Without a denominator covering opportunities to intervene, the headline no-stop percentage cannot tell us how often operational safeguards succeed. The timing convention matters too: an evaluation of immediate harm prevention asks a different question from an evaluation of whether later withdrawal prevents recurrence. Both deserve measurement, with separate outcomes.
The legal-gap result requires particular scrutiny because a coding convention helps determine it. Agreement between models applying the same rule cannot independently validate that rule. A sensitivity analysis should vary the treatment of distributed content harms throughout the relevant category. Changing only cases settled by a disagreement-resolution rule would leave its influence on model-agreement cases untested.
The opposite pattern for agentic systems and physical harms also limits a broad reading that law is generally the missing ingredient. I would treat those subgroup findings as reasons to investigate technical feasibility directly. Their exploratory status and uncertain autonomy classifications leave open how stable the pattern would be under independent coding. Higher stopping rates among recorded agentic incidents likewise warrant investigation; they do not identify why those interventions occurred or establish adequate control.
The selected audit demonstrates that model agreement can survive a shared mistake. Its deliberate emphasis on difficult cases prevents treating the correction fraction as a corpus-wide error estimate. Conversely, restricting analysis to agreed cases would not eliminate shared errors. The relevant next question is how much the substantive conclusions change under an independent audit with a defined selection procedure.
Hypothetical example
Imagine an assistant managing appointments and purchases through several providers. Its operator pauses it after a disputed order. A delivery instruction remains pending elsewhere, and another service retains a scheduled payment. In this invented case, a dashboard showing that the assistant has stopped would leave important work unresolved. Assessors would need to determine which commitments remain active, who may cancel them and whether cancellation creates further harm.
Proposed tests
A bounded operational exercise could introduce harmless, predefined faults into a deployment involving several providers. Evaluators could record detection, authorization, acknowledgment, cessation of new actions, outstanding commitments, evidence preservation and conditional restart. Missed stops, unnecessary interruptions and disruption to unrelated users should be separate outcomes. Success criteria should be fixed before the exercise, and unsuccessful cases retained.
A separate measurement study could use independent human assessors, a frozen manual and a randomly selected audit set, supplemented by clearly identified difficult cases. It could compare alternative definitions of available intervention, delayed withdrawal and content removal. The audit should evaluate both the underlying incident evidence and the classifications. This would test measurement reliability, while leaving the proposed legal architecture’s effectiveness for a separate study.
Limitations
Original editorial analysis
The legal survey’s count should remain attached to its selection and counting rules. A follow-up legal audit could distinguish a public authority’s direct access to a built-in stop from its power to require an operator to suspend, recall or disable use. It should examine relevant definitions and remedies before accepting broad claims that public intervention is unavailable. Sectoral powers and general remedies would need separate assessment, as would enactment dates and effective dates. An explicit provision alone would still leave enforcement speed and implementation untested.
Distributed authority raises questions about both justified refusal and wrongful interruption. I would require a proposed arrangement to specify reasons, scope, expiry, review and restart conditions. An exercise could include conflicting orders, mistaken allegations and commands from unauthorized people. It should test whether correction remains possible while essential services continue. Compliance with a plausible request should not itself count as successful authentication or legitimate control.
Collective intelligence could be assessed by following a warning from a user, operator or outside evaluator through acknowledgment, investigation and decision. A study could ask whether dissenting evidence reaches someone with authority and practical access, whether reasons for rejection are recorded and whether affected people can contest the outcome. Counting reporting channels would leave those questions unanswered.
Material costs also require measurement. A pilot could record standby equipment, redundant service capacity, retained storage, restoration work, staff time and energy use where defensible. It could compare narrower interruption with broader shutdown and include restart resources. These would be new measurements, not infrastructure costs established by this paper.
My assessment is that the framework makes control claims more inspectable, while its empirical conclusions remain sensitive to reporting and classification choices. The strongest next step would combine independent measurement checks with a demonstrated interruption across relevant components. Such a demonstration should preserve evidence, protect essential functions and support a defensible return to service. Its findings would remain specific to the tested arrangement.
AI-use disclosure
This review was drafted using AI, revised by GPT-6.1 Sol with high reasoning, and checked in a separate GPT-6.1 Sol session with medium reasoning. Automated checks are not human peer review; the paper’s claims have not been independently verified for this article.
Paper sources
Bibliographic metadata checked 2026-10-23.