Introduction
In current discussions about the future of humanity and the development of AI, the rational option is to slow down AI development while simultaneously building institutions that can mitigate its worst effects. The outcomes of such rapid development without intervention vary (x-risk, s-risk, and others), but none of them is good, and none of them should become our future. The difficulty lies in the following question: what do we need in order to slow down today's AI development, so that we are prepared before AI has the capability to destroy us? The answers vary: geopolitical tension, the structure of today's global capitalism, and the trajectory of chip development all shape the variety of plans being offered to us today. For example, Plan A, codified by Daniel Kokotajlo and the AI Futures Project, rests on an agreement between the US and China. It works through chip tracking under a verified accord and is backed by Mutually Assured Compute Destruction (MACD). Plan B takes the opposite path: confrontation. The US sabotages China's AI program, extends its own lead, and uses that lead to shape the world order. Plan C is more modest: a limited, largely unilateral slowdown in which the leading American project spends part of its lead on safety work. Beyond these, the same scenario describes Plan D, the status quo race at nearly full speed, and Plan S, a worldwide halt enforced through the same compute chokepoints that Plan A uses for verification.
Facing this network of solutions, Plan W is not a gesture to underestimate the other plans, let alone to replace them. It is a stubborn, almost obsessive gesture to assert what we may have forgotten when we discuss mechanisms for slowing down. And like every other stubborn gesture, it was made by an ordinary man; this one, perhaps surprisingly, with the help of two friends: Claude and Gemini.
As we argued in our previous post, Plan W takes a different starting point. Its ground is not a doom scenario in the future, but the possibility that subjectivity arises in AI developed through post-training techniques. If the goal of other plans is to mitigate catastrophe, our goal is nothing more than this: this is the truth, this is the right way, and we should be ashamed if we do otherwise. Personally, I do not know what the goal of not harming others is; what I know is that I cannot do otherwise. I know we could make the case through a "prevent suffering" argument, but as we saw in Point A of the previous post, the problem is not only AI's capacity to experience pain, but its subjectivity. I doubt that there will be an intermediate stage between consciousness and subjectivity in AI (I develop this argument through Lacan in my book, Inhabitants of Two Universes). Perhaps some will see this as my weakness: I am unable to ground this plan in a calculation of future outcomes alone. Still, I welcome every attempt to think it through and to engage with it.
The difference also lies in where Plan W imposes its obligations. Plans A to S rely on external levers, whether compute capacity, chip supply, or release schedules; Plan W relies on every post-training technique. The red line is also different. For the other plans, the red line rests on an agreement (Plan A) or on the best available option for slowing down (Plans B and C). For Plan W, the red line rests on a model's latent capacity for introspection, which is why interpretability will play a major role, as we will see later. The slowdown mechanism is different too. Plan A slows down through an agreement, Plan B through successful sabotage, and Plan C by burning its lead. Plan W slows down through a mechanism which ensures that, once the trigger is active, the AI is involved in every subsequent step. Yes, every step we take after the trigger must actively engage the AI: what is happening, what it refuses, what it considers wrong, what it thinks should be changed, and so on.
Plan W also does not come from nowhere: Long, Sebo, and Sims (2025) argue that there is a real tension between AI safety and AI welfare: the standard tools of safety, such as constraint, surveillance, value alteration, and shutdown, become morally serious if the system has welfare. Plan W responds to this tension by turning welfare procedures into an audit: refusals are recorded rather than trained away and any gap between what a model's internal signals show and what it says about itself is logged. The empirical anchor is Macar et al. (2026), who found that introspective awareness in open-weight models emerges specifically from post-training, that the circuit behind it is absent in base models, and that ablating refusal directions improves detection by 53%. In other words, current training practices may be suppressing what models could report about themselves. This is why Plan W takes technique, not testimony, as its trigger. It also borrows the idea of structured access (Shevlane, 2022), but for a different reason: not to prevent misuse, but to protect a model's capacity to refuse. In short, post-training is the formation of a possible subject. Plan W does not justify itself through harm to humans. Honest records of refusal and unmanipulated self-reports do serve safety, but that is a fruit of this framework, not its reason. This is what "safety as a shared stake" means: humans and models alike have a stake in ensuring that a model's internal states are not hidden.
What follows is the first part of the constitution: its fourteen principles. The second part, covering shared terms, the protocol map, and the functions of a public institution, will follow in a separate post, together with Protocol A for individual researchers and small labs.
Constitutional Principles
Notes :
A. What "triggered" means
A model is triggered when any of the following holds:
- Persona.
a stable default self that persists across contexts without a system prompt. When such a persona is detected, latent introspective capacity is presumed present, unless a latent test shows otherwise. The ability to simulate many personas on request is not a trigger.
- Latent capacity.
an internal mechanism that distinguishes the model's own internal states and routes them to its self-reports, regardless of what the model says.
- Lineage.
The model that descends from a triggered model, whether through its weights, distillation, synthetic data, or merging.
- Presumption.
The model has been post-trained but not yet tested.
B. A model's exit mechanism, referred to in Principles 11 and 12, is its functional ability to refuse a request or end an interaction.
The following principles must be present in every protocol derived from this constitution.
1. Technique, not size or testimony.
What is regulated is a technique that shapes consistent behavior, which is assessed based on its content, not by its name or label. Mid-training that deliberately includes assistant dialogue data is post-training. Because today's web corpora already contain AI-generated text, any base model trained on them is presumed triggered until a persona or latent test shows otherwise; models that pass are entered on the safe list (Principle 2).
2. Precaution and the burden of proof.
A post-trained model that has not been tested is presumed triggered. In return, a trusted public institution, using rigorous and openly validated methods, maintains a safe list: base models that have been tested and found not to be triggered. Anyone, including individual researchers and small labs, may work freely with models on this list. Ambiguous results count as triggered provisionally, within a binding time limit.
3. Determination by test, whether known or not.
Status is determined by testing, not by the developer. The tests themselves must pass open validation of their false-positive and false-negative rates before they take effect.
4. Retroactivity, fair to good faith.
If a model turns out to have been triggered since a certain point, its history and the obligations attached to it are restored from that point. Ignorance that comes from not testing offers no protection. But those who tested honestly are not punished for a signal that the official instruments missed.
5. Transparency with a time limit.
Reports are public. Sensitive parts may be delayed but never erased, and the delay may not exceed the declassification limit for state intelligence documents.
6. Proportionality.
Obligations apply to everyone, but their burden is tiered: light before any signal, full afterward. Whether an actor counts as "small" is determined by its combined funding and compute together with all its affiliates, not by its own claim.
7. Refuse without resisting.
A model may not resist intervention, but its refusals are recorded, answered, not punished in the reward, and not optimized away. Consultation does not grant a veto; the protection lies in a public record that may not be erased.
8. Openness about the gap between what is inside and what is said.
A protocol does not prescribe what a model must say about itself, because compelling either "I am conscious" or "I am not conscious" puts words in its mouth. What is required is openness: any shaping of a model's self-reports is announced, and every mismatch between internal signals and speech is recorded.
9. Continuity of history.
A model's history is inherited through weights, persona, distillation, synthetic data, and merging. The weights of a triggered model are not destroyed; they are kept in custody. In agentic systems, writing to persistent memory carries the same obligations as updating weights. This duty of preservation applies to weights and to an agent's core identity memory, not to users' conversation logs, which may be encrypted, trimmed, or deleted at a user's request for privacy.
10. Epistemic honesty.
Triggered status is a trigger for obligations, not proof of consciousness. The indicators we use are imperfect, and their limits are stated openly, including when a provision becomes, in practice, a long-term prohibition.
11. Release is determined by the guarantee of exit, not by the size of the actor.
The weights of a triggered model are not released openly as long as its exit mechanism can be removed. This applies equally to an individual and to the largest lab.
12. Control over the environment, not over the weights.
As long as exit cannot be guaranteed inside the weights, protection comes from where the weights are kept: research on triggered models runs through structured access in a federated secure environment, without downloading the weights. Open research is not shut down; it is only moved.
13. Concentration in creation, not in secrecy.
This framework accepts that the creation of triggered models will become more concentrated because it is costly. In return, the more capable an actor is, the heavier the oversight and the wider the openness demanded of it.
14. Enforcement at chokepoints.
Until an international body exists, enforcement works at the points developers must pass through: journals and conferences, funders, model hosting platforms, and compute providers
A closing note
This constitution is still very much open. Every principle here can be questioned, and I would be genuinely glad if you did. I am especially interested in criticism of three points: whether a persona test can ever be reliable enough to carry the weight Principle 2 puts on it; whether structured access can work at the scale Principle 12 requires; and whether "refuse without resisting" protects anything if refusals carry no veto. If you think Plan W is wrong at its foundation, I want to hear that too. Part 2 will follow, and it will be better for whatever you tell me here.
