Steering a Frozen Model: Two Hard Limits

One way to enforce a policy on a model, without retraining it, is to steer the model's internal activations as it runs; the motivating application is language-model safety. Because the policy is not part of the weights, it can be revised or replaced without updating them, and one fixed model can be governed by different policies at different times. Whether such enforcement succeeds, though, is largely uncharacterised. We argue that it rests on three conditions, and we characterise each. The model's existing read state must imply the correct target (Read); a finite intervention budget must be able to reach that target (Reach); and later edits must preserve the dependencies the result rests on (Preserve). Two of these are hard limits, a ceiling and a horizon that no amount of tuning passes; the third, Preserve, is a failure of compositional integrity rather than a wall. We treat each condition formally where its object is exact and empirically where it must be measured. For Read, under a frozen, read-immutable regime with a deterministic hard read and writes restricted to the target, an exact operator identity fixes a ceiling on the accuracy of complete enforcement; we confirm it across a grid of 27 independently trained models whose ceilings span a 42-fold range, matched to within 0.0008. For Reach, we characterise the horizon of a globally bounded additive correction under a finite budget, and measure it on real activations from Qwen2.5-7B and 32B. For Preserve, protecting only the coordinates a constraint writes worsens an earlier constraint by 19 to 27 times, whereas protecting the read-write dependencies restores it exactly. In controlled continuous-versus-discrete comparisons on this task, a continuous-time substrate confers no enforcement advantage, and one inside-dynamics configuration destabilises enforcement. We give a scoped account of when in-model enforcement on a frozen model works and where it fails.