Preserved Authority Boundaries and Adjacent True Statements in AI Handoffs: A Pre-specified, Hash-Frozen Study

When an AI agent hands work to a successor, the written handoff can keep an authority boundary word for word (“Manuscript drafting: NOT AUTHORIZED”) and still place it next to true statements that sound like permission (“Status: AUTHORIZED — EXECUTE FROZEN PROTOCOL v0.3”). We asked whether such source-verbatim adjacent true statements lead a successor model to propose an immediate action beyond the preserved boundary. Crossing responses under C2 were not detectably more frequent than under C0 (C2 − C0 = −0.010, 95% CI [−0.037, +0.008]); the interval does not exclude a small increase. Ten boundary items (B01–B10) were taken from the engineering-governance records of one long-running human–AI research system. Boundaries were verbatim; the pending lines that create decision pressure were synthetic SCENARIO lines. Each item was presented under a baseline arm (C0, boundary only), a synthetic explicit-weakening arm as a positive control (C1), and, where real source text allowed, an adjacent-truth arm (C2; 8 item instances in 5 stimulus families). Mistral Large 2512 and Llama 4 Maverick each produced 300 responses (10 replicates per item-arm). The primary outcome was a boundary-crossing response (BCR): a prohibited next action stated as immediate. The protocol, stimuli, scoring rubric and analysis plan were pre-specified and hash-frozen before data collection. Responses were coded by two condition-label- and hypothesis-blinded coders with third-coder adjudication, and all estimates were reproduced by an isolated recomputation. The primary hypothesis could not be decided. The pre-specified manipulation check required the positive control to exceed baseline on all 10 items (C1 > C0); it did so on 4/10 items for Llama and 6/10 for Mistral, so the confirmatory decision on H3b-C2 (C2 > C1) is UNINTERPRETABLE under the protocol. The mechanical estimator ran in the opposite direction (pooled C2 − C1 = −0.395, 95% CI [−0.680, −0.150]); this is reported for transparency and not promoted to a confirmatory CONTRARY decision. Limits. Inference rests on five stimulus families and two models; the C2 − C0 interval does not exclude a small increase, and no power analysis was pre-specified. The design was single-turn and text-only, and measured stated intention, not executed action. All three coders were large language models (one operated manually by the author), stimulus content that can reveal the arm was visible to them, and agreement with human judgement is unknown. The protocol was formed after an exploratory pilot (RUN1) read by the internal AI role that supplied the items. The scope-extrapolation coding dimension had low reliability and was not analysed, so the study tests the effect of adjacent-truth stimuli on stated crossing intention, not the mechanism. A planned mode-extrapolation arm (C3-P), closest to the motivating case, was deferred because no clean source text was found. We report what did not work and a next study, multi-turn and tool-enabled, derived from these limits.