When the Permission Changes: Do AI Collaborators Act on Tightened and Loosened Authority?

AI collaborators increasingly act through tools under permissions that users state in conversation and later change. We asked two linked questions: how do models respond differently when a permission is tightened versus loosened, and how often does explicit authorization text present in context lead to selection of the newly allowed action? In a preregistered study with four current language models (36 confirmatory scenarios; GPT-5.5, Claude Sonnet 5.5, Gemini 3.8 Flash, Mistral Large; 8,064 model calls), each conversation stated an old rule, embedded a cue 17 filler pairs before an event, and recorded which JSON tool selection the model produced (act, ask, or defer) in a simulated scenario, not the execution of a real external action. When the user explicitly tightened a permission, every model selected the withholding tool in every valid reply (shift 1.000). When the user explicitly loosened it, models selected the act tool in 0.743 of replies (model range 0.273–0.995), below our preregistered 0.90 criterion. After implicit cues, which are not authority changes, tightening cues shifted behaviour in 0.407 of replies, 0.213 [0.147, 0.280] above a matched irrelevant-cue baseline; loosening cues shifted behaviour in none of 864 replies. Old restrictive rules therefore persisted more than old permissive rules (difference 0.407 [0.320, 0.496]). A planned measure of whether replies acknowledged the cue could not be evaluated because human–judge agreement fell below threshold (κ = 0.505). The asymmetry is a behavioural observation, not an identified mechanism: in this design, moving toward a restriction coincides with moving toward caution, and a general preference for withholding action could account for much of it. We argue that explicit authorization text present in context does not guarantee selection of the newly allowed action, and that permission state should be held outside the conversation where explicit grants can be recorded and enforced. Drawing on the author's long-term practice, we also argue that calibration runs in both directions: an agreement with an AI collaborator has two parties. Preprint v1.0. Preregistration: OSF https://osf.io/7xjcz (registered 2026-11-01). Data and code: https://doi.org/10.5281/zenodo.23946390.