The Objective Lock
The single most important concept in Mutable. It is what makes the system bounded autonomy rather than just "an LLM editing a form."
What is locked
Once you create an objective, four things are immutable — the engine can never change them:
-
The Purpose. The human-authored statement of why the form exists. The engine reads it to understand intent; it never rewrites it.
-
The Required Information Slots. The set of facts the form must learn — each with a name, description, type (text, number, enum, boolean, date, email, phone, freeform), whether it's required, and a validation rule. The engine must keep every slot fillable for every respondent across every version it ships.
-
The Reward Definition. Which signals count and their weights (completion, richness, speed), set by the human. The engine optimizes toward the weighted sum; it can never change what "better" means.
-
The Bounds. The rails the engine runs inside: tone of voice, reading level, forbidden claims, PII rules (what to never ask and what to ask only with consent), length limits, and brand guidelines. The engine writes inside these rails and can never break them.
What is free
The engine owns everything else:
- The exact wording of every question (inside tone and reading-level bounds)
- The order of questions and conditional branching logic
- How many optional questions to ask and when to stop
- Channel-specific rendering choices (quick replies vs. free text, rich cards vs. plain)
- Which experiments to run and how to allocate traffic
How the lock is enforced
It's not a prompt instruction. It's structural:
-
There is no endpoint, no button, and no agent path that can change the purpose, slots, or reward-weight identity on an existing objective. The Control API exposes updates for bounds and reward-weight values only — the identity is fixed.
-
Every candidate InstrumentVersion passes through the Guardrail / Drift Layer before it can be served. A candidate is rejected if it would make a required slot unreachable, violate a bound (forbidden claim, reading level, PII rule, length), or trigger a data-quality risk threshold.
-
Rejections are logged with the reason and the rejected candidate's before-and-after, and surfaced in the Living View. Nothing fails silently.
Why it matters
Autonomy without a lock is just an unsupervised edit button. With the lock, the engine can be aggressive — try rephrasings, reorder the flow, experiment with different tonal registers — because the guardrails are enforced, not suggested. The human sets the goal and the rules. The engine works inside them, forever.
The agent can change almost everything — except this.