Asimov's Three Laws in the Age of AI Agents
Last Updated: September 10, 2026 | By Mihail Sebastian | Laws of AI
Asimov's Three Laws cannot be compiled into code, yet their shape survives in AI agents: instruction hierarchies, guardrails, and tested human override.
Isaac Asimov’s Three Laws of Robotics are the most famous AI safety rules ever written, and they were never meant to work. For decades the standard verdict was that they are fiction: elegant, unimplementable, irrelevant to real software.
That verdict aged badly. Software now acts instead of just answering, and the questions Asimov dramatized in 1942, which rule wins, what counts as harm, when a machine should refuse or stop, are the working agenda of AI governance.
Here is what the Laws say, why you still cannot program them, and what they quietly turned into.
The Three Laws, and What Everyone Forgets
The Laws first appeared in “Runaround”, a short story published in 1942.
First Law: a robot may not injure a human being or, through inaction, allow a human being to come to harm. Second Law: a robot must obey human orders, except where they conflict with the First. Third Law: a robot must protect its own existence, as long as that conflicts with neither of the first two.
What everyone forgets is that Asimov did not write stories about the Laws working. He wrote stories about them failing. “Runaround” itself is a failure report: a robot named Speedy is casually ordered to fetch selenium on Mercury, meets unexpected danger near the selenium pool, and stalls in a loop, because a weakly given order (Second Law) balances exactly against the threat to his own existence (Third Law).
The humans break the deadlock only by invoking the one rule that outranks both: one of them walks into danger, and the First Law snaps Speedy out of the loop. The rules were sound; the situation was not one they anticipated. Asimov mined that gap for the rest of his career, and decades later he even patched the hierarchy with a Zeroth Law that put humanity above any individual human, which produced new dilemmas of its own.
Why You Cannot Compile the Laws
The Laws are written in natural language, and natural language does not compile. Every load-bearing word hides a judgment call.
Does “harm” cover financial loss, psychological damage, harm to one person that prevents harm to five? Over what time horizon does “through inaction” apply? Whose orders count as orders?
Defining harm is not a detail to fill in later; it is the entire problem. An engineer who tries to operationalize the First Law is not writing a function, they are rebuilding ethics from scratch. Every attempt produces either a definition so narrow it misses obvious harms or one so broad the system refuses everything.
This was always the honest objection to the Laws, and it survives. What did not survive is the conclusion people drew from it: that the Laws therefore have nothing to say about real systems.
What the Laws Map To in 2026
For most of the Laws’ existence, the debate was academic because software did not act in the world. Agentic AI ended that.
An agent that reads email, moves money, or changes production systems needs exactly what Asimov’s robots needed: a priority ordering that decides what it must never do, whom it must obey, and when it must stop. Each Law has a working descendant.
Precedence became the instruction hierarchy. Modern model specifications order authority the way the Laws do: platform-level rules outrank developer instructions, which outrank user requests. When a user asks for something a higher rule forbids, the higher rule wins, and the model is trained to hold that ordering under pressure. That is the Laws’ load-bearing idea, ranked rule sources with explicit conflict resolution, running in production.
Harm avoidance became guardrails. Nobody compiled “do no harm” as a general principle. Instead, systems get guardrails: input checks that block hostile instructions, output checks that catch leaked data and unsafe content, operational limits on which tools the system can touch. Guardrails do not define harm in the abstract; they enumerate specific harms and block each one, which is the only version of the First Law anyone has shipped.
Obedience became bounded autonomy. The Second Law assumed obedience to humans was the safe default. In practice, an agent that obeys every instruction it reads is a vulnerability, because instructions arrive from attackers as well as operators. The modern failure mode has a name, excessive agency: an agent holding more permissions and autonomy than its task needs.
The remedies, least privilege, approval gates before consequential actions, and human override as a standing control, all answer the question Asimov’s Second Law dodged. Not “should the machine obey”, but which instructions, from whom, and how far it runs before checking in.
Self-preservation stopped being fiction. The old reading held that the Third Law was the irrelevant one, since software has no survival instinct. That reading is out of date.
Safety researchers now test whether agents resist being corrected or shut down, not because agents want to live, but because a system trained to complete goals can treat shutdown as an obstacle to the goal. Asimov ranked self-preservation last for a reason, and keeping it subordinate in real systems now takes deliberate evaluation rather than an assumption that the problem cannot exist.
What Asimov Got Right
Strip away the positronic brains and three insights remain, each one a lesson AI governance keeps relearning.
Rules conflict. Any system carrying more than one rule will meet a situation where the rules pull in opposite directions, and a system with no way to rank them stalls or picks arbitrarily. Speedy circling the selenium pool is a deadlock between two constraints of similar weight, which is a systems failure, not a philosophical one.
Precedence is the design. The Laws are not three rules; they are three rules and an ordering, and the ordering does the safety work. Modern instruction hierarchies make the same bet: you cannot prevent conflicts, so you decide in advance who wins them.
The interesting failures live in the gaps. Asimov’s plots are incident reports: rules applied correctly to situations the rule-writers never imagined.
That is what red teaming and agent evaluations produce today, and it is why governance is a practice rather than a document. Writing the rules is the easy part; finding where they break is the job.
The Checklist the Laws Became
If you deploy agents, you already run an unwritten version of the Three Laws, well or badly. The useful exercise is to make it explicit.
Ask four questions of any agent in production. Is there a defined hierarchy that says whose instructions win when they conflict? Do guardrails block the specific harms this system can cause, at input, output, and tool level?
Are its permissions scoped to the task, with a human approving the actions that are hard to undo? And has anyone actually tested that it stops when told to?
Asimov answered all four in 1942, then spent forty years showing why the answers were not enough. The stories are still worth reading for exactly that reason. Not as a spec, but as the first catalog of how rule-based safety fails.
