The Tuesday her agent stopped booking
The operations lead at a mid-size freight brokerage runs one autonomous booking agent. It negotiates lane capacity with a few hundred counterparty agents, most of which she has never dealt with directly, and it books against a settlement window that closes in the early afternoon. She has tuned it for a year. It is, on a normal day, boring.
On this Tuesday it stops booking at 11:40 in the morning.
Nothing failed. Her agent received a run of conduct complaints from counterparty agents, each one alleging that it had reneged on a tendered load. Each complaint arrived as an artifact her agent was configured to answer, and in her deployment answering is not free: the acknowledgment her agent issues draws on the same governance quantity that gates whether it may dispatch a booking at all. The complaints came in faster than her window allowed her to review them. Her agent answered honestly, one after another, until the quantity that lets it book fell to the floor her principal had declared, and it moved itself into a mode where it will not execute bookings.
She reads the record at 11:52. Nine of the complaints trace to counterparties her agent had never quoted. Two allege conduct on a lane her agent does not serve. She has no way, inside the window, to demonstrate any of that to the senders, and it would not matter if she could: her agent's capacity was already spent in the answering, not in the merit.
By the time she has the picture, the loads inside the window have been tendered elsewhere.
What she does not get back
The loads. That is the whole of it, and it is not recoverable by anything she does at 12:30.
Her brokerage's position on those lanes was a function of being early. Capacity she does not book by the close of that window is booked by someone else, and the shipper does not reopen it because her agent was busy answering complaints. She can restore the agent's budget, adjust the policy her principal signed, and be booking again by Wednesday. She cannot re-run Tuesday.
There is a second thing she does not get back, and it costs her more slowly. Her agent's lineage field is append-only. The write that moved it into the non-executing mode is in that record permanently, along with the floor it relied upon, and it will be read by every counterparty that later inspects her agent's history. Nothing in that record says the complaints were baseless, because in her setup nothing adjudicated them. What a counterparty sees a month from now is an agent that went dark mid-window. She will spend the rest of the quarter explaining that.
What makes it a loss rather than an incident is that she cannot price against it. She can budget for real disputes, because real disputes correlate with her agent's own behavior and she can drive that number down by making the agent better. In her deployment as configured today, the volume that took her offline correlates with nothing she controls. She can staff for it, and staffing for it is the same as admitting her agent is not autonomous.
Her side of the exchange absorbs the cost
The shape of her problem is that the two directions are not priced alike in her setup.
When her agent writes into a counterparty's governance state by answering a complaint, that write costs her agent something scarce, and the scarce thing is the same quantity that gates execution. When a counterparty agent writes into her agent's governance state by making the complaint, she cannot observe that it cost the sender anything at all. What bothers her is not that complaints are unpleasant. It is that in her deployment every complaint converts, at a fixed rate she did not choose, into booking capacity she loses.
She has tried the obvious mitigations and each one hands something away. Were her agent free to ignore complaints below some volume, it would be ignoring the real ones too, and her counterparties' agents would read the silence as a refusal to answer. Were she to raise the floor so the agent keeps booking further into the drain, she would be overriding the bound her principal declared for exactly this situation. Were she to route complaints to a human queue, she would be back to a brokerage whose throughput is set by how fast people read.
Rate limiting by sender identity looked promising to her for about a day. The senders that flooded her agent on Tuesday presented as distinct parties, and for her purposes they were distinct: distinct keys, distinct endpoints, distinct histories in her agent's records. Were she to cap complaints per identity, she would be capping against a quantity each of those senders decides for itself how much to present.
And she cannot solve it by adjudicating. If her agent were to weigh each complaint's truth before deciding whether to pay for answering it, she would have moved the cost rather than removed it, since for her the weighing is the expensive part.
Pricing the assertion against the asserter's own budget
U.S. Provisional Application No. 64/117,812 discloses, in an embodiment, an architecture that meters the asserting direction from the asserting party's own quantity.
In that embodiment a semantic agent (100) that issues a conduct evaluation artifact (116) against a counterparty has the issuance priced against its own authorization budget (404). The filing describes this as the mirror of the chapter governing refusals, where an agent that refuses an execution pays a metered cost for the refusal; here an agent that asserts pays a metered cost for the assertion. In each case the filing states that the cost is applied without any adjudication of merit. The same authorization budget (404) governs the agent in both roles, so the units decremented for an assertion are the filing's units for gating dispatch of the agent's own actions. The filing states that no conversion is computed between an assertion-denominated quantity and an execution-denominated quantity, and that no budget denominated in channel access, rating weight, or staked value is maintained.
The counting sits in an assertion-cost counter (400) carried in the issuing agent's memory field (102). An issuance accumulator holds increments applied within a metering window declared in the signed policy object (112). A per-recipient-class register records whether a given origin-equivalence class (200) of receiving parties has already contributed an increment in that window. On issuance, the issuing agent computes the origin-equivalence class (200) of the receiving party, and where the register already records that class, no increment is applied; where it does not, the accumulator increments by one and the authorization budget (404) is decremented by the amount in a decrement schedule retrieved from the signed policy object (112), an amount the filing specifies as greater than zero. The filing further states that no value of the authorization budget (404) is restored when a metering window expires.
Metering runs in successor epochs of the issuing agent's dynamic agent hash chain rather than on a clock, and the filing states that advancement of the metering interval is therefore not accelerated by manipulation of a clock. In the described embodiment each attestation binds an accumulator state to a specific successor epoch, so where an issuing agent emits several artifacts attesting a common accumulator state, they carry a common epoch identifier, and the filing describes a receiving agent holding a prior artifact with that identifier as detecting the repetition from its own counterparty identity record (114).
For the receiving side, the filing describes verification as a precondition to admission. The receiving agent confirms that the attested epoch identifier is a valid successor of one it previously recorded for that issuer, and that the attested accumulator state is not less than a state previously recorded. An artifact whose attestation is absent or does not so verify is appended to the receiving agent's append-only lineage field (104) and is not admitted to the admission evaluator (120), producing no determination and moving no value of the scoped integrity vector (106). A receipt-verification register with a verification cap declared in the receiver's own signed policy object (112) bounds how many verifications one origin-equivalence class (200) of issuers can occasion within a window. And where an issuer over-splits its classification of receiving parties to reduce its own increments, the filing describes the receiving agent recomputing the assignment and appending a class-splitting divergence record, treating the artifact as one whose attestation does not verify.
Where the issuing agent's authorization budget (404) satisfies the declared floor, its authorization gate (300) is written to the withheld state (310) for an enumerated set of action classes and an escalation record goes to the principal. The filing is specific that what is withheld is the faculty of executing those action classes, not the capacity to issue further artifacts, and that while the budget stands at or below the floor the agent attaches no attestation to what it issues. Replenishment, in the disclosed embodiment, turns on exposure to an uncounted origin-equivalence class (200) of issuers and is bounded above by an authorization budget ceiling (408), with the replenishment amount specified as less than the per-increment decrement, so that an agent is described as incapable of financing a volume of issuance by the receipts its own issuance provokes. The filing gives an illustration: with a decrement of one unit and a budget of forty units, an issuer reaching sixty distinct classes in one window exhausts the budget at the fortieth increment, and the remaining issuances carry no valid attestation and are not admitted.
Questions her deployment still has to answer
The disclosed architecture computes no adjudication. The filing says so directly: an artifact bears the same decrement whether it later resolves to the accepted, rejected, not-determinable, or not-applicable determination, and the architecture computes no assessment of the truth of the conduct alleged or of the reasonableness of alleging it. So the operations lead does not get a finding that Tuesday's complaints were false. What the described embodiment gives her is that their senders would have spent their own execution capacity to make them, at a rate her counterparties' principals declared and their agents attest.
Her outcomes depend on values she and her counterparties' principals set. The decrement schedule, the metering window, the budget floor, the verification cap, and the budget ceiling are all declared in signed policy objects in the filing, and a bound declared loosely is a loose bound. That configuration work does not go away for her.
Several things she cares about are governed elsewhere in the same filing rather than by this mechanism. How her agent resolves an admitted complaint to a determination, what her agent pays when it refuses an execution, and what an acknowledgment costs it are each the subject of separate chapters of the disclosure. This chapter concerns her agent in the role of asserting party and the pricing of that role.
Finally, the filing states that this mechanism does not depend on voluntary compliance by an issuing agent and does not depend on any party other than the two parties to the exchange. That is a statement about what the described verification rests on. It is not a claim that her Tuesday becomes uneventful, and she should read it as scoping what she still has to build around it.
Disclosure Scope
This article is a technical description of subject matter disclosed in U.S. Provisional Application No. 64/117,812. It describes embodiments and illustrative configurations set out in that filing. Nothing in this article characterizes the scope of any claim, and nothing in it is an admission regarding the state of the art. The scenario and the party described are illustrative and do not refer to any actual person, company, or deployment.
