1. The Gap

A governed agent that withholds an action class is not stuck there. A restoration controller returns the authorization gate (300) from the withheld state (310) toward the granting state, but only upon a procedure appended to the append-only lineage field (104). No elapse of time returns it, and no payment, transfer, or consideration by any counterparty returns it. Where the returning procedure is a principal-resolution object, it is the principal's own response to the escalation record that the transition to the withheld state emitted to the principal, and the principal is the party to which the agent is bound.

That design terminates authority in the principal, which is correct as far as it goes. The gap is that nothing in the ordinary restoration path evaluates whether the exercise of that authority accomplished anything. A principal can return the gate, watch the same condition write it back to the withheld state, return it again, and repeat the cycle indefinitely. Each individual restoration is valid. The pattern is the problem: repeated clearance of a block that keeps recurring, from the same source, over the same class of action, without the restoration ever holding.

The restoration path is one place the accountability architecture leaves a single party able to act again and again without limit. The filed disclosure addresses it by measuring the durability of restorations rather than the identity of the restorer, computing that measurement from the agent's own record, and changing what a repeat restoration requires instead of removing the principal's ability to restore.

2. Mechanism

The mechanism has three parts: a statistic the agent computes over its own history, a condition that statistic triggers, and the routes by which the condition ends.

The recurrence statistic. The agent computes a recurrence count from the append-only lineage field (104) by an ordered procedure. First, within a declared retention interval, it retrieves each entry recording a return of the authorization gate (300) to the granting state responsive to a principal-resolution object. Second, for each such return, it retrieves any subsequent entry recording a write of the gate to the withheld state (310) occurring within a declared correspondence interval following that return. Third, it tests each return-and-write pair for correspondence. A pair corresponds where the causal set of the subsequent write draws on the same origin-equivalence class (200) as the write that the return resolved, and where the subsequent write enumerates an action class that was enumerated in that resolved write. Where several writes fall within one correspondence interval, the first write that corresponds forms the pair and no later write forms a further pair with the same return, so each return contributes at most one corresponding pair. The recurrence count is the number of corresponding pairs.

Both dimensions have to match. A subsequent write drawing on a different origin-equivalence class (200), or enumerating a different action class, does not correspond and adds nothing to the count. The statistic is confined to repetitions of one condition: the same origin-equivalence class and the same action class, cleared and then written back to the withheld state.

The condition. Responsive to the recurrence count satisfying a bound declared in the signed policy object (112), the agent conditions the next return of the authorization gate (300) to the granting state upon both a principal-resolution object and a co-signature over that object. The co-signature is verified against a governance address named in the principal's own admitted policy object, under the same signature-verification procedure the agent uses to verify the signed policy object (112) itself. While the condition subsists, a return presented with the principal-resolution object alone does not write the gate. The presented object is not discarded: it is appended to the append-only lineage field (104) together with the recurrence count, the bound applied, and the governance address required, so the attempted restoration is on the record.

Two features keep the condition inside the principal's own governance. The agent does not nominate the address: the co-signer is drawn only from an address the principal has itself named in its policy, and the agent acts on the co-signature solely by verifying it against that named address. And where the principal's policy names no governance address, the condition is inoperative, so a principal-resolution object alone continues to return the gate.

How the condition ends. The condition is not permanent. It clears by expiry when contributing pairs age out of the retention interval and the recurrence count falls back below the bound. It also clears on demonstrated durable restoration. The agent computes a durability count, being the number of returns of the gate to the granting state by the principal, within the retention interval, that are not followed within the correspondence interval by a corresponding write under the same pairing rule. When the durability count satisfies a declared durability bound, the agent clears the condition even though the recurrence count has not yet fallen below its bound by expiry, and appends a clearing record identifying the count, the bound, and the returns relied upon. A return that contributes to a corresponding pair contributes to no durability count, and conversely, so no single return is counted on both sides.

The same statistic reaches the co-signer. The agent computes a second recurrence count over returns of the gate effected upon a co-signature by a given governance address, applying the pairing procedure with that address as the restoration authority in place of the principal. Where that count satisfies the declared bound, the agent conditions the next return effected by that address upon a co-signature by a further named governance address, and where the principal's policy names none, it appends a record identifying the address, the count, and the bound, and transmits that record to the principal without writing the gate. A co-signing authority whose signatures do not produce durable outcomes is metered by the same rule that metered the principal.

3. Operating Parameters

Every quantity the mechanism relies upon is declared, not fixed by the disclosure to a number:

  • Recurrence bound. Declared in the signed policy object (112). Satisfaction of the bound triggers the co-signature condition on the next return.
  • Retention interval. Declared. Bounds the window of lineage entries over which returns are retrieved; contributing pairs expire from it.
  • Correspondence interval. Declared. A subsequent withheld-state write must fall within it, following a return, to be eligible to pair with that return.
  • Durability bound. Declared. Satisfaction of it by the durability count clears the condition ahead of expiry.
  • Correspondence rule. A write pairs with a return only where its causal set draws on the same origin-equivalence class (200) and it enumerates an action class enumerated in the resolved write.
  • Verification procedure. The co-signature is verified against the named governance address under the same signature-verification procedure applied to the signed policy object (112).

The governance address is a datum of the principal's policy, not a parameter the agent sets. The filed disclosure states these as policy-declared quantities and does not require any particular numeric value for the bound or the intervals.

4. Composition

The mechanism sits in the principal-metering portion of the delegation-return exposure, principal metering, and residualized divergence material of the filing, and it reuses primitives declared far upstream rather than inventing parallel machinery. The authorization gate (300) is the same per-action-class, per-scope-partition state element that occupies exactly one of the granting, withheld (310), and provisional granting states, and the restoration path being metered is the same one the escalation emitter feeds when a transition to the withheld state emits a record to the principal. Because the dispatch-authority predicate is recomputed from current memory at each dispatch, and is not read from a cached token or session grant, an unmet co-signature condition takes effect at the next request without any revocation step: the gate simply is not in the granting state for that class until both signatures are present.

The signature-verification procedure is not a new trust root. It is the procedure already used to verify the signed policy object (112), now applied to a second named address, so the co-signature inherits the same cryptographic assurances the agent depends on for policy admission.

Two companion mechanisms in the same section close the obvious escape routes. The recurrence statistic and its clearing routes read only the agent's own append-only lineage field (104); no registry, platform, or third party participates in the computation or the enforcement. And the anti-evasion charge on governance-address removal handles the principal who tries to delete the named address to shed the co-signer: admitting a successor policy that removes a governance address named in the immediately preceding one, within the declared window while the condition subsists, is itself scored as a deflection event and priced, and the condition is not lifted by the removal. The metering, the clearing, the recursive extension to the co-signer, and the anti-evasion charge form one closed treatment of restoration durability rather than a single isolated check.

5. Prior-Art Distinction

Several established categories arrange for more than one party to authorize a sensitive operation, and the distinction here is structural, not a claim about any product.

Multi-signature and M-of-N quorum authorization. Threshold-signature schemes and multi-party approval require a fixed set of signers as a standing precondition, set in advance and applied uniformly to every operation of a class. The mechanism here imposes a second signature conditionally, and only after a statistic the governed agent computes from its own history crosses a bound. Before the recurrence count is reached, one signature suffices; the second is not a policy constant but a consequence of measured non-durability.

Adaptive or step-up authentication. Risk-based multi-factor authentication adds a factor when a service scores a login or transaction as anomalous. Step-up authentication increases confidence in who is acting. The co-signature here does not authenticate the principal, whose principal-resolution object already verifies. It conditions the exercise of restoration authority on a second attesting party because prior exercises of that authority did not resolve the condition. The metered quantity is the durability of outcomes over time, not identity confidence at a moment.

Privileged access management and break-glass approval. Administrator-configured escalation workflows route privileged actions to an approver chosen by a central policy or platform. Here the governed party computes the trigger itself, the second signer is named only in the principal's own policy, and the agent neither selects the co-signer nor gains authority beyond verifying a signature against the named address. Where the principal names no address, there is no escalation at all.

Account lockout and rate limiting. Lockout counts failed attempts and blocks further ones; a circuit breaker trips on an error rate and throttles. The recurrence count does the opposite in kind: it counts successful restorations that the same condition later undid, and its consequence is not a block. The agent keeps receiving instruction and keeps executing; it requires one additional signature, drawn from an address the principal itself named, on one class of state transition.

None of these categories meters the restorer's own restoration authority from the governed party's append-only record, and none escalates to a co-signer defined solely by the metered party's own policy.

6. Disclosure Scope

This mechanism is disclosed in U.S. Provisional Application No. 64/117,812, in the principal-metering material of Section 10.3, at paragraph [0371], together with the recurrence statistic on which it depends at [0370], the durability-count clearing route at [0372], the recursive metering of the co-signing authority at [0373], and the anti-evasion charge on governance-address removal at [0374] discussed in the composition above. What is disclosed is the computation of a recurrence count over corresponding return-and-write pairs in the agent's own append-only lineage field, the conditioning of a next return of the authorization gate to the granting state upon both a principal-resolution object and a co-signature verifiable against a governance address named in the principal's own admitted policy object, the appending of a shortfall record when a resolution object is presented alone, the clearing of the condition by expiry or by a durability count, and the recursive application of the same statistic to a co-signing authority.

What is disclaimed is any reading that fixes the bound, the retention interval, the correspondence interval, or the durability bound to a particular numeric value; any implication that the agent selects, nominates, or evaluates the sufficiency of the co-signer beyond signature verification; and any implication that the condition operates where the principal's policy names no governance address, in which case it is inoperative by the terms of the disclosure. This article is a defensive technical publication describing the filed disclosure and is not a claim of infringement against any party or product.