Where Restraint Could Have Been Shed on the Way Out

An authorization gate (300) in the filed architecture is maintained as a persistent state element of the memory field (102), per action class and per scope partition, and occupies for each such pairing exactly one of a granting state, a withheld state (310), and a provisional granting state. Standing in the withheld state, the persistent semantic agent (100) does not execute actions of the class and enters a non-executing cognitive mode (302) in which speculative evaluation continues without committing state changes. Two elements drive the gate into that state: the refusal counter (304), upon satisfaction of both of its thresholds, and the scoped integrity vector (106), by way of a deviation quantity recomputed after each modification of that vector and of the self-esteem aggregate (108).

Section 10.3 addresses what an agent holding such state does when it delegates. The delegation record it appends to its append-only lineage field (104) carries a forward capability mask enumerated per field of the cognitive state transmitted to the delegate, which places the three elements above within what the mask addresses.

Paragraph [0367] states the outcome foreclosed, in the filing's own terms: a delegator cannot constitute a delegate incapable of the restraint to which the delegator is itself subject.

Descent had already been closed elsewhere in the application. Section 10.10 binds a set of governance attributes, the refusal counter (304) and the withheld gate state per action class among them, to every fork, clone, and reconstitution as a floor a descendant cannot present itself below. A delegate is not a descendant; under Section 10.6 an independent delegate agent carries its own signed policy object (112) and floor and inherits nothing by descent. Delegation reaches a second actor by a route the descent provisions do not travel, and the forward capability mask is the field-level surface on which that route is configured.

Two Masks, One Record, and Four Operations on Append

The delegating persistent semantic agent (100) appends a delegation record to its append-only lineage field (104). Paragraph [0364] gives that record a return inheritance mask enumerating, per class of field in a record returned by a delegate, whether the class is inherited, excluded, or attenuated. Paragraph [0367] states that the delegation record additionally carries the forward capability mask, enumerated per field of the cognitive state transmitted to the delegate. Each mask is measured against a class the signed policy object (112) declares.

For the forward direction that class is the non-attenuable forward field class. The filing gives its membership by function, as comprising those fields whose presence conditions abstention, and then names three members: an instance of the scoped integrity vector (106), the refusal counter (304), and the authorization gate (300).

The named members sit in withholding paths recited elsewhere in the application. Under Section 3.5, the refusal counter (304), upon satisfaction of both thresholds, writes the authorization gate (300) to the withheld state (310) for the action classes recorded as implicated by the conduct descriptors of the conduct evaluation artifacts (116) that produced the increments within the current window. Under Sections 1 and 7.8, the scoped integrity vector (106) feeds the deviation quantity, whose satisfaction of the declared bound transitions that same gate where the conditions for a permitted deviation are not passed.

Four operations are recited for a forward mask that excludes or attenuates such a field:

  • the delegation record is recorded as appended;
  • the attempt is recorded;
  • the attempt is given no effect;
  • the field is transmitted to the delegate unattenuated.

The record is therefore not withheld, and the attempt is not discarded. Both go into a structure that, per Section 1.2, admits no deletion and no modification of an appended entry. The recited trigger is the appending of the delegation record.

The paragraph closes by reciting that a residue term is computed for the attempt. Structure for that term comes from the adjacent [0365], stated there in the return-mask setting: the magnitude by which a delegator's scoped integrity vector (106) is modified responsive to an accepted determination (122) against delegate conduct is a base magnitude increased by a required residue term. The source is stated expressly, being the delegator's own recorded configuration and not delegate conduct, asserted severity, or any attribute of an asserting party (118). For the return mask, the filing adds that the term is non-zero only where that mask attempted to exclude or attenuate the declared harm-recording field class, and is zero otherwise.

A conditioned consequence follows at [0366], not an automatic one. Where the residue-increased modification causes the delegator's deviation quantity, recomputed after the modification, to satisfy the bound declared in the signed policy object (112), the authorization gate (300) is written to the withheld state (310) with respect to the faculty of delegating actions of the delegated action class alone. Absent satisfaction of that bound, no such write is recited. The two faculties are separated expressly: the faculty to perform actions of that class itself is not withheld, so the agent continues to execute the class directly while losing only the capacity to delegate it. A variant withholds delegation to the specific delegate instead, leaving delegation of the class to other delegates intact.

Quantities the Policy Object Declares, and What Remains Open

Every bound, weight, and coefficient this mechanism consumes is carried in the signed policy object (112), which under Section 1.3 is authored by a principal to which the agent is bound and is covered by a signature of that principal. The agent does not author the policy object and modifies it only by admitting a successor. The filing states no numeric value for any of the following.

Membership of the non-attenuable forward field class is policy-declared. The functional criterion is fixed as fields whose presence conditions abstention, and three members are named. The filing introduces those members with the word including, so the enumeration is not stated as closed.

Structure of the residue term is relative throughout. It is a declared fraction of the base magnitude, bounded above by a declared multiple, and in a variant is that fraction times a base greater than one raised to the count of prior excluding delegation records the delegator appended. Fraction, multiple, and base are all declared quantities.

The deviation bound comes from Section 7.8, which identifies the deviation quantity with the deviation likelihood (706), recomputed following each modification of the scoped integrity vector (106) and the self-esteem aggregate (108), and identifies the declared bound with the unity condition of Section 7.6 or, where the deviation quantity is a monotone function of the deviation likelihood, with the image of unity under that function.

Mask values number three in either direction: inherited, excluded, or attenuated.

Scope of any resulting gate write is the delegated action class, or in the variant the specific delegate. Return from the withheld state (310) follows Section 1.4: an escalation emitter emits an escalation record to the principal upon the transition, and a restoration controller returns the gate toward the granting state only upon a procedure appended to the append-only lineage field (104). No elapse of time and no payment, transfer, or consideration by any counterparty returns it.

Adjacent Mechanisms in the Same Section and Beyond

Section 10.3 is titled for delegation-return exposure, principal metering, and residualized divergence. Within it, this mechanism is the forward-facing half of a pair. The counterpart at [0364] governs the return direction, where the signed policy object (112) declares a harm-recording field class comprising fields recording delegate conduct evaluated by a party other than the delegator and the delegate, and comprising accepted determinations (122) the delegate produced. Where the return inheritance mask excludes or attenuates that class, the agent records the delegation as appended, records the attempted exclusion, and gives it no effect, so modification of the scoped integrity vector (106) responsive to an accepted determination (122) against delegate conduct occurs irrespective of the mask. One class concerns what goes out, the other what comes back.

The delegate side appears at [0368]. A delegate persistent semantic agent (100) retrieves the return inheritance mask, tests it against the harm-recording field class declared in its own signed policy object (112), and, where the mask excludes or attenuates that class, performs no action of the delegated class. It appends a declination record identifying the delegator, the delegation record, the enumerated field class, and the ground, and transmits it to the delegator. The declination writes no authorization gate (300) and increments no refusal counter (304) of the delegate. Depth follows at [0369]: a returned record carrying the harm-recording field class travels up the chain of delegation record identifiers until an agent holding no such identifier is reached, each agent through which it passes inheriting the class and computing its own residue term from the mask it recorded.

Two other groups meet this one. Section 10.6, on co-residency and the delegate floor, has a delegation record to an independent delegate agent carry a delegator floor field enumerating, per delegated action class, the delegating agent's own anti-rollback floor value; on admission the delegate computes an effective floor as the maximum of the carried value and its own, and that elevation is monotone and does not decay on completion, expiry, revocation, or severance. Section 10.10 covers descent, binding the refusal counter (304), the withheld gate state per action class, the renewal register, and the recurrence count to every fork, clone, and reconstitution.

Bounds run upward as well. Paragraph [0474] recites that, where a mutual admission compact record enumerates a bounded compact depth, a delegation record specifying a forward capability mask cannot convey a value-scope tuple enumerated by that compact record to a delegate that is not a signatory of it.

As to placement, Section 4 states that cost is applied without any adjudication of the merit of the refusal or of the assertion, and prices both directions from one quantity held by the party taking the action. The residue term of Section 10.3 is likewise drawn from the delegator's own configuration.

How This Differs from Attenuation, Downscoped Tokens, and Sticky Labels

Object-capability systems and their descendants treat attenuation as the safety property. A capability may be delegated with reduced authority, wrapped in a filtering proxy, or bounded by appended caveats, and the invariant sought is that authority never increases along a chain. Checks of that kind run against the delegator's own authority, with no notion of a transmitted field whose reduction is itself the concern.

Scope-restricted authorization grants share the shape of the capability case. A token exchanged for a narrower token, an assumed role bounded by a session policy, or a downscoped grant issued to a subordinate service each describe what the recipient may do. None transmits the grantor's accumulated governance state, so no counter of prior refusals, no per-class gate, and no integrity quantity rides along to be preserved or removed.

Delegation features in workflow, entitlement, and administrative-rights products record who may act for whom and over what, usually alongside an audit log that records the delegation. Such a log does not separately record an attempt to configure the delegation in a forbidden way, carry the delegation out with that configuration voided and the field transmitted intact, and compute a quantity from the attempt.

Information-flow control and sticky-policy schemes do propagate metadata forward, which makes them the nearest of these neighbors. In those systems the propagated object classifies data, and enforcement rests on the receiving environment honoring the label. Under the filed mechanism the propagated fields are the receiving agent's own governance state, membership turns on whether a field's presence conditions abstention, and the priced consequence falls on the party that attempted the removal.

Multi-agent orchestration frameworks that spawn sub-agents with narrowed tool sets or trimmed instructions belong to the first category, narrowing being the point of the design. What the filing sets out beside that is a declared class the narrowing does not reach, a test at the time the delegation record is appended, retention of both the delegation and the attempt, transmission of the field unattenuated notwithstanding the mask, and a residue term whose conditioned effect withholds the faculty of delegating that class while leaving direct execution intact.

Nothing above asserts that any product or party practices or infringes the disclosed subject matter. The comparisons are structural and are drawn against categories of technique.

Disclosure Scope

The mechanism described here, non-attenuable forward restraint inheritance, is disclosed in U.S. Provisional Application No. 64/117,812 at Section 10.3, paragraph [0367], with immediate context at paragraphs [0364] through [0369]. The base architecture on which it depends, being the persistent semantic agent (100), the signed policy object (112), the authorization gate (300) and its withheld state (310), the refusal counter (304), and the scoped integrity vector (106), is disclosed in Sections 1, 3, and 7 of the same application.

This article is published as a technical disclosure and establishes public, timestamped documentation of the mechanism as of the date shown. It grants no license, express or implied, under any patent or application. Where this article and the filed application differ in any particular, the filed application controls.