1. Where the Register Cannot Be Read

The authorization quantity governing an action class moves in two directions. It falls under a monotonically non-increasing decay function applied as the agent operates, and it rises upon receipt of an admissible conduct evaluation artifact (116) from an origin-equivalence class (200) that a windowed register does not already record for that action class and scope partition. Where the computed class of the asserting party (118) is already present in that register, no renewal applies.

Reaching the declared floor is consequential. The authorization gate (300) is written to the withheld state (310) for that action class and the escalation record is emitted; in that state the agent does not execute actions of the class and enters a non-executing cognitive mode (302) in which speculative evaluation continues without committing state changes. A restoration controller returns the gate toward the granting state only upon a procedure appended to the append-only lineage field (104), and no elapse of time, payment, transfer, or consideration by any counterparty returns it.

Paragraph [0466] of the filing addresses the case where the register itself cannot be read, and names the consequence it forecloses: both an unwarranted renewal and a decay computed against an unknown register state. It sits under a stated invariant. Section 5 recites that no determination stage of the architecture converts unavailability of a required input into an adverse consequence for any party, at each stage at which an input is required and irrespective of the cause of unavailability. A degradation map (500) enumerates, for each stage, the input required, the abstention outcome produced upon unavailability, and the consequence foreclosed. Paragraph [0466] carries that treatment to the register of authorization quantities and recites what the agent does while the register stays unreadable.

2. Hold, Re-Read, Resume

The authorization quantity is a scalar maintained per action class and per scope partition, held in the memory field (102) and initialized from the signed policy object (112). Upon each execution within the action class and each advance of a successor epoch of the agent's hash chain, the agent computes an elapsed measure since the last renewal and applies the decay function parameterized by a declared decay constant, being an exponential half-life or a declared linear decrement per unit. The decayed value is written to the memory field and appended to the lineage field (104).

The register is keyed the same way. It holds identifiers of origin-equivalence classes (200) from which an admissible conduct evaluation artifact implicating that class has been received within a declared window, each entry expiring on window elapse. Where the asserting party's computed class is absent from the register, the quantity is renewed to a declared value, an entry is written, and the renewal is appended to the lineage field before and independently of the determination produced. Any of the four determinations (122, 124, 126, 128) renews by one and the same amount, so renewal is valence independent and cannot be manufactured by repeated evaluation from a single source.

The hold. Where the register cannot be read, no renewal and no decay are applied, and the authorization quantity is held at its current value with the condition appended. One rule suspends both operations, and the appended condition enters the same record that carries the decayed values and the renewals.

The re-read cadence. The persistent semantic agent (100) re-reads the register at a re-read cadence declared in the signed policy object (112), and each attempt and its outcome is appended to the append-only lineage field (104). That object is authored by a principal to which the agent is bound and covered by that principal's signature; the agent does not author the signed policy object and modifies it only by admitting a successor signed policy object.

Resumption. Decay resumes from the held value upon an attempt that succeeds, no decay having been applied for so long as the hold subsisted.

One consequence is expressly conditioned. Responsive to the hold subsisting for a maximum hold interval declared in the signed policy object (112), the agent emits a structured inquiry to its principal identifying the register and the interval over which it has been unreadable, without writing the authorization gate (300). The filing states no value for that interval.

Absence of a gate write is what separates this inquiry from the escalation record. An escalation emitter emits the escalation record to the principal upon a transition of the authorization gate (300) to the withheld state (310), the record enumerating the action class, the scope partition, and the entries upon which the transition was computed. Under paragraph [0466] the inquiry is emitted without any such write.

3. Declared Parameters, No Declared Values

Each parameter this mechanism consumes is declared in the signed policy object (112) in force. The filing states a numeric value for none of them.

  • Re-read cadence. Declared in the signed policy object (112). No value, no unit, and no bound on the number of attempts is recited.
  • Maximum hold interval. Declared in the signed policy object. The structured inquiry is conditioned on the hold subsisting for this interval, and no value is recited.
  • Decay constant. Declared, being an exponential half-life or a declared linear decrement per unit. Under Section 10.2 the rate at which the quantity depletes is set as an inverse function of a count of corrective encounters recorded in the lineage field (104) for that action class with which the agent subsequently complied; where that count is zero the class is an untested class and the constant is set to a short constant declared in the policy object.
  • Elapsed measure. Expressed in executions performed within the action class or in epochs advanced, as the policy declares per action class.
  • Register window. Declared, each register entry expiring on window elapse.
  • Renewal amount. Declared, and under Section 10.1 a monotonically non-decreasing function of the count of recorded severance events across the constituent edges of the renewing origin-equivalence class (200), a class each of whose edges resolves not-typeable renewing at a declared least amount.
  • Floor. Declared. Reaching it writes the authorization gate (300) to the withheld state (310) for that action class and emits the escalation record.

No threshold for what counts as unreadable and no taxonomy of causes appears in the filing. Section 5 states its invariant to apply irrespective of the cause of unavailability, and paragraph [0466] is written over the condition that the register cannot be read rather than over any enumerated class of fault.

4. Adjacent Rules in the Same Filing

Section 5.2 already carries a register-unavailable path of the same shape on the budget side: where the replenishment register (402) of Section 4 cannot be read, no replenishment is applied and the authorization budget (404) is held at its current value. Paragraph [0466] recites three things that path does not: the declared re-read cadence with each attempt and its outcome appended, resumption of decay from the held value, and the inquiry conditioned on a declared maximum hold interval.

The two quantities are coupled through one triggering event. Responsive to a renewal by an uncounted origin-equivalence class (200), and by the same procedure, the authorization budget (404) is replenished by an amount from a declared replenishment schedule bounded above by a declared ceiling, any excess being discarded and not carried forward. That replenishment is the sole procedure by which the budget increases; no replenishment follows an artifact from a counted class, elapsed time, an execution, or a self-assessment. While the hold subsists no renewal is applied. The quantities stay distinct, neither computed from nor expressed in the units of the other, one held per action class and scope partition and the other per agent across the action space.

Renewal also governs one return path. Where the authorization gate (300) was written to the withheld state (310) by the authorization quantity reaching its floor, a renewal by an uncounted origin-equivalence class returns the gate to the granting state for that action class and exits the non-executing mode, without a principal-resolution object, acknowledgment artifact, or acceptance determination, the withholding having arisen from absence of evaluation rather than from an accepted determination (122) recording harm. Where the gate was instead withheld by a deviation quantity or by the provisional-restoration mechanism, the renewal returns it by no procedure.

A structural sibling appears at Section 10.6. Where an orphaned-class budget disposition is declared frozen, decay of the authorization quantity for that class is suspended from the append of the orphaning record and resumes upon the authorization gate (300) returning to the granting state, the elapsed interval contributing no decrement; where declared retained, decay continues unmodified. In neither disposition is the authorization budget (404) decremented, any authorization quantity set to zero, or any register entry removed.

Section 5 supplies the surrounding discipline. Its conversion bar (502) forecloses a consuming determination from converting an abstention outcome into a scalar value, a default value, an operand of a threshold comparison (510), or a consequence adverse to any party, and the filing states in consequence that no authorization quantity is decremented by one and no write of the authorization gate (300) is caused by one.

5. Distinguishing the Adjacent Categories

Governance and policy-enforcement systems for autonomous agents evaluate a proposed action against policy before it is performed and return a decision. As the filing's background records, systems implementing the XACML standard return a decision drawn from permit, deny, not-applicable, and indeterminate; that four-valued result is directed at the request, produces no persistent state in the deciding entity, and constrains no subsequent operation of the decider. Where an attribute required for evaluation is unavailable, such systems return an error or indeterminate status to the requesting party or deny the action, and the unavailability is in neither case recorded as a persistent state of the deciding entity that constrains its own later operation. The hold sits on the other side of that line: the condition is appended to the deciding agent's own record, and what is held is that agent's own authorization to act.

Behavioral integrity systems compute a conformity measure between observed execution signals and a baseline of expected behavior, then reduce capability upon a deficient comparison. The background identifies U.S. Patent No. 12,563,045 (Daon), which compares an integrity score against a threshold, modifies capabilities upon the comparison, and restores capability upon a reconciliation recorded to a ledger; and U.S. Patent No. 12,526,244 (Citibank), which maintains a reputation value for a computing entity, applies decay and penalty values, and removes a probationary status after an interval of operation without incident. The filing characterizes both as conformity detectors with exactly one direction, in which divergence narrows capability. Neither is characterized there as carrying a state in which a stored measure is held, unchanged in either direction, because an input to its computation cannot be read.

External revocation systems issue and withdraw credentials from an identity provider or control plane, terminating an agent's ability to act by an act of the controlling authority. Such systems, the filing records, provide no procedure by which the agent's own conduct record participates in the determination and no state in which the agent continues to reason while withheld from execution. Under paragraph [0466] the operative record is the agent's own lineage field.

Accountability protocols for distributed systems, exemplified in the background by PeerReview, locate the verdict in auditors, and remote attestation architectures such as the architecture of RFC 9334 locate appraisal in a verifier and the grant or denial of authority in a relying party. Appraisal sits in each with a party other than the appraised one; the register at issue here is one the governed agent reads about itself.

These distinctions are structural and drawn from the categories the filing's background identifies. None asserts that any named system or party practices, or infringes, the mechanism described here.

6. Disclosure Scope

The mechanism described in this article is disclosed in U.S. Provisional Application No. 64/117,812, at Section 10.8, paragraph [0466], titled in that filing as register-unavailable re-read cadence, held-value decay resume, and max-hold inquiry. Its base architecture is set out at Section 10.1, paragraphs [0343] through [0346], which recite the authorization quantity and its decay, the windowed register gating renewal by an uncounted origin-equivalence class, the renewal-side replenishment of the authorization budget (404), and the distinct return path for decay-induced withholding. The untested-class decay rate appears at Section 10.2, and the orphaned-class budget disposition at Section 10.6. The surrounding abstention discipline, including the degradation map (500), the conversion bar (502), and the register-unavailable path for the replenishment register (402), appears at Section 5, paragraphs [0148] through [0161], and the assertion-cost apparatus at Section 4, paragraphs [0111] through [0147].

No numeric value is declared for the re-read cadence, the maximum hold interval, the register window, the decay constant, the renewal amount, or the floor; each is declared in the signed policy object (112) in force. No deployment context, worked numeric trace, or availability figure beyond what is stated here forms part of the disclosed mechanism. Statements made here describe the mechanism as filed and are not an assertion that any specific external system practices it.