Execution as Revocable Permission
The semantic agent architecture described in the preceding chapters comprises structural fields, the intent field, context block, memory field, policy reference field, mutation descriptor field, lineage field, affective state field, integrity field, and forecasting structures, that encode what the agent intends, the context it operates within, the policies that constrain it, and the hypothetical futures it has evaluated. None of these fields addresses the antecedent question of whether the agent should be permitted to act at all at a given moment: whether the conditions under which execution was initially authorized still obtain, and whether the agent's assessed sufficiency to carry out its current task remains above the level at which execution is structurally warranted.
In accordance with an embodiment, execution is treated as a revocable permission rather than a default assumption. Execution is a conditional privilege that must be continuously earned by the agent's demonstrated sufficiency across a plurality of evaluated dimensions. Conventional autonomous agent systems, including runtimes that provide pause and resume capabilities, suspend execution reactively in response to external failures or resource interruptions. The confidence governor disclosed here suspends execution proactively, based on the agent's own continuously computed assessment of its sufficiency, enabling the agent to stop itself before damage occurs rather than recovering after damage has occurred.
The revocable-permission model is enforced by a confidence governor: a structural subsystem of the agent's cognitive architecture that continuously evaluates whether the conditions for execution remain satisfied and withdraws execution authorization when those conditions are no longer met. The confidence governor is not an advisory module or a soft constraint the agent may override through urgency or intent priority. It is a hard gate: when it determines that execution authorization should be withdrawn, execution ceases, and the agent cannot override the withdrawal through self-assessment, affective escalation, or policy reinterpretation. No alternative pathway to execution exists that bypasses this gate.
Composite Admissibility
The confidence governor does not act alone. Together with the integrity engine and the capability envelope, it operates as a composite admissibility evaluator that integrates signals from a plurality of cognitive domain fields, including the affective state field, the integrity field, the confidence field, the capability field, and the personality field, to produce a composite admissibility determination for each proposed mutation. The composite admissibility evaluator does not reduce admissibility to any single dimension. It requires concurrent satisfaction of confidence sufficiency, integrity compliance, and capability confirmation before a proposed mutation is admitted for execution.
Treating execution as a revocable permission, rather than as a default state interrupted only by failure, produces two architectural consequences. First, the agent's right to act is continuously re-evaluated against current conditions rather than assessed once at task inception and assumed thereafter. Environmental conditions change, resource availability fluctuates, the agent's own internal state evolves, and the task itself may reveal complexities not apparent at inception. A system that evaluates execution permission only at startup cannot account for these changes; a system that continuously re-evaluates adapts to them structurally. Second, the transition from executing to non-executing is not synonymous with failure. In conventional systems an agent that stops executing has either succeeded or failed. Here an agent that stops executing may be in a state of deliberate pause: a structurally governed suspension in which cognition continues but action does not.
Confidence as a First-Class Computed State Variable
Confidence is introduced as a first-class computed state variable within the semantic agent schema. It is not a heuristic score, a probability estimate, or a metadata annotation appended to the agent's task record. It is a structurally defined, continuously computed, governance-integrated state variable that occupies a designated field within the agent's canonical data structure, specifically the confidence field, and participates in the same lineage tracking, policy enforcement, and audit mechanisms that apply to all other agent fields. The confidence field encodes the agent's assessed sufficiency to continue executing its current task given its present internal state and the current state of the task and environment. It is computed by a confidence computation subsystem, not declared, estimated, or externally assigned, and it is a continuous scalar within a defined range where the lower bound represents complete assessed insufficiency and the upper bound represents complete assessed sufficiency.
The confidence field is structurally distinct from the intent field and from the forecasting structures. The intent field encodes what the agent is trying to accomplish; the confidence field encodes whether the agent assesses itself as sufficiently equipped to accomplish it. An agent may have high intent clarity and low confidence, knowing exactly what it wants to do but assessing that conditions are insufficient. The independence of confidence from intent ensures that confidence evaluation is not contaminated by the agent's desire to act: an eager agent does not thereby become a confident agent. Similarly, the forecasting engine answers what the agent could do, classifying branches as eligible, introspective, delegable, or pruned, while the confidence field answers whether the agent should be permitted to do it now. Every mutation to the confidence field is recorded in the agent's lineage, producing an auditable record of the confidence trajectory that governance infrastructure can audit to verify that authorization decisions were consistent with the recorded values.
Computation from Agent State and Task State
The confidence computation subsystem evaluates confidence by applying a defined confidence evaluation function to a structured input vector comprising agent state inputs and task state inputs. The function is deterministic: it maps structured inputs to a confidence value and a confidence rate of change, and is not a learned heuristic, a neural network output, or a subjective self-assessment. The agent state inputs comprise at least capability sufficiency, computed by comparing the agent's capability envelope against the task's capability requirements; resource availability, computed from real-time substrate telemetry and projected resource consumption; internal integrity state, the current value of the integrity field; affective modulation state, the current value of the affective state field; and memory and experiential state, a structured similarity evaluation comparing current conditions against historical execution records.
The task state inputs comprise at least the task requirements specification, the formal specification of what the task demands; temporal constraints, the time remaining before deadlines, milestones, or environmental windows close; uncertainty magnitude, the degree of unresolved uncertainty in the task state, which the source distinguishes from task difficulty; and forecasted execution cost, the projected cost of executing the task as estimated by the forecasting engine's planning graph analysis. The confidence evaluation function produces two outputs: a confidence value representing current assessed sufficiency, and a confidence rate of change representing the derivative of the confidence value with respect to time or evaluation cycles. The rate of change enables the confidence governor to anticipate confidence trajectory and initiate preemptive responses before confidence crosses the authorization threshold.
Decay, Recovery, and Differential Rate Analysis
The confidence value is a dynamic quantity governed by two opposing processes. Confidence decay decreases the value in response to accumulating adverse conditions, including degradation of resource availability, detection of capability gaps not apparent at task inception, increases in task uncertainty, integrity field degradation, temporal pressure intensification, repeated execution failures, and environmental destabilization. Each adverse condition contributes a decay component, and the aggregate produces the instantaneous decay rate. Confidence recovery increases the value as previously adverse conditions are ameliorated, including restoration of degraded resources, acquisition of new capabilities, reduction in task uncertainty through inquiry, integrity field restoration, temporal pressure relief, successful execution of sub-tasks, and environmental stabilization.
The confidence governor performs differential rate analysis by computing the difference between the decay rate and the recovery rate at each evaluation cycle. A positive differential indicates recovery is outpacing decay; a zero differential indicates equilibrium; a negative differential indicates deterioration. This drives trajectory-based gating, which considers not only the current absolute confidence value but also the direction and magnitude of the trajectory. The confidence governor may suspend execution even when the absolute value remains above the authorization threshold if the differential rate is sufficiently negative, that is, if the projected time to threshold crossing is shorter than the estimated time required for orderly suspension. To support this, the governor maintains a confidence trajectory projection that extrapolates the value forward in time and produces an estimated time-to-threshold; when that estimate falls below a configurable safety margin, a graceful suspension sequence is initiated regardless of the current absolute value. Differential rate alarm conditions, a decay rate spike, a recovery rate collapse, and a sustained negative differential, trigger responses independent of the absolute value, ranging from increased evaluation frequency through preemptive inquiry to immediate suspension.
Authorization Gating and the Three Authorization States
Execution authorization gating is a hard constraint enforced at the architectural level. When the confidence governor withdraws authorization, the execution subsystem is structurally prohibited from committing mutations, initiating actions, or producing externally observable effects. The prohibition is not a flag the execution subsystem checks and optionally respects; it is a structural decoupling of the execution subsystem's output pathway, such that the subsystem cannot produce effects regardless of its internal state or the urgency of the agent's intent.
Gating operates in one of three states. In the authorized state the confidence value is above the authorization threshold and the trajectory triggers no alarm conditions, and execution is permitted. In the suspended state the value has fallen below the threshold or the trajectory has triggered a preemptive suspension, and execution is prohibited but cognitive processes continue. In the locked state a severe integrity violation, a catastrophic resource failure, or a governance-mandated halt has occurred, and both execution and certain cognitive processes are restricted pending external review. The transition from authorized to suspended occurs when the value crosses below the threshold or a trajectory alarm triggers. The transition from suspended back to authorized requires that the value exceed the threshold by a configurable hysteresis margin, ensuring the agent does not oscillate near the threshold. The transition to locked occurs only upon governance-mandated triggers and is not reversible by the agent itself; locked-state recovery requires external authorization.
Structural Separation of Execution from Cognition
The architecture enforces a structural separation between the agent's execution subsystem and its cognitive subsystems, so that the withdrawal of execution authorization does not impair the agent's ability to think, reason, forecast, plan, inquire, or evaluate. Execution suspension is not cognitive suspension. The separation is enforced at the substrate level through distinct processing pathways. The cognitive pathway comprises all processing that evaluates, reasons about, projects, or represents state without producing externally observable effects, including forecasting, planning graph construction and evaluation, confidence computation, affective state updates, integrity evaluation, and inquiry generation. The execution pathway comprises all processing that commits mutations to verified state, produces externally observable outputs, initiates delegation, or consumes irreversible resources. The confidence governor gates only the execution pathway; the cognitive pathway remains active regardless of authorization state.
An agent under confidence suspension thereby enters a non-executing cognitive mode: a mode in which the agent is fully cognitively active but structurally prohibited from acting. This mode is not idle, passive, or waiting. The agent may construct new planning graphs exploring how to recover authorization, evaluate the conditions that caused confidence to decay and identify remediation strategies, generate inquiry requests seeking information that would resolve the uncertainty or capability gaps contributing to low confidence, perform introspective analysis to determine whether affective biases or integrity degradation are contributing to the deficit, and forecast the consequences of action sequences that might be available when authorization is restored. The confidence governor also supports a structured inquiry mode, activated when confidence falls below the authorization threshold but remains above a minimum engagement threshold, comprising hypothesis expansion, information ingestion, re-evaluation loops, and condition monitoring, and operating iteratively until confidence recovers sufficiently to warrant a transition back to authorization.
Task Class Differentiation Under Interruption
The confidence governor adapts its response to confidence interruption based on the structural characteristics of the task the agent was executing. It recognizes at least three structurally distinct task classes. The terminal task class comprises tasks characterized by high irreversibility, high cost of partial execution, and low tolerance for state corruption, such as operations that commit permanent changes, transactions that cannot be rolled back, and communications that cannot be retracted. Here the interruption protocol prioritizes state preservation and partial progress protection: the agent preserves the current execution state in a durable, governance-tagged checkpoint and halts at the earliest safe point rather than redirecting or reinterpreting. The exploratory task class comprises tasks with low irreversibility and high tolerance for redirection, such as search and information gathering; here the protocol redirects cognitive capacity toward hypothesis expansion rather than state preservation. The generative task class comprises tasks with creative or inventive objectives and high sensitivity to commitment timing; here the protocol transitions the agent to a lower-commitment creative exploration mode that generates prototypes and tentative formulations without committing to any single direction.
Task class assignment is determined by a task class classifier that evaluates the task's structural properties, including irreversibility magnitude, partial execution cost, redirection tolerance, and commitment sensitivity, and may assign a task to a hybrid class that inherits the most conservative constraints from each contributing class. The assignment is recorded in the agent's lineage and is auditable by governance infrastructure. When the confidence governor is applied to embodied agents that control physical actuators, it implements a physical safety floor: a minimum confidence threshold, set higher than the general authorization threshold and not overridable by the agent's deliberation or by delegation commands, below which no physical action is permitted. When confidence drops below the floor, the agent transitions to a safe physical state in which actuators are brought to a controlled stop and end effectors are moved to safe positions, while the agent remains cognitively active in the non-executing mode.
Deferred Execution and Recovery of Authorization
A suspended agent may schedule a future re-evaluation through deferred execution, electing to defer re-evaluation until a specified trigger rather than consuming cognitive resources on continuous re-evaluation. The associated waiting state is a defined suspension sub-state in which the agent has completed its initial inquiry, determined that no productive cognitive action is available in the immediate term, and elected to wait on a temporal trigger (re-evaluate after a specified duration) or a conditional trigger (re-evaluate when an environmental condition is met, a resource becomes available, or a collaborating agent reports a confidence change). The waiting state is not idle: the agent continues to monitor a reduced set of critical conditions and responds immediately if any change. Temporal reauthorization is not automatic; the passage of time alone does not restore authorization. The confidence governor performs a full confidence re-evaluation at the trigger point, incorporating any changes that occurred during the waiting period.
Recovery of execution authorization is a structured three-phase process that ensures the agent does not resume prematurely or under conditions that would immediately re-trigger suspension. In the confidence restoration phase the value increases from below the threshold to above it, computed by the same evaluation function applied to the agent's updated state. In the stability verification phase the governor monitors the value and trajectory over a configurable verification period to confirm the restored confidence is stable, not fluctuating near the threshold, not trending negatively, and not subject to active alarms, and it requires that the value exceed the threshold by the hysteresis margin throughout the period; longer suspensions require larger margins. In the reauthorization phase the governor reconnects the execution subsystem's output pathway and notifies the deliberation pipeline that execution is available. The agent then incorporates any products of suspension-time cognition, a checkpointed state for terminal tasks, a broadened hypothesis set for exploratory tasks, or candidate creative directions for generative tasks, into its resumed execution plan.
Confidence-Integrity Feedback and Multi-Agent Propagation
The confidence field and the integrity field are connected through a bidirectional feedback loop that forms a self-protective circuit. On the forward path, when the integrity engine detects a deviation event, the degraded integrity value is propagated to the confidence computation as an adverse input, reducing confidence in proportion to the severity of the violation. On the reverse path, when confidence drops below the threshold and execution is suspended, the agent is structurally prevented from committing mutations and therefore cannot commit integrity-violating mutations; the suspension creates a structural shield against further integrity degradation. The loop converges toward a state in which integrity is restored to a level that supports confidence recovery, which in turn supports reauthorization, and it includes a circuit-breaker mechanism: if integrity is so severely degraded that no achievable confidence value can support reauthorization, the agent transitions to the locked state and signals that external intervention is required.
In a multi-agent system, confidence values propagate through the executive graph. When a parent agent delegates a sub-task, its confidence computation incorporates the child agent's reported confidence as an input, scaled by the criticality of the delegated sub-task. Propagation is directional: child confidence propagates upward to parents, and parent execution suspension propagates downward so that child agents enter their own suspension procedures rather than executing unsupervised. In peer-to-peer coordination without a strict hierarchy, each agent publishes its confidence to a shared confidence context, and a collaborative task's aggregate confidence is bounded by the confidence of the least-confident participating agent. The confidence governor also accepts environmental inputs derived from a human user's physiological state through a privacy-preserving biological signal interface that records only structured stress, fatigue, and engagement assessments, never raw physiological data, and modulates the agent's confidence in continuing the current interaction accordingly. The agent's affective state field, including a curiosity dimension, modulates the sensitivity of the confidence computation and the intensity of inquiry under suspension, but does not override the authorization gate: curiosity influences what the agent does during suspension, not whether it is suspended.
Disclosure Scope
The confidence governor and its sub-mechanisms, execution as a revocable permission, the composite admissibility evaluator requiring concurrent confidence sufficiency, integrity compliance, and capability confirmation, confidence as a first-class computed state variable in the confidence field, the deterministic confidence evaluation function over agent state and task state inputs producing a confidence value and a confidence rate of change, differential rate analysis with trajectory-based gating and differential rate alarm conditions, the three authorization states (authorized, suspended, locked), the structural separation of execution from cognition and the non-executing cognitive mode, the structured inquiry mode, task class differentiation across terminal, exploratory, and generative classes with the physical safety floor for embodied agents, deferred execution with waiting states and temporal reauthorization, the three-phase recovery process (confidence restoration, stability verification, reauthorization) with hysteresis, the bidirectional confidence-integrity feedback loop with circuit breaker, and multi-agent confidence propagation, are disclosed in the cognition filing (U.S. Application No. 19/647,395). This article describes that disclosed mechanism and does not introduce thresholds, cadences, or parameter ranges beyond those characterized in the specification. The disclosure does not claim consciousness, clinical relevance, or human-equivalent experience; it is offered as an implementable architectural mechanism for systems that must act safely under uncertainty by treating execution as a revocable permission and separating non-executing cognition from execution at the structural level.
