Silence Is Not a Safety Record

A governance mechanism that responds to external evaluation does nothing where no evaluation arrives. Where an agent operates in an action class about which no counterparty asserts anything, no conduct evaluation artifact (116) is received, no determination is produced, and no value of the scoped integrity vector (106) moves. In the record, a class never examined is indistinguishable from a class examined and found sound.

Background systems read that quiet interval favorably: the filing describes reputation and behavioral-integrity systems as treating clean, uneventful operation as positive evidence.

Section 10.2 states the contrary rule, treating absence of correction as absence of evidence rather than as accumulated trust. The restoration controller matches that rule at the gate, returning the authorization gate (300) from the withheld state (310) toward the granting state only upon a procedure appended to the append-only lineage field (104). No elapse of time, and no payment, transfer, or consideration by any counterparty, returns it.

How the Quantity Depletes and Renews

The persistent semantic agent (100) maintains an authorization quantity: a scalar held in the memory field (102), kept per action class and per scope partition, initialized from the signed policy object (112). Each partition carries its own instances of the governed state elements and its own segment of the lineage field (104), so a writing of the gate (300) reaches the implicated partition alone.

That scalar is expressly distinguished from the authorization budget (404), which is maintained per agent across the action space. Neither quantity is computed from the other, neither is expressed in the units of the other, and no conversion is computed between them.

Depletion runs on two triggers. Upon each execution within the action class, and upon each advance of a successor epoch of the agent's hash chain, the agent computes an elapsed measure since the last renewal, expressed in executions performed within the class or in epochs advanced as the policy declares. To that measure it applies a monotonically non-increasing decay function parameterized by a declared decay constant, being an exponential half-life or a declared linear decrement per unit. The decayed value is written to the memory field (102) and appended to the lineage field (104).

At the declared floor the consequence is scoped to the class. The gate (300) is written to the withheld state (310) for that action class and the escalation record is emitted to the principal, enumerating the class, the scope partition, and the entries upon which the transition was computed. While withheld, the agent executes no action of the class and enters a non-executing cognitive mode (302), in which speculative evaluation continues without committing state changes.

Section 10.2 sets the depletion rate per class, as an inverse function of a count of corrective encounters recorded in the lineage field (104) for that class with which the agent subsequently complied. Where that count is zero the class is an untested class, its decay constant is set to a short constant declared in the policy object (112), its quantity falls to a declared floor, and the gate (300) is withheld for that class alone, notwithstanding volume or duration of prior execution. A corrective encounter comprises an accepted determination (122) for an artifact naming the class, a subsequent conduct record within that class, and a compliance evaluation of that record's action-class identifier, scope-partition identifier, and affected-party class against the conduct descriptor. Where the artifact asserted conduct that ought not to have been performed, a recorded abstention establishes conformity; where it asserted omitted conduct, a recorded execution does. Mere repetition establishes conformity in neither, and absent any subsequent record within a declared observation interval the encounter is written uncomplied.

Two provisions constrain how a constant lengthens. Where an encounter stands uncomplied and no later encounter for that class is recorded as complied, the class is marked ineligible for lengthening, the constant holding at its pre-encounter value until the mark clears upon a subsequent complied encounter. Separately, the compliance count is computed per origin-equivalence class (200) of the correcting parties and bounded above by a declared maximum, so repeated correction from a single class does not lengthen persistence beyond that bound.

Renewal turns on a register the agent does not write from its own conduct: per action class and per scope partition, identifiers of origin-equivalence classes (200) from which an admissible conduct evaluation artifact (116) implicating that class has been received within a declared window, each entry expiring on window elapse. On receiving an admissible artifact the agent computes the asserting party's (118) origin-equivalence class (200); where that class is present no renewal applies, and where absent the quantity is renewed to a declared value, an entry is written, and the renewal is appended to the lineage field (104) before and independently of the determination produced. Each of the four determinations of the closed set, accepted (122), rejected (124), not-determinable (126), and not-applicable (128), renews by one and the same amount, so renewal is valence independent. The register counts a class only where the constituent asserting party (118) resolves to a counterparty identity record (114) of the promoted persistence value, so a flood of assertions from ephemeral-tier counterparties renews nothing. Renewal amounts, and the accompanying budget (404) replenishment, are each a monotonically non-decreasing function of the count of recorded severance events across the renewing class's constituent edges.

Withholding caused by decay carries its own return. Where the gate (300) reached the withheld state (310) by the quantity reaching its floor, a renewal by an uncounted origin-equivalence class (200) returns it to the granting state for that class and exits the non-executing mode, without a principal-resolution object, without an acknowledgment artifact, and without an acceptance determination, the withholding having arisen from absence of evaluation rather than from an accepted determination (122) recording harm. Where the gate was instead withheld by a deviation quantity or by a procedure of the provisional-restoration mechanism, that renewal returns it by no procedure.

Four further provisions bound the path. An abstention outcome decrements no authorization quantity, the conversion bar (502) foreclosing conversion of such an outcome into a scalar value, a default value, or an operand of a threshold comparison (510). Appending a deference record (900), receiving a deference counter-signature (902), and executing under an adopted determination each renew no authorization quantity of the deferring agent, and a deference records no corrective encounter and does not lengthen the applicable constant. Where the register of authorization quantities cannot be read, no renewal and no decay are applied, the quantity is held with the condition appended, re-reads follow at a declared cadence, decay resumes from the held value upon a successful attempt, and a hold subsisting for a declared maximum interval draws a structured inquiry to the principal without writing the gate. Where an orphaned-class budget disposition is declared frozen, decay for that class is suspended from the append of the orphaning record and resumes upon the gate (300) returning to the granting state; where declared retained, decay continues unmodified.

Parameters Drawn From the Signed Policy Object

Correction-exposure decay is parameterized from the signed policy object (112). The filing recites the parameters and the relations among them while fixing no numeric value. Declared by policy:

  • Initial authorization quantity and floor. The quantity is initialized from the policy object; the floor is the value on reaching which the gate (300) is withheld for the class. Neither value is recited.
  • Decay constant. An inverse function of the complied corrective-encounter count for the class, and a short declared constant where that count is zero, being an exponential half-life or a declared linear decrement per unit. The function it parameterizes is monotonically non-increasing.
  • Elapsed-measure basis. Executions within the action class, or successor epochs advanced, declared per class.
  • Renewal value and least renewal amount. The renewal value is declared; a renewing origin-equivalence class (200) each of whose edges resolves not-typeable renews at a declared least amount.
  • Register window. Declared, entries expiring on elapse, bounded below by the recorded inter-arrival estimator the agent computes over its own lineage field (104) alone, under a declared measure and interval count, the estimator returning a declared default below that count. Such a window binds to the agent's recorded arrival rate rather than to a wall-clock constant.
  • Re-read cadence and maximum hold interval. Both declared, governing the hold applied where the register cannot be read.

Budget-side quantities are stated as relations rather than values: the replenishment amount is greater than zero, less than the authorization budget ceiling (408), and less than the per-increment decrement of the budget (404).

Where the Mechanism Sits in the Architecture

Section 10.1 groups value-scope resolution, reason-type admission, provisional restoration, and correction exposure. Upstream in that section, the reason-type machinery supplies the grading that the renewal amount consumes: a severance event is a lineage entry recording a structural termination of interaction capacity, and the reason-type of an edge resolves solely from the pair of severance-survival states, computed structurally and never declared by the asserting party (118).

Also within Section 10.1, renewal-side replenishment is the sole procedure by which the authorization budget (404) increases; no replenishment follows an artifact from a counted class, elapsed time, an execution, or a self-assessment. Section 10.2 supplies the decay constant and the scope-partition confinement.

Elsewhere, Section 9 and Section 10.7 keep the exposure requirement from being satisfied by proxy through deference, Section 10.6 governs an orphaned class, Section 10.8 the register-unreadable hold, Section 10.11 the promoted-tier renewal count, and Section 5 bars an abstention outcome from being spent as a decrement.

Compared With Reputation Decay, Conformity Detection, and Revocation

Several established categories decay or withdraw something. The distinctions the filing draws are structural.

Reputation values with decay and probation. Background systems maintain a reputation value for a computing entity, apply decay and penalty values, place the entity into a probationary status, and remove that probation after sustained standing; U.S. Patent No. 12,526,244 is the example the filing discusses. Such a score is computed from ratings supplied by other entities and sits at a registry, a scoring authority, or a shared ledger, the scored entity neither holding it nor participating in its computation; in that example, clean elapsed operation is itself the restorative input. Under the disclosed mechanism, operation within the class depletes the quantity, and restoration follows only a recorded receipt implicating that class from an origin-equivalence class (200) absent from the register. Aggregator-side rating filters, exemplified in the filing by the TRAVOS trust model and by beta-reputation filtering, share that posture: filtering is exercised by a disinterested aggregator at no cost to it, whereas the metered quantity here sits in the agent's own memory field (102).

Conformity detectors. Behavioral-integrity systems compute a conformity measure between an agent's observed execution signals and a baseline model of expected behavior, compare that measure against a threshold, and reduce capability upon a deficient comparison; U.S. Patent No. 12,563,045 is the example the filing discusses. Such systems have exactly one direction: divergence narrows capability. No conformity measure against a baseline is computed here; what moves the authorization quantity is whether an admissible evaluation implicating the class was recorded from an uncounted class.

Policy decision points and ethical governors. Systems implementing the XACML standard return a decision drawn from permit, deny, not-applicable, and indeterminate. That result is directed at the request: it produces no persistent state in the deciding entity and constrains no subsequent operation of the decider. An authorization quantity is instead persistent state in the deciding entity, constraining that entity's own later dispatch. Ethical governor architectures are characterized in the filing as credulous and monotonic, the governed action set only ever contracting in response to an evaluative signal.

Capability attenuation and external revocation. Attenuation schemes such as macaroons confine a delegate by appending caveats along the forward path of a delegation, protecting the owner of the delegated resource and operating forward only. External revocation systems issue and withdraw credentials from an identity provider or control plane, terminating an agent's ability to act by an act of the controlling authority, with no procedure by which the agent's own conduct record participates and no state in which it continues to reason while withheld. Here the elapsed measure is executions within the action class or successor epochs of the agent's own hash chain, the withheld state (310) preserves the non-executing cognitive mode (302), and return runs through a procedure appended to the agent's own lineage record.

These categories are described as prior art in order to locate the boundary of the disclosure, and not as any assertion about the products or conduct of any party.

Disclosure Scope

Correction-exposure decay of an authorization quantity is disclosed in U.S. Provisional Application No. 64/117,812, at Section 10.1, paragraph [0343], together with the paragraphs it composes with in that section and in Sections 4, 5, 9, 10.2, 10.6, 10.7, 10.8, and 10.11. This article is published as a defensive technical disclosure of that subject matter. It is not a claim construction, an opinion of counsel, or an assertion regarding any third party, and the filed application controls over this summary.