Two Withholdings That Look Identical From Outside

An agent that has stopped executing presents the same surface no matter why it stopped: the action does not dispatch, and a record says the gate is closed. From that surface alone, an operator, a counterparty, and the agent itself cannot tell whether the closure records that someone was harmed or only that nobody has looked.

The architecture of U.S. Provisional Application No. 64/117,812 writes the withheld state (310) of the authorization gate (300) from several unrelated causes: a refusal counter (304) incrementing upon the agent's own refusals of conduct evaluation artifacts (116), a deviation quantity satisfying a declared bound, the authorization budget (404) satisfying its floor, and an authorization quantity reaching its floor for want of anything asserted about the agent across a declared elapsed measure.

Two filed constraints make one undifferentiated flag expensive. The withheld state (310) persists irrespective of elapsed time, no expiry interval being applied to it, and a restoration controller returns the gate toward the granting state only upon a procedure appended to the append-only lineage field (104), no elapse of time and no consideration by any counterparty returning it. A determination the agent produces while the gate stands withheld is appended to that field but does not write the gate to the granting state, so the agent cannot clear its own withheld state by producing further determinations.

Waiting is closed and self-certification is closed, leaving the return to be an external recorded event. Define one such event for every withheld state and a harm-sourced withholding is discharged by something establishing nothing about the harm; define one repair procedure instead and a withholding written for absence of evaluation sits behind steps presupposing an injured party.

Keying the Return to the Cause That Was Written

The disclosed answer makes the class of the key a function of the recorded class of the lock.

Start with the quantity that decays. The agent maintains an authorization quantity, a scalar held per action class and per scope partition in the memory field (102) and initialized from the signed policy object (112). Upon each execution within the action class, and upon each advance of a successor epoch of the agent's hash chain, it computes an elapsed measure since the last renewal and applies a monotonically non-increasing decay function parameterized by a declared decay constant, being an exponential half-life or a declared linear decrement per unit. The decayed value is written to the memory field (102) and appended to the lineage field (104). On reaching a declared floor, the authorization gate (300) is written to the withheld state (310) for that action class and the escalation record is emitted to the principal. In that state the agent does not execute actions of the class and enters the non-executing cognitive mode (302), in which speculative evaluation continues without committing state changes.

Renewal is not an internal event. Per action class and per scope partition, the agent maintains a register of identifiers of origin-equivalence classes (200) from which an admissible conduct evaluation artifact (116) implicating that class has been received within a declared window, each entry expiring on window elapse. On receiving an admissible artifact, the agent computes the asserting party's (118) origin-equivalence class (200). A class already present in the register applies no renewal; a class absent from it renews the authorization quantity to a declared value, writes an entry, and has the renewal appended to the lineage field (104) before and independently of the determination produced. Any of the four determinations (122, 124, 126, 128) renews by one and the same amount, so renewal is valence independent and cannot be manufactured by repeated evaluation from a single source.

Affirmative limb. Where the authorization gate (300) was written to the withheld state (310) by the authorization quantity reaching its floor, a renewal by an uncounted origin-equivalence class (200) returns the gate to the granting state for that action class and exits the non-executing mode. The filed text applies that return without a principal-resolution object, without an acknowledgment artifact, and without an acceptance determination, the withholding having arisen from absence of evaluation rather than from an accepted determination (122) recording harm.

Negative limb. Where instead the gate was withheld by a deviation quantity or by a procedure of the provisional-restoration mechanism, the renewal returns it by no procedure, and it is returned only under the path applicable to the withholding that was written. That path is longer. On a request to leave the withheld state (310) after a deviation write, the agent computes a causal set of the deviation quantity. Where that set holds an accepted determination (122) from an asserting party (118) other than the principal, the deviation is externally sourced, and the gate returns only to its provisional granting state and only on a principal-resolution object bound to the emitted escalation record. The agent then executes under a provisional marker and issues an acknowledgment artifact whose issuance decrements the authorization budget (404) gating action dispatch, and an asserting party (118) assigned to the harmed origin-equivalence class (200), rather than the agent or its principal, produces the acceptance determination transitioning the gate to the granting state.

A further embodiment addresses overlap between two of the writing structures: where the refusal counter (304) and the deviation quantity have each written the gate, it holds the union of the classes enumerated by every write not yet returned, and a class in the intersection returns only upon satisfaction of each such write's return procedure.

How much a renewal is worth is conditioned separately again. The amount by which it raises the authorization quantity, and the amount by which it replenishes the authorization budget (404), are each a monotonically non-decreasing function of the count of recorded severance events across the constituent edges of the renewing origin-equivalence class (200), a class each of whose edges resolves not-typeable renewing at a declared least amount. A principal standing up fresh identities that classify into classes bearing no recorded severance event renews its own agent's authorization at that least amount and does not restore full authorization.

Declared Bounds Rather Than Fixed Constants

The filed disclosure states this mechanism in quantities the principal declares in the signed policy object (112), reciting no numeric value for any. Declared parameters include:

  • the decay constant, as an exponential half-life or a linear decrement per unit of the elapsed measure
  • the floor of the authorization quantity, on reaching which the gate is written to the withheld state (310)
  • the value to which a renewal restores the authorization quantity
  • the window governing the register of counted origin-equivalence classes (200), each entry expiring on its elapse
  • the elapsed-measure basis, being executions performed within the action class or successor epochs advanced, declared per action class
  • the replenishment schedule amount and the authorization budget ceiling (408), any excess above that ceiling being discarded and not carried forward
  • the short decay constant applied where the action class is an untested class

One bound is not a free constant. A recorded inter-arrival estimator, computed by the agent over its own lineage field (104) alone as a declared measure of central tendency of the intervals between successive entries of a named kind, each interval counted in successor epochs of the hash chain, supplies the lower bound of the observation and register windows, binding them to the agent's own recorded arrival rate rather than to a wall-clock constant; on fewer than the declared count of intervals it returns a declared default. Elapsed time therefore parameterizes the decay while parameterizing no return, and no expiry interval attaches to the withheld state (310).

A degraded-read condition is declared as well. Where the register of authorization quantities cannot be read, no renewal and no decay apply, the quantity is held with the condition appended, and decay resumes from the held value upon a successful re-read at a declared cadence; a hold subsisting for a declared maximum interval draws a structured inquiry to the principal, without writing the authorization gate (300).

Position Within the Correction-Exposure Chain

This mechanism is the fourth link in a five-paragraph run within one section of the filing. Correction-exposure decay supplies the quantity and the write; uncounted-class renewal gated by a windowed register supplies the event that raises it; renewal-side replenishment adds that the same event, by the same procedure, restores metered spending capacity in the authorization budget (404). The paragraph treated here fixes which withholdings that event reverses; the severance-conditioned amount, by how much.

The two quantities stay separate. An authorization quantity is a scalar per action class and per scope partition, each partition also carrying its own segment of the lineage field (104); the authorization budget (404) is maintained per agent across the action space. Neither is computed from the other, and neither is expressed in the units of the other.

Cause-keying runs a second time on the budget side. Where the gate stands withheld by reason of the authorization budget (404) having satisfied its declared floor, and a replenishment raises the budget above that floor, the gate is returned to the granting state for the action classes enumerated upon that write and for no other, the agent exits the non-executing cognitive mode (302) as to those classes, and the return is applied without a principal-resolution object and without an acceptance determination, no entry adverse to the party whose artifact occasioned the replenishment being appended. Where the gate stands withheld by any procedure other than that budget write, the replenishment returns it by no procedure.

Upstream, a separate group of paragraphs governs how quickly an agent reaches a decay-induced withholding at all. Depletion rate is set as an inverse function of a count of corrective encounters recorded for that action class with which the agent subsequently complied. Where that count is zero the class is untested and the decay constant is set to a short declared constant, so the quantity falls to the floor notwithstanding volume or duration of prior execution. The compliance count that lengthens the constant is computed per origin-equivalence class (200) of the correcting parties, bounded above by a declared maximum.

Two express non-paths close an obvious workaround. Appending a deference record (900), receiving a deference counter-signature (902), and executing under an adopted determination each renew no authorization quantity and replenish no authorization budget (404) of the deferring agent; a deference also records no corrective encounter and does not lengthen that agent's decay constant.

Adjacent Families: Session Expiry, Trust Scores, Operator Override

Several established families address neighboring problems. Distinctions below are structural, and nothing here asserts that any product, party, or system practices the disclosed subject matter.

Time-bounded credentials and lease renewal. A credential decays against a clock and is restored by re-authentication or a refresh grant. Here elapsed time restores nothing, and the restoring event is receipt of an admissible artifact from an origin-equivalence class (200) absent from a windowed register. What returns the gate is who evaluated the agent, not possession of a token.

Circuit breakers and rate limiters with half-open recovery. Recovery is probed on a cooldown timer and reopened by a trial the guarded component runs on itself. The filing forecloses both halves: no expiry interval applies to the withheld state (310), and a determination the agent produces while withheld does not write the gate to the granting state.

Reputation and trust scoring. Favorable and unfavorable signal accumulate into a scalar gating action at a threshold, so enough favorable signal offsets a recorded harm. Renewal here is valence independent, leaving no favorable channel to accumulate, and a renewal returns a decay-induced withholding while returning a deviation-sourced or provisional-restoration-sourced withholding by no procedure.

Human-in-the-loop approval and administrative override. Restoration vests in a privileged operator who clears the flag without regard to why it was set. That authority is unnecessary on one path and insufficient on the other: the decay-induced return is applied without a principal-resolution object, while an externally-sourced deviation return runs only to the provisional granting state, full granting coming from a party of the harmed origin-equivalence class (200).

Acknowledgment and remediation workflows. Access reopens on issuance of a repair artifact. The filing prices that artifact against the authorization budget (404) that gates dispatch, then excludes it from the decay path, which requires no acknowledgment artifact and no acceptance determination.

Delegation and capability attenuation. Rights narrow as they pass downward and cost falls on the relying party. Under this disclosure, deference renews no authorization quantity of the deferring agent.

Disclosure Scope

The mechanism described here, a distinct return path for decay-induced withholding, is disclosed in U.S. Provisional Application No. 64/117,812 at Section 10.1, paragraph [0346]. Surrounding paragraphs supply the elements it composes upon: correction-exposure decay at [0343], uncounted-class renewal gated by a windowed register at [0344], renewal-side replenishment at [0345], and the severance-conditioned renewal amount at [0347]. The alternative restoration paths from which this return is distinguished appear at [0338] through [0341], and the parallel budget-floor return at Section 4.5, paragraph [0146]. This article describes that filed disclosure and is published as a technical publication; it grants no license and creates no rights in the disclosed subject matter.