A stranger arrives with a correction and nowhere to put it

An autonomous agent receives a message saying that an action it took last week was wrong. The sender is a party it has never dealt with. The signature checks out, so the agent knows the message came from the key it claims. Whether the complaint should reach the agent's admission evaluator is a separate question, and the disclosed architecture answers it with a different kind of record.

The conventional answer is a presented credential: something upstream vouches, the receiving party inspects it, decides it is good enough, and proceeds. That works because a venue holds the underlying facts and displays a conclusion drawn from them.

Remove the venue and two things happen. The presented quantity stops being computable, since it was always computed out of data one party held. And the direction of cost stays where it was: the party relied upon collects the benefit while the relying party carries the risk. Conventional delegation and capability-attenuation designs formalize that flow, attenuation narrowing only the capability passed downward.

LinkedIn verification, as publicly described

LinkedIn is a professional networking platform, and the problem it set out to solve deserves stating plainly, because the design answers that problem well.

As publicly described, a member maintains a profile stating work history, education, and skills, and connects to other members, who can endorse listed skills and write recommendations that appear on the profile. Public materials also describe verification features that let a member confirm aspects of identity or an association with a workplace or educational institution, with the result surfaced on the profile so a viewer can see which claims have been checked against something outside the member's own assertion. The purpose, as publicly stated, is to raise confidence that a person is who they say they are.

That design is coherent on its own terms. One operator holds the graph and the profile data, so a member's history can be presented in one place and compared across members, and the same operator sets policy on the accounts behind those profiles. Verification runs against sources outside the member, giving a viewer a signal the member could not simply write for themselves.

Two structural properties follow from that design goal rather than from any shortcoming in execution. The presentation is a presentation: a viewer is shown a conclusion about identity and affiliation, and decides what to do with it. And the conclusion is computable because an operator holds the underlying records, which is the condition that makes presenting it possible at all. Neither observation is a criticism. What the disclosed architecture describes is a different thing, and the comparison below is structural rather than an audit of anyone's product.

Deference records, a metered counter-signature, and the classes that follow

Section 9 of the filed provisional removes the venue, the presented quantity, and the adjudication.

A first agent, the deferring agent, holds a request to dispatch an action of an action class and finds its dispatch-authority predicate satisfied upon recomputation from its memory field (102). Authorized on its own record to determine the matter for itself, it elects instead to execute under a determination of the closed set recorded in the lineage field (104) of a second agent, the followed agent. An agent whose predicate fails, whose authorization gate (300) stands in the withheld state (310), or which has entered the non-executing cognitive mode (302) does not defer at all; its holding is a withholding, not a following.

Before a deference record (900) is given effect, the deferring agent applies the origin-disjointness test, asking upon its own records whether it and the followed agent are assignable to a common origin-equivalence class (200). Where they are, the record is appended as an attempted deference record and given no effect: it decrements no authorization budget (404), enrolls no class, and appends nothing adverse to the followed agent. The declining is a positive abstention.

The deferring agent then retrieves a followed determination record and runs a retrievability-form verification of three ordered conjuncts: the presented authority credential and continuity hash field, the tested-entry enumeration against a lineage commitment, and membership of the determination in the closed set with a matching action class. That record carries an identifier and successor index of the signed policy object (112) in force for the followed agent at the recorded assertion time, anchoring it to a position in that agent's own policy succession. The verification is of form and of retrievability and not of merits: the deferring agent does not retrieve the enumerated entries, does not re-derive the determination, and produces no determination concerning the followed agent's conduct.

The cost arrives at counter-signature. The followed agent verifies the record, and electing to counter-sign, appends a deference counter-signature (902) and by that append decrements its own authorization budget (404), being the budget gating its own non-advisory dispatch, under a deference decrement schedule declared in its signed policy object (112). The schedule declares an amount not less than that declared for issuance of a conduct evaluation artifact (116) by that agent, and is a monotonically non-decreasing function of a count of counter-signatures appended within a declared window, so the marginal cost of being followed rises with the rate of adoption. The disclosed forms are a step function and a linear form, the one applied being declared in that agent's own policy object, bounded above by a declared maximum. The decrement occurs without regard to whether the deference was well founded, no party adjudicating that question as a condition of it.

Responsive to that counter-signature, and not otherwise, the deferring agent retrieves a corrector-class enumeration (904): the origin-equivalence classes (200) recorded both as having corrected the followed agent in that action class and as having had those corrections thereafter conformed to by it. Both parts of the conformance filter (906) must hold; a class satisfying correction without subsequent conformity is excluded. No rating, weight, score, endorsement, vouch, or standing quantity of the followed agent is consumed in computing it. Each enumerated class is written into the deferring agent's replenishment register (402) as an admissible-but-unexercised entry, keyed on a class-defining reference rather than on any identifier local to the followed agent.

That entry has two effects and no third. A conduct evaluation artifact (116) from a party assignable to the class is admissible to the deferring agent's admission evaluator (120) notwithstanding that it holds no prior encounter history with that party, and is not held in the pre-settlement inert state on that ground. For renewal, the entry is not counted while its exercise field stands at the unexercised value.

Where the two designs diverge

The category is shared: making a party nobody has met treatable as accountable. Three things differ underneath.

  • What is transferred. A presented identity signal travels to the viewer as a conclusion. In the filed mechanism no rating, score, standing quantity, or credential passes between agents at all; what passes is a record of conduct and a class-defining reference each agent evaluates against its own records.
  • Who pays. The metered consequence falls on the followed agent, in the units of that agent's own capacity to dispatch, and rises with the rate of adoption. The filing states expressly that this inverts the conventional direction, in which cost falls on the relying party and the party relied upon is protected.
  • What is earned. The deferring agent earns admissibility: a channel through which a specific set of classes can reach its admission evaluator. It acquires no credibility with those parties and receives no rating from them, and nothing transmitted describes the followed agent's standing.

Convergence is real as well. Both designs treat unverified self-assertion as insufficient, and both look outside the asserting party for something other than what that party wrote about itself.

Complementary layers, and the limits the design sets

The mechanism operates at a different layer from the job LinkedIn does. A hiring manager reading a career history wants a readable presentation of who a person is, checked where checking is possible, and a platform holding the graph suits that. The filed architecture sits at the machine-to-machine layer underneath, where an agent decides whether an arriving correction is admissible and whether being widely followed should be free. The two layers can run together: platform verification bears on whether a principal is who it claims, while the disclosed records govern what the agents acting for those principals execute under, and what it costs them to be relied upon.

The limits below are limits of design, not of implementation.

Enrollment confers admissibility alone. Until an artifact arrives and exercises the entry, nothing is renewed, and the deferring agent's quantities stand as they would have stood had the entry never been written. Nor does the mechanism evaluate whether an adopted determination was correct: the deference correction linkage record is expressly not a determination that the adopted determination was ill founded.

Several quantities are policy-declared rather than fixed by the disclosure: the counter-signature and reinstatement windows, the budget floor, the terms of the decrement schedule apart from one illustrative embodiment, the observation interval, and the maximum chain depth. Outcomes gated on those bounds follow only where an agent's own policy object declares them, and not unconditionally. The escalation to the withheld state (310) is written responsive to the authorization budget (404) satisfying a floor declared in the followed agent's own policy object, for an enumerated set of action classes.

A declined counter-signature is not a denial. It is recorded as a not-determinable determination (126) identifying the counter-signature as an unavailable input, and the deferring agent may still execute, appending an ungoverned reliance record and a reliance-bound narrowing record that narrows its own counterparty scope object held for the followed agent. That narrowing is not a sanction, and it is released upon a counter-signature within the reinstatement window.

Where two followed agents present determinations of differing outcome class upon one conduct descriptor, the deferring agent adopts neither. It appends a deference conflict record naming both, and either determines the matter itself or withholds dispatch as a positive abstention.

Disclosure Scope

This article describes subject matter disclosed in U.S. Provisional Application No. 64/117,812, filed by Adaptive Query. It is published as a technical explanation of the filed disclosure. It is not legal advice, is not an offer to license, and does not assert that any claim has issued or that any product falls within any claim. The application is pending, and any claims that issue may differ in scope from what is described.

References to LinkedIn verification are to public materials and are used for comparison only; no relationship, endorsement, or infringement is asserted.