The Graduated Actuation Mode Selector

Mechanism

Every physical actuation by an autonomous, semi-autonomous, or operator-assisted governed unit is evaluated through the composite admissibility evaluator prior to execution. The graduated-actuation mode selector consumes the composite admissibility determination for a proposed actuation and selects one of a plurality of actuation modes for execution. The plurality of modes is governance-policy-defined per actuator class, per authority level, per deployment domain, and per admissibility-determination output. The selector produces a continuous and bounded mapping from the composite admissibility determination to actuation mode, rather than a binary permit-or-deny decision.

The plurality of actuation modes comprises, at minimum and without limitation: a disabled mode, wherein the actuator does not execute the proposed actuation and the non-execution is lineage-recorded; a simulated mode, wherein the actuator executes a dry-run without physical effect, supporting pre-deployment verification and what-if analysis; an advisory mode, wherein the actuator emits a governance-credentialed advisory observation recording what actuation would have been taken without physically executing it; a consultative mode, wherein the actuator emits a consultation request to a human operator, a higher-authority agent, or a governance-policy-defined consultation endpoint and awaits confirmation before execution; a shadowed mode, wherein the actuator physically executes the proposed actuation and additionally emits an advisory observation recording an alternative actuation path for shadow-evaluation; a partial mode, wherein the actuator executes at fractional magnitude, reduced rate, reduced precision, or reduced scope; a constrained mode, wherein the actuator executes subject to additional governance-policy-defined constraints; a stage-gated mode, wherein the actuator executes in a sequence of stages with admissibility re-evaluation between stages; a deferred mode, wherein the actuator executes at a later time upon satisfaction of a deferral condition; a full mode, wherein the actuator executes at nominal magnitude, rate, precision, and scope; and an emergency-accelerated mode, wherein the actuator executes at elevated magnitude, rate, or priority upon emergency preemption. The mode set is not limited to the enumerated modes; it admits any combination of the foregoing and any future governance-policy-defined mode that preserves the governance chain.

The mapping is governance-policy-configurable per actuator class. As composite admissibility rises, the selector transitions the selected mode through increasingly autonomous modes, for example disabled, simulated, advisory, consultative, constrained, stage-gated, full; as composite admissibility falls, the selector transitions toward less autonomous modes. The continuous mapping enables graceful degradation under conditions of reduced confidence without forcing a binary outcome of either unconstrained execution or complete cessation. Every selection, including a selection that results in the disabled mode, emits a lineage record capturing the composite admissibility determination, the selected mode, and the resulting actuation.

Operating Parameters

The mode mapping is governance-policy-defined per actuator class, per authority level, and per deployment domain. The governance policy determines which modes are admissible for a given actuator and how the composite admissibility determination maps onto the mode set. The selector itself does not estimate admissibility; it consumes the composite admissibility determination produced by the composite admissibility evaluator and applies the policy-configured mapping.

Confidence thresholds are associated with each actuator and are governance-policy-defined. A reversibility-aware commitment-point evaluator elevates admissibility thresholds for proposed actuations classified as irreversible or as having irreversible sub-steps, and a path-preference engine prefers reversible actuation paths over irreversible paths where both are admissible. Emergency-preemptive authority can override ordinary confidence thresholds and compel execution at an elevated mode, subject to the preemption-budget and expiration constraints described below.

Each mode carries its own execution semantics. Full mode executes at nominal magnitude, rate, precision, and scope. Partial mode executes at fractional magnitude, reduced rate, reduced precision, or reduced scope relative to nominal execution. Constrained mode executes subject to one or more additional governance-policy-defined constraints, which may include a maximum magnitude limit, a maximum rate limit, a geographic restriction, a temporal restriction, or a conditional predicate. Stage-gated mode executes the actuation in a sequence of stages with admissibility re-evaluation between stages, enabling interruption or modification between stages. Deferred mode executes the actuation at a later time upon satisfaction of a governance-policy-defined deferral condition. Simulated mode executes a dry-run of the proposed actuation without physical effect and records the simulated execution in the lineage field.

The emergency-accelerated mode is reached upon emergency preemption. A governance-credentialed observation carrying emergency-preemptive authority can override ordinary confidence thresholds and escalate the selected mode to emergency-accelerated. A preemption-admissibility evaluator verifies the authority credential, the continuity-based identity, and the temporal, geographic, and preemption-class scope of the directive. A preemption-budget enforcer limits the rate at which a preempting authority may issue directives within a governance-policy-defined temporal window; exhaustion of the budget suspends further preemption admissions from that authority for the remainder of the window, with the suspension lineage-recorded. A preemption-expiration enforcer discards preemption observations whose governance-policy-defined validity duration has elapsed.

Alternative Embodiments

The confidence-governed execution primitive is medium-agnostic, substrate-agnostic, modality-agnostic, and domain-agnostic. The graduated-actuation mode selector governs every action of a braking system, a steering system, a propulsion system, a gate actuator, a valve actuator, a suppressant-deployment actuator, a flight-control actuator, a payload-release actuator, a manipulator-arm actuator, a door-lock actuator, a barrier actuator, a medical-dispensing actuator, a surgical-tool actuator, an access-control actuator, a ventilation-damper actuator, an irrigation-valve actuator, or any other actuated physical effector, each treated as a governed mutation subject to the composite admissibility evaluator.

The mode set itself admits variation. The plurality of actuation modes is governance-policy-defined per actuator class, per authority level, and per deployment domain, and the disclosure does not limit the mode set to the enumerated modes. Embodiments may add any combination of the enumerated modes, and any future governance-policy-defined actuation mode that preserves the governance chain. The mapping from composite admissibility to mode is governance-policy-configurable per actuator class, so deployments with differing reversibility and operator-involvement requirements configure differing mappings without re-engineering the selector.

The selector supports mode escalation and mode de-escalation. Upon emergency preemption, an emergency-authority directive elevates the selected mode from a nominal mode to the emergency-accelerated mode, with the escalation recorded in the lineage field together with the preemption authority credential and the preemption scope. Upon detection of reduced composite admissibility during execution, an actuation already in progress at a first mode is transitioned to a reduced mode, for example constrained, partial, simulated, or disabled, in response to a newly consumed observation, a newly computed forecasting observation, a newly updated dispositional field, or any newly arriving input indicating reduced admissibility. Mode de-escalation during execution is recorded in the lineage field with the triggering input and the transition timestamp.

Operator-involvement modes embody the human-in-the-loop disciplines disclosed for the mode set. Advisory mode emits a governance-credentialed advisory observation supporting human-in-the-loop review and shadow-deployment data collection, while consultative mode emits a consultation request to a human operator, a higher-authority agent, or a governance-policy-defined consultation endpoint and awaits confirmation before execution. The consultation endpoint is governance-policy-defined, so the same mode semantics apply whether ratification arrives through an onboard interface, a remote link, or a review endpoint.

Composition

The graduated-actuation mode selector composes within a structured actuation chain. The chain proceeds through observation consumption, composite admissibility evaluation, mode selection, actuator command at the selected mode, post-actuation observation, post-actuation verification, actuation-state broadcast, and post-execution lineage recording. The selector only further constrains commit authority: where composite admissibility supports execution it selects a mode under which the actuation proceeds, and where admissibility is inadequate it selects a reduced or disabled mode. The selector adds graduated commitment above the existing evaluation rather than relaxing any constraint.

The selector composes with the composite admissibility evaluator, which consumes authority-credentialed observations, the dispositional field, forecasting observations, and the capability envelope. Where multiple cognitive primitives propose conflicting actuations, an actuation arbitration mechanism produces a single selected actuation through governance-policy-defined priority, authority weighting, composite-admissibility comparison, or any governance-policy-defined arbitration function, and each arbitration event is recorded in the lineage field.

The selector composes with downstream effect confirmation. A post-actuation verification mechanism compares the observed effects of an executed actuation against the expected effects and modulates subsequent actuations in accordance with the comparison, providing closed-loop refinement that prior architectures terminating at actuator command do not. An actuation-state broadcast mechanism emits a governed actuation-state observation to the mesh recording the executed actuation, enabling cross-unit coordination. Each mode selection, preemption event, commitment-point determination, harm-minimization selection, and verification outcome is preserved in a governance-chain-preserving lineage record.

Because the mode mapping is governance-policy-configurable per actuator class, per authority level, and per deployment domain, the selector adapts to differing governance policies without re-engineering. A deployment changes the admissible mode set and the admissibility-to-mode mapping by loading a differing governance policy under the appropriate credential, with the policy in force recorded in the lineage of each mode selection.

Prior-Art Distinction

Conventional sensor-actuator architectures, including programmable logic controllers, supervisory control and data acquisition systems, electronic control units, cloud-connected Internet-of-Things platforms, and conventional digital-twin platforms, operate on anonymous or homogeneously authenticated sensor signals without authority-taxonomy semantics, without composite admissibility evaluation, without graduated response modes, and without lineage-recorded provenance chaining each actuation to its contributing observations. The architecture disclosed here evaluates each proposed actuation through a composite admissibility evaluator consuming authority-credentialed observations, the dispositional field, forecasting observations, and the capability envelope, then executes at a selected mode from a plurality of graduated modes rather than executing or suppressing in binary.

Prior interlock, prior emergency-stop, and prior functional-safety emergency mechanisms provide no rate or temporal constraint on emergency authority. Here, an authority-credentialed preemption overrides ordinary confidence thresholds subject to a preemption budget and an expiration window, where prior architectures provide interlocks without budget semantics. The preempted actuation is recorded in the lineage field with the complete preemption-provenance chain, and the preemption operates uniformly across actuator classes and deployment domains rather than being domain-specific.

Prior architectures treat actuations uniformly regardless of reversibility and terminate at actuator command without verification closure. Here, a reversibility-aware commitment-point evaluator prefers reversible actuation paths where feasible and elevates admissibility thresholds for actuations classified as irreversible. A harm-minimization deviation mechanism evaluates self-damaging paths as admissible candidates when they minimize composite projected harm under a governance-policy-defined entity-class harm ordering, where prior architectures exclude such paths categorically.

Prior architectures confine actuation state to the executing system. Here, the actuator publishes governed actuation-state observations back to the mesh, enabling cross-unit coordination, and a governance-chain-preserving lineage record captures every actuation evaluation, mode selection, preemption event, commitment-point determination, harm-minimization selection, and verification outcome, so the basis for each actuation is reconstructable from recorded inputs.

Disclosure Scope

This article describes subject matter disclosed in U.S. Provisional Application No. 64/049,409. The disclosure encompasses the graduated-actuation mode selector independent of actuator technology and deployment domain. The inventive contribution lies in mapping a composite admissibility determination to one of a plurality of actuation modes rather than a binary permit-or-deny decision; in the continuous and bounded mapping that enables graceful degradation; in mode escalation upon emergency preemption subject to a preemption budget and expiration window; and in lineage-recorded provenance for every mode selection. Embodiments described herein are illustrative. The plurality of actuation modes is governance-policy-defined per actuator class, per authority level, and per deployment domain, and is not limited to the enumerated modes; any combination of the foregoing and any future governance-policy-defined mode that preserves the governance chain falls within the scope of the disclosure.