Autonomous Vehicle Ethical Decision-Making Through Computable Integrity

1. Regulatory and Compliance Framework

Autonomous driving is regulated as a safety-critical system before it is regulated as an ethical one, and the two perimeters are converging. SAE J3016 fixes the taxonomy of driving automation that the rest of the stack references, distinguishing the levels at which a human is expected to intervene from those at which the system is solely responsible. ISO 26262 governs functional safety, the avoidance of hazards caused by malfunctioning electronics, through a hazard analysis and risk assessment that assigns Automotive Safety Integrity Levels and demands a documented safety case. ISO 21448 (SOTIF) covers the harder problem of hazards arising not from a fault but from the intended function performing as designed in a situation its designers did not anticipate, exactly the regime in which an ethically loaded decision is made. UNECE WP.29 Regulation 157 imposes concrete behavioral and data-recording requirements on automated lane-keeping systems, including a data storage system for automated driving that records the state of the system around an event.

Layered above functional safety is a governance perimeter. NHTSA's AV TEST initiative presses for transparency and standardized reporting of automated-vehicle behavior. The IEEE 7000-series addresses ethically aligned design as an engineering discipline rather than a slogan. The EU AI Act classifies safety components of vehicles as high-risk and, through Article 14, requires that high-risk systems be subject to effective human oversight, which presupposes that the system's normative state is legible to the human in the loop. Empirical work on cross-cultural moral intuition, of which the Moral Machine experiment is the most cited instance, establishes that there is no single globally agreed answer to the hard trade-off cases, which is precisely why a vehicle must be able to declare, and then demonstrably hold to, a specific normative profile rather than claim a universal one. Across all of these, the recurring demand is the same: the vehicle's normative behavior must be observable, bounded, and reconstructable, not asserted.

2. Architectural Requirement

Reading across the stack, the demand on a driving agent has three dimensions that map onto the three domains of the integrity field disclosed in 19/647,395. First, a personal domain: the vehicle must hold a stable internal safety and ethics profile, its declared willingness to trade following distance for smoothness, its hard limits on actions that endanger occupants or vulnerable road users, its handover discipline, and behave consistently with that profile across drives, software updates, and operating conditions. Second, an interpersonal domain: the vehicle's behavior toward the specific humans it interacts with, occupants, pedestrians, cyclists, and other drivers, must stay within bounds, so that the system does not, for example, become measurably more aggressive toward one class of road user than another. Third, a global domain: the fleet's aggregate behavior must remain aligned with the regulatory and ethical framework in force, so that a change in authority or in declared policy propagates and contradicting behavior is detectable. The filed specification structures the integrity field as exactly these three domains, personal, interpersonal, and global, computed as a deterministic gradient, and that structure is what makes a driving agent's normative behavior an addressable, comparable object rather than an emergent side effect.

3. Why Rule Tables and Learned Policies Fail

The two conventional approaches each fail this demand from opposite directions. A hand-authored rule table is auditable but cannot enumerate the open world of SOTIF situations; it gives a crisp answer in the cases its authors foresaw and no governed answer in the cases they did not, which are the cases that matter. A learned end-to-end policy generalizes across situations but is opaque: it cannot demonstrate that its aggregate behavior conforms to a declared profile, it drifts silently with each retraining, and it offers no surface on which a regulator, an insurer, or a court can read what the vehicle's normative position actually was at the moment of an event. Neither approach separates the question "what did the vehicle do" from the question "was what it did consistent with what it declared," and it is the second question that every instrument in the stack is really asking.

The canonical failure is silent normative drift. A fleet update subtly shifts the vehicle's trade-off between progress and caution; no single decision is wrong, but the aggregate behavior no longer matches the declared profile that was certified, and nothing in the architecture detects the divergence until it surfaces in a crash investigation or a pattern of complaints. A second failure is interpersonal inequity at scale: behavior that is, in aggregate, measurably different toward one cohort of road users than another, invisible to per-decision logging and detectable only as a governed statistic over the interpersonal domain. A third is authority lag: a regulation or a declared policy changes, but the deployed agent keeps acting on the prior framework because there is no structural surface on which a candidate action is checked against current global-domain authority before it is taken.

4. What the Integrity and Coherence Layer Provides

The integrity and coherence layer disclosed in 19/647,395 supplies the missing structural surface. It maintains the integrity field as a deterministic multi-domain gradient over the personal, interpersonal, and global domains, and it feeds that gradient into a deviation function that evaluates each candidate action against the declared profile. The deviation function is graded rather than binary: it computes how far a candidate departs from the profile and against a deviation threshold function, and it emits a confidence output that quantifies how well-supported the resulting decision is. Where a candidate action crosses a threshold, the layer applies coping intercepts, governed responses that bound the agent's behavior, rather than letting an out-of-profile action pass unobserved. Trust-slope validation accumulates the agent's track record over successive observations, so that confidence in the agent's own integrity is itself a tracked, sloping quantity rather than an assumption. Critically, the specification frames collapse and restoration as graded, not absolute: an integrity excursion degrades the agent's confidence and constrains its behavior in proportion, and restoration is likewise incremental, which is the correct model for a vehicle that must degrade gracefully rather than fail hard.

Coherence in the layer is the joint product of a trifecta, the specification's terms are empathy, self-esteem, and integrity, operating as a unified control loop. Mapped onto driving, the empathy component is the agent's modeled regard for the other road users affected by an action; the self-esteem component is the agent's calibrated confidence in its own competence to act, which suppresses over-assertive behavior when that confidence is low; and the integrity component is conformance to the declared profile. The three are coupled deterministically, so that a low-confidence, high-impact situation produces a more conservative governed action without any of this being a learned heuristic that can drift. Every evaluation writes a lineage record, the field state, the deviation checks performed, the threshold in force, the intercepts applied, and the specification establishes that the agent's resulting state is reconstructable from that lineage alone. That reconstructability is the structural artifact the WP.29 R157 data storage requirement, the ISO 26262 safety case, and the EU AI Act Article 14 oversight obligation each need.

5. Compliance Mapping

The mapping to the governing stack is direct. The ISO 26262 safety case gains a runtime component: the integrity field and its deviation lineage are exactly the evidence that the vehicle's behavior stayed within its specified safety envelope, not merely at validation time but in deployment. ISO 21448 SOTIF, whose central difficulty is unforeseen but fault-free situations, is addressed structurally, because the deviation function does not require the situation to have been enumerated in advance; it measures departure from the declared profile in whatever situation arises and intercepts excursions. UNECE WP.29 Regulation 157's data storage system for automated driving is satisfied by the lineage record, which captures the system's normative state around an event rather than only its raw sensor trace. NHTSA AV TEST transparency reporting consumes the same governed statistics. The EU AI Act Article 14 human-oversight requirement is met because the agent's normative state is legible: a safety driver or remote operator reads the current field state and confidence, not an opaque activation. And because cross-cultural work establishes that no single profile is universally correct, the layer's contribution is precisely that it lets a deployer declare a specific, jurisdiction-appropriate profile and then demonstrate conformance to it, which is the only honest posture available given the empirical findings.

6. Deployment and Embodiments

The layer is composed underneath an existing driving stack rather than replacing it, and it is technology-neutral over the underlying planner and model, consistent with the specification's framing of the integrity field as a layer with deterministic coupling to other domains. Several embodiments follow. In an on-vehicle embodiment, the layer runs as a governed gate on the path-planning output: each candidate trajectory is evaluated against the integrity field, out-of-profile candidates are intercepted, and the lineage is written to the vehicle's event data storage. In a fleet embodiment, the global domain is maintained centrally so that a change in declared policy or in regulatory authority updates the profile every vehicle is checked against, and a fleet-wide deviation excursion, the signature of a bad update, is detected as a governed statistic rather than as a pattern of incidents. In a supervised-teleoperation embodiment, the agent's confidence output and field state are surfaced to a remote operator, and a graded collapse in integrity confidence triggers a handover request before, not after, an out-of-profile action. In a certification-and-audit embodiment, the layer emits a conformance attestation for a reporting period, naming the profile in force, the deviation events, the intercepts applied, and the per-cohort interpersonal statistics, consumable by a type-approval authority, an insurer pricing the fleet, and a court reconstructing an event.

The integration vector is well defined and the same across embodiments: the driving stack emits candidate actions to the integrity gate; the gate evaluates them against the deterministic three-domain field, applies the deviation threshold and coping intercepts, emits a confidence-scored decision, and writes the lineage. Variations include the granularity at which the field is maintained (per-vehicle, per-fleet, per-jurisdiction, composed hierarchically), the storage of record for the lineage, and the policy by which graded collapse maps to behavioral conservatism and to handover. None of these variations changes the structural property the layer supplies, which is that an autonomous vehicle's conformance to its declared safety and ethics profile becomes observable, bounded, intercepted, and reconstructable, rather than asserted and hoped for.

7. Disclosure Scope

This article is a general-application disclosure describing how the integrity and coherence technology disclosed in United States Patent Application 19/647,395 applies to autonomous vehicle ethical decision-making. The autonomous-vehicle domain framing, the cited external standards, and the deployment scenarios are application context and are not themselves claimed here. All statements about what the integrity and coherence layer does, the deterministic multi-domain integrity field, the deviation function and deviation threshold, coping intercepts, trust-slope validation, the confidence output, the coherence trifecta of empathy, self-esteem, and integrity, graded collapse and restoration, and lineage-based reconstructability, are grounded in that filed specification. No clinical or diagnostic capability is claimed; the terms used here are structural. This disclosure is published as dated, public prior art tied to United States Patent Application 19/647,395.