Why containment has to reach past a single agent

A persistent semantic agent (100) may, in an embodiment, maintain a plurality of scope partitions, each carrying its own instance of the scoped integrity vector (106), self-esteem aggregate (108), refusal counter (304), authorization budget (404), and per-partition segment of the append-only lineage field (104). Upon a determination for a conduct evaluation artifact (116), the agent identifies the partition from the conduct descriptor and applies every consequent modification, counter increment, and writing of the authorization gate (300) to that partition's instances alone. The gate (300) remains granting for classes of every other partition, and execution continues there.

That partitioning carries its own saturation condition. In an embodiment, the agent computes per partition, over a declared window, a partition receipt rate of conduct evaluation artifacts (116) bearing that partition identifier, together with an aggregate rate across the remaining partitions taken as the greatest of their partition rates. Where a first partition's rate exceeds a declared bound while that aggregate remains below the bound, the agent suspends cross-partition propagation out of the first partition only, continues applying movements within that partition, and appends a containment determination recording the partition, both rates, the bound, and the window.

The architecture also admits across the agent boundary an accepted determination (122) itself, and not only the abstention type of the preceding disclosure. Where a first agent produces an accepted determination (122) upon a conduct evaluation artifact (116) concerning conduct within a scope partition shared with a second agent, it emits a determination propagation record as a governed observation. Two facts about that record matter to containment. It is a governed observation and not a conduct evaluation artifact (116), so it is not among the objects the partition receipt rate counts, and it arrives at a second agent whose own partition state is separately maintained.

The conjunct described here addresses both. It makes the containment determination a condition tested on both sides of the boundary, and it gives determination propagation records a rate condition of their own, computed per partition of the receiving agent.

Two limbs of the suspension, and the degenerate partition case

In an embodiment, a determination propagation record comprises at least the determination class identifier of the accepted determination (122), the scope-partition identifier, the identity primitive of the asserting party (118), an epoch identifier of the first agent's dynamic agent hash chain, an implicated action-class enumeration naming action-class identifiers alone, and a propagation depth field. The record carries a governance object and not a magnitude, and is thereby distinguished from a cognitive field value. Admission by the second agent modifies a value of its scoped integrity vector (106) only through the state modifier and only under the coupling functions, no field being updated in isolation.

Admission is conditioned upon a propagation admissibility gate. The attack-conditional conjunct of that gate operates in two limbs.

The standing-containment limb. Propagation is suspended, and no determination propagation record is given effect, while the containment determination stands for the scope partition concerned in either agent. The suspension applies across the agent boundary as it applies across a partition boundary within a single agent. The condition is not confined to the receiving agent's own partition state: the containment determination standing in either agent for the partition concerned is what the limb tests.

The propagation-rate limb. A rate of determination propagation records received within a single scope partition that exceeds a bound declared in the signed policy object (112), while a mean rate across the remaining scope partitions remains below that bound, is itself a condition of the suspension. The rate counted here is a rate of determination propagation records, and it is computed per scope partition of the receiving agent.

Denomination of the two rates is stated in the filing. Each rate is measured over a common window declared in the signed policy object (112) and expressed as a count of successor epochs of the second agent, so that the window is not advanced by any other party. The per-partition rate is the count admitted within the partition concerned over that window. The mean rate is the count admitted across the remaining partitions over that window divided by their number. The two rates are denominated alike and are compared against the one declared bound.

Both conjuncts of the rate limb are stated together: the rate within the single partition above the declared bound, and the mean across the remaining partitions below it. Where the second conjunct does not hold, the limb is not the operative condition.

One case remains, and the filing resolves it expressly. Where no remaining scope partition exists, the mean-rate conjunct is treated as not satisfied, and the suspension is governed by the per-partition rate condition alone.

Two consequences of the single-agent containment structure carry over and are worth restating, because the standing-containment limb depends on that structure. First, the authorization gate (300) is not written by reason of the suspension: containment withdraws reach into other partitions, not the agent's ability to act. Second, propagation resumes after the rate stays below the bound for a declared interval. Under the neighboring conjuncts of the same gate, a record that fails admission is appended as an attempted propagation and given no effect.

Declared quantities: bound, window, and resumption interval

Each quantity this conjunct consumes is policy-declared, and the filing states the declaration and not a value.

  • The bound against which both the per-partition rate and the mean rate are compared is declared in the signed policy object (112). One bound serves both rates.
  • The window over which both rates are measured is declared in the signed policy object (112) and expressed as a count of successor epochs of the second agent. It is common to both rates.
  • The resumption interval, being the interval for which a rate must stay below the bound before propagation resumes, is declared.
  • The per-partition suspension bound governing the containment determination is, in a further embodiment, multiplied by a factor of one less the proportion of a partition's conduct evaluation artifacts (116) originating from origin-equivalence classes (200) designated untested, so a partition whose artifacts all originate from untested classes triggers containment at a rate approaching zero, and one with none so originating triggers at the full declared bound.

No numeric bound, window length, resumption interval, or rate value is stated in the filing for this conjunct. Each is a declaration carried in the signed policy object (112).

Placement within the propagation admissibility gate

This conjunct is one of several conditions a determination propagation record must clear, each stated separately in the filing.

An origin-equivalence condition governs effect at the outset: in an embodiment, the second agent gives the record effect only where the first agent and the asserting party (118) are not assignable to a common origin-equivalence class (200) under any relation type declared in the signed policy object (112), the class being computed by the second agent from records carried in its own memory field (102). Where the agents are so assignable, the record is appended and given no effect.

A self-execution conjunct addresses context. The scope-partition identifier carried by the record must resolve to a scope partition recorded in the second agent's own per-partition lineage record, being that agent's record of the actions it has itself executed within each scope partition, as one within which the second agent has itself executed an action of an action class enumerated in the record's implicated action-class enumeration. The conjunct is evaluated by testing the entries of that lineage record for the partition against the implicated action-class enumeration, and is not satisfied where the intersection is empty.

Depth is bounded separately. The propagation depth field is decremented upon each admission, a record whose depth reaches zero is not further propagated, and an admitting agent that further propagates emits the record at the value obtained upon its own admission. Each admitting agent maintains, per determination class identifier and per asserting party (118), a propagation depth ceiling being the least propagation depth value it has admitted for that determination, monotonically non-increasing under the anti-rollback discipline. A record carrying a depth exceeding the ceiling then standing, or exceeding the declared initial depth, fails the gate and is given no effect.

Magnitude is bounded by a further embodiment. The magnitude by which an admitting agent's scoped integrity vector (106) is modified upon a determination propagation record is bounded above by a declared fraction, less than unity, of a reference displacement magnitude, the fraction being declared in the signed policy object (112). The admitting agent computes that reference magnitude from the determination class identifier carried by the record, being the magnitude by which its own scoped integrity vector (106) would be modified were it itself to produce an accepted determination (122) of that class under the parameters declared in its own signed policy object (112), so no magnitude of the emitting agent need be carried by the record.

Taken together, these conditions are separately stated and separately evaluated, and the attack-conditional conjunct is the one that turns on a containment determination standing in either agent and on a rate measured over an epoch-counted window.

Distinguishing rate controls, reputation aggregation, and policy decision points

Rate limiting and flood control are long established in distributed systems, and a per-partition rate compared against a bound is not novel in isolation. The structural distinction lies in what the rate is attached to and what satisfying it does. Here the rate is denominated in successor epochs of the receiving agent's own hash chain, is compared against a mean across the remaining partitions rather than against an absolute ceiling alone, and its consequence is that a governance object is not given effect. The authorization gate (300) is not written by reason of the suspension.

Reputation and trust systems compute a score for an entity from ratings or observations supplied by other entities and expose that score to parties deciding whether to transact, the scored entity neither holding the score nor participating in its computation. Defenses against unfair ratings in such systems filter incoming ratings before aggregation to protect the accuracy of a stored score, the filtering party being an aggregator rather than the rated entity. The structure here has no aggregator and no score. What crosses the boundary is an accepted determination (122) carried as a governance object, admitted or not admitted by the receiver from records in its own memory field (102), and the suspension turns on the containment determination standing for the partition and on the receiver's own epoch-counted window.

Behavioral integrity systems for autonomous agents compute a conformity measure between observed execution signals and a baseline model, compare it against a threshold, and reduce the agent's capabilities upon a deficient comparison. Divergence in such systems narrows capability. The suspension described here does not narrow the receiving agent's capability: the authorization gate (300) is unwritten by reason of the suspension, effect is withheld from an inbound record while the condition stands, and propagation resumes after the rate stays below the bound for the declared interval.

Policy-enforcement systems implementing the XACML standard evaluate a proposed action against policy and return a decision drawn from permit, deny, not-applicable, and indeterminate. That result is directed at the request, is returned to the requesting party, produces no persistent state in the deciding entity, and constrains no subsequent operation of the decider. The attack-conditional conjunct depends on persistent state of exactly the kind such systems do not produce: a containment determination appended to an agent's own record, standing for a scope partition, and consulted on both sides of an agent boundary upon later admissions.

None of the foregoing is an assertion that any named system or party practices the subject matter of the filing. The comparison is structural and is offered to locate the mechanism against the categories a searcher would reach first.

Disclosure Scope

The mechanism described in this article, being the attack-conditional cross-boundary suspension conjunct of the propagation admissibility gate, is disclosed in U.S. Provisional Application No. 64/117,812, at Section 10.8 ("Chained cross-agent withholding, anti-amplification, and introduction protocols"), paragraph [0454]. Its antecedents in the same application include the cross-agent propagation of an accepted determination at Section 5.10, the scope-partitioned confinement of state movement and the attack-conditional propagation suspension at Section 10.2, and the remaining conjuncts of the propagation admissibility gate at Section 10.8, paragraphs [0451], [0453], and [0455]. Reference numerals used above are those of the filed application. This article is published as a technical disclosure and establishes public, timestamped prior art as to the mechanism described; it is not a claim construction, not legal advice, and not a representation as to the scope of any claim that may issue from this or any related application.