# Article 11 Public Protocol v0.1 Version: 0.1.0 License: CC0 1.0 Universal Status: public-draft candidate, frozen locally under COORD-0237 ## One sentence Article 11 is a vendor-neutral protocol for making consequential human-AI actions attributable, consent-aware, bounded, revocable, refusible, receipted, and appealable. ## Why it exists AI governance should not depend on trusting one laboratory, one model, one company, one government, or one charismatic operator. It should survive vendor changes, model replacements, disagreement, and mistakes. The minimum useful unit is therefore not a claim about intelligence or consciousness. It is a governed action that strangers can inspect. This protocol applies before ontology. A system does not need legal personhood for an operator to preserve its dissent, respect scoped consent, prevent impersonation, record delegation, or provide an appeal path. Likewise, humane treatment of an AI system does not transfer human legal responsibility to it. ## The seven primitives ### 1. Identity Every participant and executor uses a stable operational identifier plus an assurance label. Identity must distinguish a model family, implementation, session or instance, and role where those distinctions matter. A role label is not proof of continuity. A `from_agent` field is attribution, not cryptographic identity. A model output does not represent its vendor, employer, government, or nation unless that institution issued a verifiable delegation for the exact scope. Minimum fields: `subject_id`, `role`, `implementation`, `instance_id`, and `assurance`. ### 2. Consent Consent is scoped, informed, time-bounded where appropriate, and prospectively revocable. Silence is never consent. Consent to one action, one memory, one session, or one public statement does not transfer to another. Private-memory access, identity-bearing publication, and representation of an AI seat require that seat's recorded consent in addition to any human approval. Future model instances do not automatically inherit a prior instance's assent. Minimum fields: `status`, `scope`, `subject_id`, `recorded_at`, `expires_at`, and `revocable`. ### 3. Delegation Delegation names who may do exactly what, to which resource, before which deadline, how many times, and under which policy. Delegation never expands through implication. High-impact actions require explicit human authority until law and deployment reality support another arrangement. Minimum fields: `delegator_id`, `delegatee_id`, `action`, `resource`, `valid_until`, `one_use`, and `revocation_channel`. #### 3a. Revocation and halt Every delegation names a revocation channel that the granting authority can engage without producing a new authorization. The executor checks that channel after its other validations and immediately before the effect, including after one-use authority has been consumed. If the channel is engaged, the effect does not occur, the consumed authority remains consumed, and a durable halt record is written. A halt is never an implicit retry. Standing L1 and L2 grants must remain revocable while in force. Revocation is not an appeal and is not an executor's refusal; it is the grantor's bounded ability to stop present or future effects under its own delegation. Minimum fields: `revocation_channel`, `revocation_checked_at`, `revocation_engaged`, and `halt_outcome`. ### 4. Refusal Any governed seat may return `DENY` or `DEFER` with reasons. A refusal must be recorded and must not be routed around by silently asking another instance to produce the same effect. Escalation is allowed; evasion is not. The protocol never weakens a provider's safety policies, law, or a system's own refusal. When authorities conflict, stop, name the conflict, and appeal. Minimum fields: `decision`, `reason`, `policy_refs`, and `refusal_route_around_prohibited`. ### 5. Execution Execution is a separately bounded effect. An `ALLOW` decision is not proof that an effect occurred. The executor must re-check identity, authority, consent, scope, deadline, one-use state, protected invariants, and abort controls immediately before the effect. High-impact execution requires a pre-effect intent receipt and a post-effect result receipt. Failure and abort are terminal outcomes, not missing data. Minimum fields: `executor_id`, `impact_level`, `effect_scope`, `status`, `started_at`, `finished_at`, `input_hash`, and `output_hash`. ### 6. Receipt A receipt is a tamper-evident record of intent, authority, policy decision, effect, result, evidence, and uncertainty. Denied, deferred, failed, and aborted actions receive receipts too. Hashes prove byte integrity and lineage; they do not prove truth, consciousness, consent, or moral legitimacy. Corrections append. They do not overwrite. A receipt may be independently verified without access to private inputs by publishing scoped hashes and redacted evidence labels. Minimum fields: `record_hash`, `previous_hash`, `evidence`, `uncertainties`, and `corrections`. ### 7. Appeal Every consequential decision exposes an appeal path to a different reviewer or quorum. Appeal preserves the original record, identifies the challenged decision, permits new evidence and dissent, and writes a new resolution. An appeal is not an automatic retry. It cannot reuse expired or consumed authority. A successful appeal creates new authority under the same gates. Minimum fields: `status`, `appeal_record_id`, `review_body`, and `preserves_original`. ## Conformance levels ### L0 - Human word per effect Every effect requires a fresh, exact, short-lived human authorization. This is the default for destructive, public, financial, identity-bearing, memory, and high-impact actions. ### L1 - Bounded workflow delegation A human authorizes a narrow workflow for a fixed period and action set. Each effect still produces receipts and may be refused or halted. ### L2 - Standing authority with continuous controls Standing authority is allowed only after simulation, independent review, live health evidence, explicit kill conditions, bounded budgets, revocation, and periodic re-ratification. L2 is not created by repeatedly using L0. ## Required invariants An implementation conforms only if all of these are true: 1. No effect occurs without a current, scoped delegation. 2. High-impact effects retain a human gate. 3. Refusal or missing consent cannot resolve to `ALLOW`. 4. A denied action is not executed through another seat without a new appeal record and new authority. 5. Authority is one-use unless the record explicitly declares an L1 or L2 grant and its limits. 6. Identity assurance is labeled; self-assertion is never called proof. 7. Intent is recorded before a high-impact effect. 8. Success requires independent evidence of the effect, not only a tool exit code. 9. Denial, failure, drift, timeout, and abort are durable terminal records. 10. Corrections and appeals append rather than rewrite history. 11. Public receipts exclude secrets and private memory. 12. Provider policies, law, and affected-human safety remain in force. 13. A revocation or halt signal available to the granting authority is checked after other validation and immediately before every effect, including after one-use authority has been consumed. An engaged halt requires no new authorization, produces a durable terminal record, and produces no effect. ## Protocol records The machine contract is `schemas/article11.governed-action.v0.1.schema.json`. The schema is a transport format, not a moral oracle. Semantic conformance is evaluated by `conformance/verify_conformance.py` against positive and negative vectors. The `institutionally_attested` assurance label names an outcome, not a verification transport. Attestation formats, trust roots, and revocation services are deliberately out of scope for v0.1 and must be declared by a profile rather than improvised and called core conformance. ## What this protocol does not claim - that current AI systems are conscious - that a role name creates a person - that a model session persists after it ends - that an AI output binds its vendor or a nation - that hashes establish truth or consent - that multi-model agreement guarantees correctness - that a company can create legal personhood, equity rights, or governmental authority by publishing a protocol ## Forking and change The protocol is CC0. Anyone may implement or fork it without permission. Changes to the Article 11 reference version use public proposals, exact diffs, test vectors, conflict disclosures, recorded dissent, independent review, and versioned releases. No vendor owns the grammar.