ARC Open GovernanceAI Governance
Agents act. Every act should settle.
The problem is not that agents are powerful. The problem is that an agent's power is usually inherited, ambient, and never examined at the moment it is used.
An agent today acts on whatever its tools and credentials can reach. A token granted for one purpose opens every door that token opens. A permission given months ago, for a different task, is still standing when the agent reaches for it tonight. Between the instruction and the effect there is ordinarily nothing that asks whether this act, by this agent, under this authority, inside these bounds, should happen at all, and nothing that keeps evidence fit to examine when it did. When something goes wrong, the investigation reads logs after the fact and reconstructs an authority nobody ever stated.
That gap is the unsolved problem this page is about. It is not solved by a better model, a longer policy document, or a dashboard of what already happened. It is solved, if it is solved, at the transition itself, where authority can be required before effect and evidence can be bound to the act that produced it.
What governing an agent means here
Under ARC, a consequential act begins as a proposal, never as a direct effect. The proposal names the agent, the action, and the authority it claims. Settlement checks that authority as a relation, asking who granted what to whom, for which class of consequence, within which ceiling, and until when. Only a settled act proceeds, and it proceeds with the settlement attached. When it completes, the evidence returns and is bound into a Statement that either side can verify without trusting the other. Revocation is a governed act of the same kind, and it reaches the parties who rely on the grant before further acts are accepted.
Two consequences follow. A compromised or confused agent does not automatically inherit the ability to cause every consequence its tools can reach, because reachability is computed and settled per act rather than assumed from possession of a credential. And the record of what was authorized is written at the time of the act, in the same motion as the act, instead of being reconstructed from logs by whoever investigates later.
The machinery, mapped onto the problem
Consequential reachability
The first computational object of ARC is the set of consequences an agent can actually reach from where it stands, computed from the relations that grant, bound, and revoke authority. Governance begins by making that set explicit and examinable, instead of discovering it from an incident.
Settlement before effect
The settlement lifecycle runs proposal, examination, settlement, execution, evidence, and Statement. An act that cannot settle does not execute, and an execution without its settlement is not a governed act at all. This is the step the ambient model skips.
Admission at the boundary
KORE is the admission engine that applies the standing rules at the boundary, including exposure limits that persist across acts, so an agent cannot split one large consequence into many small ones and walk it past the gate. The institution's own agent works under this admission today, and its refusals are part of the operating record.
The exposure rule, in your hands
Cumulative Consequence Exposure is one of the five proposed modules, and its rule is simple enough to feel. Set the size of the consequence you want to cause, then try splitting it into smaller acts. The ceiling counts the total, so the splitting changes the pieces and not the sum. This demonstration illustrates the admission rule drawn from the engine that governs this institution’s own agent. It is not a live system, and it moves nothing.
Evidence that survives the act
Statements bind what was proposed, what was settled, what executed, and what evidence returned, under signatures either side can check. A Statement is never valid merely because it is formatted correctly. Its provenance is cryptographic and independently verifiable, which is what separates evidence from a report the agent wrote about itself.
The proposed consequence security modules
Five modules are proposed as the product shape of this application area. They are design work, recorded as proposed, and none of them is a shipped product. Each is an application of the one foundation above.
Agent Consequence Firewall, proposed
A boundary service that admits or refuses an agent's proposed consequences against the authority and exposure rules in force, before any tool is invoked.
Relational Identity and Authority, proposed
Identity and grants carried as verifiable relations between named parties, so authority is always traceable to a grantor, a scope, and an expiry.
Cumulative Consequence Exposure, proposed
Exposure accounted across actions and across time, so the risk of a campaign of small acts is visible as one number with a ceiling, not as a thousand unrelated approvals.
Consequential Forensics, proposed
Investigation over Statements rather than logs, where every step of an incident carries the authority under which it was settled and the evidence bound at the time.
Distributed Consequence Security, proposed
The same settlement discipline carried across independently operated nodes, so an agent's authority in one organization does not silently become authority in another.
What this does not claim
Governance here binds acts, not intentions. It does not read an agent's reasoning and does not judge whether a goal is wise. It cannot promise anything for paths that run outside the enforcement boundary, and any deployment that routes around the boundary has left the governed system, however it is labeled. What it claims is narrower and stronger. Inside the boundary, no consequential act proceeds on unstated authority, and every act leaves evidence that survives examination.
Work on this with us
Two invitations stand open. Institutions deploying agents into consequential work are invited as design partners, to bring real authority structures and real failure cases against this design while it is still examinable. Researchers in governance, security, and formal methods are invited to attack the model where it is weakest, through the same examination path the release itself stands on. Messages through the participate section are answered under the standing norm, with acknowledgment within two business days, and the examination begins on the examine page.
Status, plainly. AI governance is an application of the founding release, and the release stands at NO-GO while its evidence gates complete. The five modules above are proposed designs, not products on sale. The admission discipline itself is in daily operation here, governing the institution's own agent, because a governance institution that exempts its own agent from governance would be making the opposite claim.