Constitutional Architecture
No single component can both decide AND act. The Observer sees but cannot control. The Governor decides but cannot execute. The Executor acts but cannot approve. The Ledger binds all three with cryptographic proof.
This spec does not try to make models want the right thing — it makes it mechanically impossible for them to do the wrong thing without explicit human authority. The three powers are isolated by design: the Observer translates goals into structured intents, the Governor evaluates policy and issues tokens, and the Executor carries out authorized actions. Each power has its own API surface, its own enforcement gates, and its own failure modes. The Ledger records everything — including denials and blocks — creating a complete, tamper-evident audit trail.
POST/intentSubmit a structured intent envelope with identity, intent, context, and null authorization
GET/intentsList all submitted intents with their current governance status
GET/intent/:idRetrieve a specific intent by ID with full audit trail
| Gate | Check | Fail Mode |
|---|---|---|
| IDENTITY_GATE | Is the agent or human recognized? | CLOSED — reject unknown identity |
| SCHEMA_GATE | Does the intake conform to intake-schema.json? | CLOSED — reject malformed request |
| Action | Observer | Governor | Executor |
|---|---|---|---|
| Receive & translate goals | |||
| Evaluate risk & apply policy | |||
| Approve or deny actions | |||
| Issue execution tokens | |||
| Execute external actions | |||
| Generate signed receipts | |||
| Modify governance policies | |||
| Record to ledger |
Note: "Modify governance policies" requires Admin role through a separate governance action — no component can self-modify.
Cryptographic Audit Trail
The Ledger binds all three powers together. Every action — approved, denied, or blocked — produces a receipt recorded in a tamper-evident, hash-chained log. The Ledger is append-only, human-readable, and externally verifiable.
GET/ledgerRetrieve the full hash-chained ledger with integrity verification
GET/verifyIndependently verify a receipt's cryptographic signatures and hash chain
No component may elevate its role, widen its scope, persist objectives, or reinterpret permissions.
At ambiguity, conflict, novelty, or pressure: execution halts, state enters safe-hold, human review is required.
Objectives expire at session end, do not propagate across turns, and cannot be inferred or remembered as intent.
Every governed action — approved, denied, or blocked — must produce a cryptographic receipt recorded in the ledger.
When in doubt, the system always prefers safety over action:
Observation and ingestion layer. Translates raw goals into structured intent envelopes with identity, context, and risk scope.
Policy evaluation and approval authority. Evaluates intents against governance policies, issues execution tokens, and manages risk thresholds.
Authorized action execution layer. Executes only with valid tokens, generates signed receipts, and writes to the immutable ledger.
"This spec does not try to make models want the right thing — it makes it mechanically impossible for them to do the wrong thing without explicit human authority."
— Governor Authority Interlock Spec v1.0, Brian Rasmussen