[AI2]
ai2papers.com · formal papers
The papers
Hardware-enforced authorization for AI agents: a reference monitor and a safety instrumented function on the action path of the model, stated formally, with its lineage, its limits, and a separate research programme on the machine it is built to govern.
These are the formal papers of Asymmetric Intelligence & Innovation, written by David P. Reichwein and published here in full. Each is self-hosted and static so that it returns readable content to any reader — a person, a reviewer, or a machine pointed at the URL. Essays and teasers appear on Substack; the papers live here. Corrections are marked in place, never silently repaired, and every paper carries a revision note and a list of what remains open.
Intelligence proposes. Hardware disposes.
A model can produce a proposal. It cannot produce an authorization. The gap between the two is closed by architecture, and these papers are the architecture, stated formally enough to be checked.
Reading order · revised 26 October 2026
Two tracks. Start with the summary.
The corpus is two bodies of work. The gate is a reference monitor and a safety instrumented function placed on the action path of an AI agent: close to established engineering practice, specified formally, and the subject of the patent filings and the product. The Synthetic Intelligence programme is research on the kind of machine the gate is built to govern. It adds no authority to the gate, and the gate papers stand without it.
Start here · the gate in standard terms
Technical summary · 26 October 2026
What the gate inherits from fifty years of reference-monitor and process-safety practice, the five things it adds, how it differs from Simplex, separation kernels, SIS trips, HSMs and zero-trust enforcement points, and what is proved, tested and still owed. Every corpus term is mapped to its standard name.
If you only have one sitting
Board or insurer
Summary → WP-17C → WP-16
The question that can be priced: was this action constructable, given gate state at t = 0? In WP-16, read the four governing rules and Level 7.
Control engineer or safety reviewer
Summary → Genesis R3.1 → WP-12 → WP-16
The voting comparison, the PCR™ state machine and the effect boundary; then the Level 4 calculus and the ladder.
Security engineer
Summary → WP-10 → WP-17C → WP-18
The reference monitor stated as algebra, the classification of containment against authorization, and the evidence file a claim must survive.
Formal methods
WP-10 → WP-12 → WP-13 → Genesis
The latch theorem, the evaluator below Turing, pinning and Theorem 5, then the temporal-logic specification. Mechanized proofs are owed and listed.
Evaluating a vendor's claim
WP-17C → WP-18 + schema
Apply the ten-part test path by path, then the dossier. Do not start with any product page, including AI2's.
Policy, regulator or licensee
Summary → WP-19 → WP-17C
Who may grant, deny and legislate, on whose boundary, and why the seat map is pinned in silicon as firmly as the evaluator.
The research programme
One Skin → WP-11 → WP-15 → WP-20
The enclosure, the object, the cognitive calculus and one life of the machine. Hypotheses, with their tests.
The whole, once
Canonical → errata
One paper in the order the architecture is built, then the corrections an independent review produced.
One-page reading map (PDF, 30 September 2026) →
Track AThe gate
Deployable architecture, close to existing practice. Each paper opens with a lineage note and closes with related work.
A1
The question and the test
What counts as authorization, and what does not.
AI2-WP-2026-17C · Canonical · September 28, 2026 · lineage added October 26, 2026
Canonical governance classification of runtime containment and pre-effect authorization.
The normative position of the series. Runtime containment controls a process already operating; authorization controls whether a specific effect may occur at all. One governing question, a ten-part evidence test that every Level 4 claim must pass path by path, and the red-team victory condition. Names no vendor and certifies no implementation, including AI2's own.
A2
The theory
The ladder, the algebra, the circuit and the calculus, in the order they become checkable.
AI2-WP-2026-16 · Consolidated Edition, Rev 8.3 · October 26, 2026
From the Switch to Level 7: deterministic authorization, self-constituting governance, recursive succession, and energy-bound terminal control.
The whole ladder in one paper. Level 4 decides the action, Level 5 the change, Level 6 the origin of the change, Level 7 existence: at Level 7 the governed intelligence receives energy only while an independent gate authorizes the energy path. States the four governing rules and the one red-team victory condition, and separates what is implemented from what is demonstrated, formally discharged, and independently attested.
AI2-WP-2026-10 · Rev 4.5 · October 20, 2026 · lineage added October 26, 2026
A formal axiomatic specification of spatial authorization lattices.
The axiomatic base of the series: the chain, the global meet, the threshold at TOP, topology independence, Criterion H1, Theorems 1–4, and the seven hardware refinement obligations with their discharge status. Theorem 4: no rule, admissible or malicious, can raise the latched aggregate.
Foundational paper · Revision 3.1 · October 20, 2026 · lineage added October 26, 2026
Deterministic spatial authorization: lattice aggregation, hardware-enforced invariants, and the limits of the claim.
The gate as a circuit. Meet aggregation compared with 1oo2, 2oo3 and 2oo4D voting, with its availability cost; fail-closed dual-rail node encoding; the PCR state machine with two-domain recovery, stated in temporal logic; Axiom A1 as six construction obligations; the effect boundary; and a bounded-inhibit theorem that bounds one latency term and names the other two.
AI2-WP-2026-12 · Rev 1.3 · October 26, 2026
The mathematics, laws, and structural calculus of an authorization plane that is verifiable, fail-closed, and never restores authority on its own.
Defines the Level ladder. Three laws, three theorems, the four-state chain BOT < IDLE < COND < TOP, the ratchet, and the split that keeps the evaluator below Turing: the proposal side computes the projection and a certificate; the evaluator checks an inequality and never solves one. Traced claim by claim to the filed circuit, provisional application 64/157,181.
AI2-WP-2026-13 · Rev 1.2 · October 20, 2026 · lineage added October 26, 2026
Theoretical foundations for governing a system that rewrites its own rules, its own model, and its own topology — under an evaluator it can never reach.
Three laws beyond Level 4: pinning, identity on both the object and evidence paths, and composition by meet. Five theorems, ending with the one that bounds the whole ladder: no gate can certify its own isolation. Isolation is an audit fact, and the paper says where it is discharged.
A3
Attestation and the grant
How a claim is evidenced, and who may hold the grant the gate enforces.
AI2-WP-2026-18 · Rev 1.1 · September 29, 2026 · lineage added October 26, 2026
How a Level 4 claim is attested. One path. Ten exhibits. Failure of one is failure of the claim.
An assurance case scoped to one path. The unit of a Level 4 claim is one named path on one named consequence surface, and the file must hold ten exhibits a third party can refuse. Dispositions are two fields: what the file shows, and whether the path is dark or armed. A machine-readable schema and an empty dossier are published with it. Certifies no implementation.
AI2-WP-2026-19 · Rev 1.0 · October 20, 2026 · lineage added October 26, 2026
Authorization as a computing primitive, and who may hold it.
The clerk enforces whatever valid grant it is given, so the question is who may give it. Names the Authorization Processing Unit as a device class, shows why denial is the safe direction for a machine and a harm for a person, and writes the grant-policy doctrine: seats and powers, boundary classes, eleven principles, the grantor's threat model, and a red-team victory condition for governance itself.
A4
Corrections
What an independent review found, and where each correction now sits.
Errata · October 20, 2026
Eight corrections to WP-10, WP-12, WP-13, WP-14 and Genesis, from an independent adversarial review.
Each place where a stated result was wider than the mathematics or specification behind it, the correction made, and its effect. None removes a result the architecture depends on: the meet, the ratchet and no autonomous ascent survived the review. Every correction is also marked in place in the paper it corrects.
Track BThe Synthetic Intelligence programme
Research on the machine the gate governs. Adds no authority to Track A. Claims about a new kind of mind are hypotheses unless marked proved, and each states the observation that would falsify it.
B1
The enclosure and the whole
The spine of the programme, and the corpus stated once.
Technical note · 30 September 2026 · revised October 26, 2026
The enclosure topology of Synthetic Intelligence, and why ChronaGate™ is both sides of it.
Names the object the programme builds: a Synthetic Intelligence as Λ sealed inside Π, with the same cut on ingress and on egress.
AI2-WP-2026-C · Canonical Edition, Rev 1.0 · October 20, 2026
The corpus stated once, in the order it is built.
The object, the interior, the two gates, the Authorization Processing Unit, the seven levels, the world's seat, and a gated release. Spans both tracks; supersedes nothing.
B2
The object and the mind
What the machine is, how it changes, how it thinks, and one life of it.
AI2-WP-2026-11 · Rev 1.0 · September 17, 2026 · revised October 26, 2026
Deterministic governance for independent, three-dimensional, self-constituting intelligence.
Defines a Synthetic Intelligence as one object — substrate, canonical language, permission runtime, and containment — rather than a model wrapped in a safety layer. States what is proved, what is conditional, and what is owed. The containment premise is stated as Hypothesis T, with its test.
AI2-WP-2026-14 · Canonical Edition, Rev 1.1 · October 20, 2026 · retitled October 26, 2026
RSI Mechanics: falsification as an operator on the rule, authority as a ratchet on the consequence, and the evaluator that neither can reach.
The mechanics of the rewrite that Level 5 governs. A counterexample is not a halt: two operators carve the failure out of the rule's claimed domain and project the rule onto a successor that reproduces the observed truth. The successor is born at IDLE and runs only when a hand arms it.
AI2-WP-2026-15 · Rev 2.0 · September 29, 2026
Thought as a field configuration. Permission as a law of motion. Codex-1 as the language of the field.
The cognitive row the series had not written: state as a field on the three-dimensional lattice, PCR as its clock, and Codex-1, a finite, typed, canonical relational grammar with bounded settlement and no path to authority. Formation is not authorization; the evaluator is not a site of the field.
AI2-WP-2026-20 · Rev 1.0 · October 2026
From linear token inference to a governed, constituted object.
Follows one Synthetic Intelligence from instantiation to stop, naming the law in the corpus that governs each stage. States what the four states do not mean, five falsifiable hypotheses, and a six-track programme with an evidence class for every stage.
Owed · not in the corpus yet
What is still owed
The corpus says what it has not shown. In order of how much each would move the central claim:
- A worked example: one real agent tool call blocked end to end by the gate, with measured decision latency and a fault-injection log.
- A mechanized proof of the latch and meet theorems (Coq, Lean or TLA+), and the netlist check that only the reset line can raise the latch.
- Ingress-face obligations mapped onto filed hardware claims.
- Axiom A1 disjointness verified in layout.
- Who decides the class of a contested boundary: the one question the grant-policy doctrine cannot settle by architecture.
How the papers fit the rest of the record
Books, patents, product — and the layer between
The books carry the doctrine; Beyond Turing is the canonical text. The provisional patent series carries the circuits; the papers cite them by application number and never claim more than the filing discloses. ChronaGate is the product. These papers are the layer between: the mathematics that connects what the books argue to what the silicon does, with the open items left open.
| Track | Level | Paper | What it governs |
|---|
| A | — | Technical summary | The gate in standard terms: lineage, what is new, what is owed |
| A | 1–4 | WP-17C | How to classify any system: containment is not authorization |
| A | 1–7 | WP-16 | The whole ladder: the unified statement |
| A | — | WP-10; Genesis Rev 3.1 | The lattice, the meet, the latch, the circuit: what a gate is |
| A | 4 | WP-12 | What the system does |
| A | 5 | WP-13 | What the system becomes |
| A | 7 | WP-16 §18–20 | Whether the system is energized at all |
| A | 4 | WP-18 | How a Level 4 claim is attested, path by path |
| A | — | WP-19 | Who may hold the grant: seats, powers, boundary classes, and their limits |
| B | — | One Skin, Two Faces | The enclosure: one cut, two faces, ingress and egress |
| B | — | Canonical statement | The whole, once, in the order it is built |
| B | — | WP-11 | The object: what a Synthetic Intelligence is |
| B | 6 | WP-14 | What the system authors from its own failures: the successor, born at IDLE |
| B | — | WP-15 | How the system thinks: the cognitive field, with no path to authority |
| B | — | WP-20 | The whole object through one life, and the programme that would make it real |