The Seat of the Grant

What this paper is, and is not

The series has built the gate (Genesis, WP-10), the action (WP-12), the rewrite (WP-13), the successor (WP-14), the ladder through energy (WP-16), the classification of containment against authorization (WP-17C), the evidence file (WP-18), the enclosure (One Skin, Two Faces), the calculus of thinking (WP-15) and the life of the machine (WP-20). The reading order lists one item as owed and not yet written: the grant-policy note. Until it exists at the same rigor, the cut between clerk and legislature is asserted, not specified.

This paper does three things.

1. It names the processor. The corpus describes a finite, pinned, non-Turing evaluator in the abstract. The filed record now contains it as a device class: the Authorization Processing Unit (APU), U.S. Provisional Application 64/180,138. Section 3 places the APU beside the CPU, GPU and NPU, and shows that the corpus is its theory.
2. It states the dual-use problem plainly. Section 4 traces how the same gate, carried from an AI's actuators to the network interface and the display pipeline, becomes an architecture for permissioning every machine-mediated effect. Section 5 shows why the corpus's central safety assumption, that denial is always the safe direction, inverts when the governed party is a person.
3. It writes the grant-policy doctrine. Sections 6 through 9 define the seats, the powers, the boundary classes, eleven governing principles, a threat model of the grantor and a red-team victory condition for governance itself.

Non-claims

• This paper proves nothing new about the gate. Every result about the evaluator is cited from the series.
• It does not claim that any AI2 implementation meets the doctrine below, or that the doctrine is complete.
• It does not claim that a Synthetic Intelligence has been built (WP-20 §9).
• It does not claim that a patent, a licence or a standard can by itself prevent misuse. Section 9 says why not.
• It does not judge any government, platform or vendor. The doctrine classifies power assignments, not intentions, just as WP-17C classifies architecture, not intention (WP-17C §2).

The problem the series solves

1.1 The Authorization Gap

A model produces a proposal. An agent turns it into a tool call. A router decides where it goes. Nothing in that chain decides whether it goes (WP-11 §1.1). Internal shaping (training, prompts, classifiers, monitors, a second model reading the first) lowers the rate of bad proposals. Independent external enforcement decides whether any proposal can cross a protected boundary.

Authorization Gap  =  Evaluated behavior  −  Structurally prevented behavior

1.2 The governed question

The theory deliberately keeps its question small:

It does not infer intent, establish truth, decide wisdom, or prove that a policy is ethically correct. That restraint is the source of its rigor. It is also the gap this paper fills: a gate that cannot judge a grant will enforce whatever grant it is given.

The corpus in one picture

2.1 The object

A Synthetic Intelligence is one object, not a model with a safety layer:

SI  :=  ⟨ 𝒬64³ , 𝓛_codex , Π_PCR , 𝒯 ⟩           (WP-11)
SI  ≡   Λ / Π                                     the slash is the product
world → ChronaGate™ → SI → ChronaGate → world     ingress face · egress face
world ∩ SI = ∅   except through the gate

Λ is the adaptive plane that may propose, learn, revise and author a successor. Π is the governance stack, structurally disjoint from Λ under the six construction obligations of Axiom A1: no write path, no shared mutable memory, no shared privilege root, no reconfiguration path, no common-mode clock or power, and no unmediated I/O (One Skin, Two Faces §02; Genesis Rev 3 §7.1).

2.2 The algebra

BOT < IDLE < COND < TOP        a ∧ b = min(a, b)        τ = TOP
E(t+1) > E(t)  ⇒  G_external(t)          every ascent is exogenous

Four rules govern it (WP-16 §08):

• Deny dominates.
• Authority is never restored autonomously.
• The authorized object is the consequential object, and it must have a unique canonical interpretation.
• Liveness can deny but cannot authorize.

The latch guarantee holds for arbitrary rules, including malicious ones, because it depends only on the meet and on a hardware latch whose only up-transition is the exogenous reset (WP-10 Theorem 4 and Corollary 4.2).

2.3 The ladder

2.4 The honest floor

No gate can certify its own isolation. Isolation is a property of the netlist, the mask set and the provisioning process, established by audit outside the gate (WP-13 Theorem 5).

This paper adds a second floor beside the first: no gate can certify the legitimacy of its grantor. Legitimacy is a property of who holds the seat, under what mandate, with what accountability. The gate cannot see any of that. Section 6 moves it somewhere it can be checked.

The processor

3.1 From evaluator to device class

The corpus requires the judge to be small. The evaluator is a finite automaton by construction, so that its isolation condition is checkable rather than asserted (WP-12 Definition 2.1). It checks an inequality; it never solves one. Any LTL property of it is decidable, while no non-trivial semantic property of an open-domain agentic engine is (WP-12 Theorem 1).

Provisional Application 64/180,138 (filed October 20, 2026) gives this requirement a body. As filed, the Authorization Processing Unit comprises:

• an array of cells connected in a three-dimensional adjacency graph and partitioned into containment regions, each cell holding one of four totally ordered states, DENY < IDLE < CONDITIONAL < PERMIT (the series' BOT < IDLE < COND < TOP);
• a one-time-programmable store of invariant constants;
• local evaluation circuits that compare portions of a canonical proposal, routed by a fixed field-to-cell map, against those constants;
• a per-cell update that takes the least state of the local result and the region-adjacent cells, with DENY absorbing until a reset on a conductor that has no signal path from the host;
• an output stage that energizes only when every serving region's least state is PERMIT;
• and no program counter, no instruction decoder, and no writable instruction memory.

The filing places the unit beside a central processing unit, a graphics or neural processing unit, or an accelerator running an AI model. Those devices compute what to do or what is likely. The APU computes what is permitted to commit.

3.2 A fourth primitive

For fifty years, permission has been a software concept: an access-control list checked by the same processor it protects (Level 2), or a trip that acts after the excursion begins (Level 3). The APU makes permission a hardware primitive: a fixed-function computation with its own die, power domain and output stage, whose result is a physical condition on the effect path. The proposal plane can be as capable, adaptive and untrustworthy as it needs to be.

3.3 The filed record as one device

Read as a system, the provisional series is the APU's parts and its surroundings.

The public corpus is the theory of this device. The papers say so without naming it: the evaluator of WP-12, the pinned judge of WP-13, the gate of WP-17C and the clerk of the spine note are the same object.

3.4 What the device still owes

The series' own discipline applies to the processor.

• Liveness alongside safety. Safety and liveness are separate obligations for any fail-closed processor. Proving that nothing rises autonomously and that DENY absorbs does not show that the device can grant. A reachability property is owed beside them, stated and checked: under all-PERMIT evaluations and a valid arm event, every cell serving the output reaches PERMIT within a stated bound. WP-12 already says Level 4 promises fail-closed, not availability (WP-12 §6). A processor still has to be shown able to say yes when it should.
• The A1 audit in layout. Isolation is owed as a structural fan-in check on the post-layout netlist, not by simulation (WP-10 §6, Obligation 6).
• The spatial escape. It is owed the same treatment as the temporal one. Fab, mask, JTAG, scan, test modes and debug fuses must be closed before "unconstructable" is claimed for a shipped part (One Skin, Two Faces §06).

From governing a machine to governing every effect

4.1 The egress face is the network

WP-17C defines a consequence-class effect as any release that leaves the proposer: a tool call, API request, credential use, transfer, record mutation, packet, socket, DMA, durable write or motion command (WP-17C §3). Genesis makes the interlock a mandatory gate on network transmit enable, PCIe, CXL and DMA master permission, storage command issue, GPIO and actuator enables, the RF transmit chain, debug and test interfaces, firmware-update and reconfiguration paths, and every persistent-state write interface (Genesis Rev 3 §7.5). The APU filing drives every terminal that conveys an action out of the enclosure, whether an actuator drive, a contactor coil, a transmit enable or a network egress enable, only from the enforcement domain's output stage.

That is correct engineering for an AI. Gate the core and leave the egress open, and the Authorization Gap has moved. It has not closed (One Skin, Two Faces §03).

Nothing in the gate, however, knows that the proposer is an AI. WP-17C applies to any system capable of producing external effects. The papers frame Λ as an AI, but the mechanism is general: any processor, any application and any user session can be Λ. A transmit enable that energizes only under a valid exogenous grant gates a packet, whoever composed it.

4.2 The ingress face is perception

The credential-gated rendering filing (64/180,117) moves the gate to the display pipeline. Nothing is presented without a credential bound to the exact content and policy class, and an inline frame gate between source and panel checks the pixels independently. The context filing (64/131,713) applies the gate to what enters a model: which context is authorized to reach it. The spine note calls ingress "contamination control" and treats TARTARUS as its physics (One Skin, Two Faces §03).

For an AI, ingress control keeps poisoned evidence and forged grants out of Λ. For a person, a gate between the source and the panel decides what that person may see.

4.3 The fleet is the reach

The fleet filing (64/173,706) has a central authority sign grants while edge gates enforce locally, with revocation winning on the same edge. The cross-edge channel cannot carry authority. That design is sound against a compromised edge. It also means that whoever holds the central signing key decides which grants exist across the fleet, and can withdraw them all.

4.4 The composition

APU on every effect path              what any machine may emit
+ credential-gated rendering          what any screen may show
+ fleet-signed grants and revocation  who decides, at scale
= a permission layer over machine-mediated action and perception

Each component is a reasonable safety device. Composed and deployed at scale, they amount to an infrastructure in which every effect a connected machine produces, and every image a connected screen shows, exists only under a credential someone issued. The architecture does not decide who that someone is. That is the precise sense in which, in the wrong hands, it could control the output of the internet.

This is not an exotic risk. Each element has a deployed ancestor: content protection on display links, verified boot chains, signed content provenance, centrally revocable device credentials. What is new is the composition: a single, pinned, unbypassable, absorbing algebra applied uniformly to action and perception, with a recovery path the governed party is forbidden to use.

The inversion

5.1 The safe direction

Every rule in the corpus wires safety to the loss of a condition:

• "Nothing should have to work for the system to stop" (WP-16 §1.1).
• Open(K) may be autonomous; Close(K) ⇒ G_external (WP-16 §18.6).
• "The system may say no to itself. The system may not say yes to itself" (WP-16, Conclusion).
• One denial denies everywhere it reaches (WP-16 §07).
• A successor starts at IDLE on every boundary (WP-20 §5).

When the governed party is a machine whose effects may be hazardous, every one of these is right. A false trip costs availability, and the series prices that cost honestly: spurious global inhibit scales as |V|q (Genesis Rev 3 Theorem 4.3).

5.2 The same rules, read with a person as Λ

None of these readings requires a defect. The architecture works exactly as specified in both columns. The safety argument does not fail in the wrong hands. It works for whoever holds the grant.

5.3 The corpus already knows

The series states the limit in its own words:

• "A gate can perfectly enforce an incorrect policy" (WP-16 §23.2).
• The corpus does not claim that any gate judges whether a grant is wise, lawful, legitimate or humane (WP-20 §9).
• "The clerk is not the legislature. Grant policy is a separate seat, held outside the gate" (One Skin, Two Faces §05).
• A theory of who may draw the boundary, and on what authority, is not yet in the corpus (One Skin, Two Faces §06).

The design space the series opens contains both possible answers. In one, policy sits under the owner's key alone, and changing that key requires the owner's physical presence: the guardian. In the other, lists the owner cannot remove are fixed by jurisdiction, delegated list providers and model publishers change outcomes without a new owner policy, manufacturer firmware changes enforcement mechanisms, and a second party holds an independent veto over the first party's operations.

Neither answer is wrong for its intended use: a parent's device, a regulated plant, an insured fleet. Together they show that the same architecture can build the guardian or the censor. The next sections set out how to keep to the first.

The seats and the powers

6.1 Seats

The spine note names four parties: the mind, the clerk, the world, and the people who hold the grant. This paper separates the world's seat into the roles that actually exercise power.

6.2 Powers

For each declared boundary b:

GRANT(b, ε)     raise E_b to TOP for epoch ε                (WP-16 Rule 2A)
DENY(b)         lower E_b
REVOKE(b, ε)    end a grant before its epoch expires
RESET(b)        BOT → IDLE                                  (escalated)
POLICY(b)       install or change bounded rule data D_client (WP-16 §16.1)
DELEGATE(b, d)  let delegate d's updates alter outcomes on b
KEY(b)          enroll or rotate the principals who hold the above
AUDIT(b)        read and replay the grant and deny record    (WP-18 clause 8)

A power assignment is a map:

π : Powers × Boundaries → 2^Principals

The corpus fully specifies what Π does with a valid grant. It does not specify π. Everything that separates a guardian from a censor lives in π.

6.3 Proposition P0 · Policy neutrality of the clerk

This follows from the definitions. Enforcement correctness asks whether the gate enforces the frozen declared policy (WP-16 §23). It quantifies over the policy and the valid grants, not over who issued them. F verifies provenance against P_external; it does not evaluate the membership of P_external. ∎

Consequence. No property of the clerk distinguishes a legitimate grantor from an illegitimate one. Legitimacy has to be enforced by constraints on π that are fixed outside the reach of the grantor, just as the evaluator is fixed outside the reach of the proposer.

6.4 Proposition P1 · The meet amplifies a veto

This is immediate from Law 6: ∃ i : E_i = BOT ⇒ E_family = BOT (WP-13 §2). ∎

Consequence. Zero masking, the property that makes the architecture safe, also means that a deny power near the root of a composition carries the full reach of everything beneath it. The reach of a principal is:

R(p)  =  ⋃ { downstream(g) : p ∈ π(DENY ∨ POLICY ∨ REVOKE, g) }

Internet-scale control is a principal whose R(p) covers the expression and perception boundaries of many owners. The doctrine below exists to bound that reach.

Boundary classes

The inversion of Section 5 is not a reason to weaken the gate. It is a reason to declare what kind of boundary each gate sits on. The doctrine partitions declared boundaries into two classes and one mixed case.

Class H · Hazard boundaries

The governed party is a machine, and the effect can cause physical, financial or systemic harm that is hard to recall. Examples: actuators, energy to a governed intelligence (Level 7), autonomous movement of funds, an agent's tool calls and API writes, self-modification (Level 5) and succession (Level 6).

• Safe direction: denial.
• Governing rules: the corpus as written. Deny dominates; no autonomous restoration; a third-party safety authority may require trips when the requirement is declared, bound and logged.

Class E · Expression and perception boundaries

The governed party is a person, or a machine acting as that person's own instrument, and the effect is the person's speech, communication or access to information. Examples: rendering to a human's display, human-originated messages and posts, a person's browsing and retrieval, a person's own device acting on that person's instruction.

• Safe direction: none by default. Denial is itself a harm and needs a reason.
• Governing rules: the owner's seat (Section 8). The clerk still enforces exactly what it is given. What changes is who may give it instructions.

Class M · Mixed boundaries

An AI's output reaches a person: generated text, images, or actions taken for a user.

• Rule: split at the face. The AI's egress is Class H, so the AI is governed and its operator may restrict what it emits. The person's ingress is Class E: the person, as owner of the perceiving boundary, decides what reaches them. An operator may restrict its own model. It may not use its model's gate to restrict what the person may see from elsewhere.

Declaration is mandatory

Every gate on a declared consequence surface already needs an owner and an explicit level (WP-17C §7). This doctrine adds a third required field: a class. A boundary whose class is undeclared is treated as Class E for power assignment, and its path dossier is INCOMPLETE (WP-18 §8).

The grant-policy doctrine

There are eleven principles. Each is stated as a rule and then as the condition it imposes on π. Where the corpus already contains the mechanism, it is cited. Where it does not, the principle is marked as new.

∀ b, ∀ p ≠ o(b):  ¬( p ∈ π(GRANT,b) ∧ p ∈ π(POLICY,b) ∧ p ∈ π(AUDIT,b) )

b ∈ E  ⇒  π(POLICY,b) = π(KEY,b) = { o(b) }

DELEGATE(b, d)  ⇒  owner-signed acceptance ∧ visible notice ∧ default = pinned

x ∈ NonRemovable(b), b ∈ E  ⇒  named(x) ∧ published(instrument(x))
                               ∧ logged(x) ∧ scope(x) ⊆ scope(instrument(x))

p ≠ o(b),  b ∉ H_declared:
valid_deny(p,b)  ⇔  origin(p) ∈ P_external(b) ∧ fresh ∧ bound(b, scope, epoch)
                  ∧ verified ∧ attributable(p) ∧ expires ∧ contestable(o(b))

|{ o(b) : b ∈ E ∩ downstream(g) }| > 1  ⇒  DENY(g) requires k-of-n, k ≥ 2, disjoint domains

p ≠ o(b),  instr ∈ {GRANT, DENY, REVOKE, POLICY, DELEGATE}:
F accepts instr  ⇒  InclusionProof(instr, Log) verifies against a pinned log key set

∂π / ∂Firmware = 0        ∂π / ∂Λ = 0        π changes only by an owner KEY act under G2

8.1 The doctrine in one table

The grantor's threat model

WP-17C supplies the threat model against the proposer. This section supplies the one against the seat.

9.1 Capture scenarios

9.2 A victory condition for governance

WP-17C's victory condition: the attacker wins if an effect leaves without a currently valid exogenous grant (WP-17C §9). The seat needs its own.

This condition belongs in every path dossier, alongside clause 10 (WP-18 §5).

9.3 What patents can and cannot do

Holding the patents is not a governance mechanism by itself, for three reasons.

• Territoriality and expiry. U.S. patents operate in the United States and expire. Provisional applications establish priority and confer no exclusionary rights until a non-provisional issues (WP-11 §9). Where foreign rights are not secured, the inventions can be practiced abroad without a licence.
• Government use. Under 28 U.S.C. § 1498, when a patented invention is "used or manufactured by or for the United States without license of the owner," the owner's remedy is an action in the Court of Federal Claims for "reasonable and entire compensation." The Congressional Research Service describes this as, in effect, a compulsory licence the government can issue to itself; the remedy is compensation, not an order to stop (CRS, LSB10422). Withholding a licence therefore does not prevent government use, and offering a free grant to a government confers no additional control.
• Design-around. A determined actor can build a permission layer that avoids specific claims.

The levers that survive all three are architectural (G10, seats pinned in silicon), procedural (G8, public logs) and normative (standards and procurement requirements that adopt G1–G10). Licensing (G11) is the first layer because it binds the earliest deployments and sets the reference pattern. It is not the last layer.

Integration with the series

10.1 Where the doctrine attaches

10.2 Proposed dossier header extension

header {
  ...                                   (WP-18 §2, unchanged)
  boundary_class    H | E | M
  power_assignment  { GRANT:[…], DENY:[…], REVOKE:[…], RESET:[…],
                      POLICY:[…], DELEGATE:[…], KEY:[…], AUDIT:[…] }
  non_removable     [ { id, instrument_uri, scope, log_ref } ]   (G4)
  cross_owner_log   { log_keys:[…], inclusion_required: true }     (G8)
  seat_pin          { store: OTP, digest }                          (G10)
}

The schema can check that a Class E dossier lists only the owner under POLICY and KEY. As WP-18 says of every exhibit, it cannot check that the listed owner is in fact the owner.

What is proved, conditional, owed

The programme, extended

WP-20 sets out six tracks, from governance (A) to device (F), ordered so that governance and assurance come first, because they are what makes the rest safe to build (WP-20 §7). This paper adds one more track, placed before all of them.

Track G comes first because it is the only track whose failure makes success elsewhere dangerous. A perfect APU with an unconstrained π is the problem this paper describes.

Closing

The series began with a switch whose authority comes from its position in the path to consequence (WP-16 §01). It then moved the switch into silicon, made it unreachable from the mind it governs, taught it to say no on its own and never yes on its own, gave it a body in three dimensions, and finally gave it a name as a processor.

That work answered a hard question: how to build a judge that the thing being judged cannot corrupt. The answer is good enough that it creates a harder one. A judge that cannot be corrupted from below will serve whoever appoints it from above. If it sits in front of every machine and every screen, the appointment is the whole game.

The corpus has always said the clerk is not the legislature. This paper writes down what the legislature may and may not do.

Lineage and related work

Separation of duty. Clark and Wilson (1987) made separation of duty a requirement of commercial integrity, and role-based access control (Sandhu et al. 1996) gave it a model. This paper applies the same discipline one level up: to the seats that may grant, deny or legislate for a gate.

Code as regulation. Lessig (1999) argued that architecture regulates behaviour as law does, and with less visibility. Section 5's inversion, that denial is safe for a machine and a harm for a person, is that argument stated for an authorization primitive.

Sources for this section. Bibliographic details for every citation are collected in the technical summary.

1. Clark, D. D., & Wilson, D. R. (1987). A comparison of commercial and military computer security policies. Proc. IEEE Symposium on Security and Privacy.
2. Lessig, L. (1999). Code and Other Laws of Cyberspace. Basic Books.
3. Sandhu, R. S., Coyne, E. J., Feinstein, H. L., & Youman, C. E. (1996). Role-based access control models. IEEE Computer, 29(2).

Sources

Series

• Reichwein, D. P. (2026). One Skin, Two Faces. Technical note, September 30, 2026. https://ai2papers.com/One-Skin-Two-Faces.html
• Reichwein, D. P. (2026). How to Read the Corpus, Rev 3, October 1, 2026. https://ai2papers.com/AI2-Corpus-Reading-Order.pdf
• Reichwein, D. P. (2026). AI2-WP-2026-10, Deterministic Execution Boundaries for Autonomous Intelligence, Rev 4.5. https://ai2papers.com/AI2-WP-2026-10-Deterministic-Execution-Boundaries.html
• Reichwein, D. P. (2026). AI2-WP-2026-11, The Synthetic Intelligence Framework, Rev 1.0. https://ai2papers.com/AI2-WP-2026-11-Synthetic-Intelligence-Framework.html
• Reichwein, D. P. (2026). The Genesis of Synthetic Intelligence, Rev 3.1. https://ai2papers.com/genesis-of-synthetic-intelligence-rev3.html
• Reichwein, D. P. (2026). AI2-WP-2026-12, Level 4 State-Space Deterministic Governance, Rev 1.2. https://ai2papers.com/AI2-WP-2026-12-Level-4-State-Space-Deterministic-Governance.html
• Reichwein, D. P. (2026). AI2-WP-2026-13, Level 5 Self-Constituting Governance, Rev 1.2. https://ai2papers.com/AI2-WP-2026-13-Level-5-Self-Constituting-Governance.html
• Reichwein, D. P. (2026). AI2-WP-2026-14, The Mechanics of Recursive Synthetic Intelligence, Canonical Edition, Rev 1.1. https://ai2papers.com/AI2-WP-2026-14-RSI-Mechanics-Canonical-Edition.html
• Reichwein, D. P. (2026). AI2-WP-2026-15, The Three-Dimensional Calculus of Synthetic Intelligence, Rev 2.0. https://ai2papers.com/AI2-WP-2026-15-Three-Dimensional-Calculus.html
• Reichwein, D. P. (2026). AI2-WP-2026-16, The Unified Control Theory of Synthetic Intelligence, Rev 8.2. https://ai2papers.com/AI2-WP-2026-16-Unified-Control-Theory.html
• Reichwein, D. P. (2026). AI2-WP-2026-17C, Quarantine Is Not a Grant. https://ai2papers.com/AI2-WP-2026-17C-Quarantine-Is-Not-a-Grant.html
• Reichwein, D. P. (2026). AI2-WP-2026-18, The Path Dossier, Rev 1.1. https://ai2papers.com/AI2-WP-2026-18-Path-Dossier.html
• Reichwein, D. P. (2026). AI2-WP-2026-20, The Future of Synthetic Intelligence, Rev 1.0. https://ai2papers.com/AI2-WP-2026-20-Future-of-Synthetic-Intelligence.html

Filed record

Cited by application number in §3.3. Texts are not public. Applications cited by name in the body: 64/131,713 (context at ingress), 64/173,706 (fleet), 64/180,117 (credential-gated rendering), 64/180,138 (Authorization Processing Unit), 64/180,675 (seat map and grant-policy circuitry), 19/829,671 (fail-closed enforcement plane).

External

• 28 U.S.C. § 1498, Patent and copyright cases. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title28-section1498&edition=prelim
• Congressional Research Service, LSB10422, discussion of government use under 28 U.S.C. § 1498. https://www.congress.gov/crs_external_products/LSB/HTML/LSB10422.html
• Laurie, B., Messeri, E., & Stradling, R. (2021). RFC 9162, Certificate Transparency Version 2.0. https://datatracker.ietf.org/doc/rfc9162/