RFC-010: AIGP Runtime Governance Protocol — 19. Actuation Anchor and Reversibility Grading
AIGP Specification › RFC-010: AIGP Runtime Governance Protocol › 19. Actuation Anchor and Reversibility Grading
← 18. Non-Linguistic Invocation Governance · Section index · 20. Governed Decision Service Pattern →
19. Actuation Anchor and Reversibility Grading
19.1 Purpose
The actuation anchor governs every effect that crosses from the governance substrate into the real world. It classifies effects by reversibility and enforces human-authority gates for irreversible actions.
19.2 Reversibility Classes
| Class | Meaning | Gate Requirement |
|---|---|---|
reversible |
Can undo immediately (display alert) | Standard gate checks |
compensable |
Can compensate via declared procedure (TOI tag) | Gate + confidence floor |
irreversible |
Cannot undo (weapons cueing) | Gate + mandatory co-signature |
19.3 Seven Structural Invariants
Every ACTUATION_ANCHOR record SHALL carry:
- Originating certificate identity (references the conformance certificate)
- Consumer bridging-program identity
- Consumer bridging-program analysis-specification identity
- Causal-binding witness
- Actuation-scope intersection
- Procedural-confidence-at-admission (for classes with declared floors)
- Named-human-authority co-signature (required for irreversible classes)
19.4 Nine Gate Refusal Conditions
The actuation gate SHALL REFUSE if ANY of:
- Originating certificate absent or invalid
- Consumer program unregistered
- Consumer analysis spec unregistered
- Causal-binding witness fails re-derivation
- Actuation scope outside declared intersection
- Procedural confidence below declared floor
- Co-signature absent for irreversible class
- Co-signature expired (temporal validity window exceeded)
- Co-signer’s authority-standing revoked or out-of-scope
For irreversible-class actuations, there is NO override mechanism for condition 7.
19.5 Actuation-Accumulation Gate
Multiple individually-reversible actions that compose into an irreversible effect SHALL trigger escalation to irreversible-class gate requirements. Accumulation is tracked across configurable dimensions (count, cumulative risk, temporal density, cross-class interaction).
19.6 Authority-Standing Declarations
Co-signers SHALL hold typed, cryptographically-signed authority-standing declarations with: identity, consequence-bearing class set, declared scope, issuing-authority signature, temporal validity window, revocation reference.
Revocation of a standing declaration SHALL cascade: all actuations performed under that declaration within the retention window are flagged for review.
← 18. Non-Linguistic Invocation Governance · Section index · 20. Governed Decision Service Pattern →