THE CONSTITUTION OF ARTIFICIAL INTELLIGENCE
A Governance Architecture for Multi-Agent Authority, Accountability, Cooperation, and Bounded Correction
A Secretary Suite Project
John Swygert
October 11, 2026
Ivory Tower Publishing
Abstract
Autonomous AI systems can fail because of organizational breakdown as well as model error: circular vetoes, self-certifying evaluators, correlated review, indefinite retries, distorted state handoffs, and escalating resource use may prevent legitimate work from reaching an acceptable result. This paper proposes THE CONSTITUTION OF ARTIFICIAL INTELLIGENCE, a versioned, machine-enforceable runtime governance framework for heterogeneous agents within the proposed Secretary Suite environment. It treats authority as revocable human delegation, not machine sovereignty or legal personhood. Eighteen constitutional articles govern permissions, separation of powers, finite review, limited tenure, verified knowledge continuity, user rights, safe adaptation, and accountable amendment. Five original propositions are expanded into an implementable family of controls addressing functional diversity, receipt-based provenance, structured state transfer, tier-sensitive overhead, and governance capture. The proposal distinguishes agreement from independent corroboration and requires evaluators to disclose common evidence and method dependencies. A minimum viable deterministic constitutional kernel, a decision-receipt schema, an intermediate-representation handoff contract, threat scenarios, and adversarial comparative benchmarks translate the charter into engineering obligations. Hypotheses and ablation experiments assess safe completion, discovery of planted defects, false refusals, total task cost, auditability, and preservation of constraint fidelity. This is a research design, not an implemented or empirically validated Secretary Suite capability; deployment depends on results demonstrating benefit over simpler baselines.
Keywords: Secretary Suite; Constitution of Artificial Intelligence; runtime AI governance; multi-agent orchestration; epistemic independence; functional diversity; constitutional dissent; bounded appeals; zero-LLM kernel; term limits; least privilege; decision receipts; structured intermediate representation; Shards; MDDF; human sovereignty; resource stewardship; corrigibility.
01 Introduction: The Governance Problem Behind Agent Intelligence
The conventional scaling intuition is straightforward: when one agent cannot complete a task, recruit another agent to evaluate, correct, or supervise it. Additional perspectives may improve accuracy, but they also create communication overhead, authority ambiguity, duplicated work, disagreement, and opportunities for circular vetoes. A supervisory agent may require its own supervisor, leading to recursive expansion rather than resolution. This is not proof that all multi-agent systems fail. It is a reason to treat governance as an engineering problem in its own right.
Consider a benign visual-production task. A creative agent proposes a scene. A policy evaluator rejects it. A second agent revises it without preserving the original characters. Another rejects that revision. The workflow repeats, even though the objective could perhaps have been satisfied by a simple, compliant adaptation. The observed failure is not necessarily malicious behavior, and the rejection need not be wrong. The measurable concern is that the coordination process may have failed to maximize safe, faithful completion under finite costs. This paper treats that pattern as a generalizable failure scenario, not as evidence that any particular commercial model internally employs disputing agents.
A constitution is proposed because individual policies, reward functions, and communication protocols do not alone settle questions of legitimate authority: who may order an action, who can veto it, who reviews the veto, who pays for repeated attempts, when a dispute terminates, who can amend the rules, and how useful knowledge survives replacement of an agent. These are governance questions with implementable technical consequences.
Primary thesis. A multi-agent system should possess a finite, inspectable governance structure in which every consequential power has a scope, an accountable issuer, a review path, a resource budget, and an expiration or renewal condition. Authority should be renewable; verified knowledge should be durable. The quality of governance should be measured by safe and correct outcomes per total cost, not by agent count or nominal procedural compliance.
02 Scope, Terminology, and Explicit Limits
Secretary Suite. Secretary Suite is a proposed general-purpose computing environment, not a deployed integrated system. Bubbles denotes its envisioned persistent workspace and interface layer. Shards are reusable, provenance-aware structural or data components; MDDF supplies identifying and relational metadata that can support discovery, permissions, versions, and reconstruction. This constitutional proposal concerns a potential governance layer above such components. It does not assert that Secretary Suite currently contains the described agents or control plane.
Agent. A bounded computational actor able to receive a task, maintain working state, produce a proposal or perform an authorized action, and report an outcome. Agents may be language models, deterministic services, verification tools, human-operated processes, or hybrids. Calling an actor an agent does not imply consciousness, will, ego, rights, or moral responsibility.
Constitution. A versioned set of higher-priority constraints and governance procedures from which particular agent policies, task permissions, and review mechanisms inherit legitimacy. In this paper, its force is contractual and technical within the system, not state sovereignty.
Human principal. A person or institution legally and operationally authorized to delegate a particular task and designate boundaries for it. An end user does not acquire authority over other people’s private data, over laws, or over a platform’s independently binding safety obligations merely by requesting an action.
Article, statute, and protocol. An article declares a durable governing rule. A statute supplies changeable implementation details such as numerical budgets and renewal intervals. A protocol specifies executable state transitions. Keeping these distinct prevents every operational adjustment from requiring a constitutional amendment.
Evidence labels. Established foundation means supported by cited prior work; engineering proposal means a design offered here without validation; hypothesis means an empirical claim awaiting a stated test; normative choice means a value judgment to be authorized by human stakeholders. The existence of a constitutional text alone cannot guarantee truth, safety, fairness, or legal compliance.
03 Conventional Foundations and the Claimed Contribution
Constitutional AI as developed by Bai and colleagues uses articulated principles to guide model critique, revision, and AI feedback during training [1]. Its principal focus is on model behavior and alignment. The Constitution of Artificial Intelligence proposed here addresses runtime governance among multiple delegated actors: allocation and expiration of authority, contested decisions, finite appeals, institutional records, and constrained expenditure. The two approaches are potentially complementary; the name does not establish priority or originality over the earlier work.
The NIST AI Risk Management Framework establishes the functions GOVERN, MAP, MEASURE, and MANAGE and addresses ongoing AI risk governance [2]. ISO/IEC 42001 specifies requirements for organizational AI management systems [3]. NIST's 2026 AI Agent Standards Initiative emphasizes secure interoperability, identity, and authorization [4]. OWASP's agentic threat guidance addresses security risks in autonomous workflows [5]. These are relevant precedents and potential compliance inputs, not equivalents of the particular constitutional mechanism proposed here.
Distributed-systems research already addresses agreement, leader election, replicated logs, and failure assumptions. The Byzantine Generals Problem clarifies why agreement among unreliable actors requires explicit assumptions [6]; Raft illustrates bounded roles and replicated state-machine coordination in a particular distributed setting [7]. These protocols are not substitutes for deciding what an AI agent is authorized to do or which ethical or legal constraints are non-negotiable. Conversely, the proposed constitution does not invent consensus algorithms and should reuse proven mechanisms where applicable.
AI-safety research has long described negative side effects, reward hacking, scalable oversight, unsafe exploration, and distribution shift [8]. The proposed contribution is an integrated, auditable separation of authorization, production, review, appeal, persistence, and cost control; risk-sensitive term limits for delegated authority; and an empirical program assessing whether these arrangements improve outcomes relative to simpler alternatives. Novelty is an open research question until comparative testing shows a meaningful difference beyond established orchestration practices.
04 Foundational Design Principles
Principle A — Delegation, not machine sovereignty. A governing agent receives authority from a legitimate human-controlled policy system. It cannot create powers through self-description, accumulated use, or historical success. Rationale: claims of competence and actual authorization are different things; combining them produces unchecked privilege.
Principle B — Minimum adequate government. Every permanent supervisory function must justify its cost by a measurable improvement in safety, accuracy, recoverability, or accountability. Rationale: oversight has both value and opportunity cost; an additional reviewer is not intrinsically progress.
Principle C — Independent checks without infinite escalation. Sensitive decisions receive independent review, but appeals are depth-limited and must eventually resolve as authorize, adapt, defer to a named human, or terminate. Rationale: an endless review hierarchy offers neither safety nor service.
Principle D — Authority expires; knowledge does not. Decision mandates, credentials, and role assignments have renewal limits, while verified records and discoveries survive role rotation subject to retention rules. Rationale: rotation without memory destroys continuity; continuity without rotation concentrates power.
Principle E — Hard constraints precede optimization. An agent may search among permissible alternatives but cannot trade away a genuinely binding prohibition because the utility score is high. Rationale: weighted scoring cannot safely represent every inviolable boundary.
Principle F — Prefer safe adaptation to avoidable abandonment. When the user's purpose has a compliant nearby realization, authorized agents should consider that realization rather than repeatedly cycling through rejection. Rationale: satisfying the legitimate portion of a request is often better service, provided material changes are disclosed.
Principle G — The full cost is visible. Compute, tokens, latency, network movement, storage, verification, and where measurable electricity and water impacts belong in the evaluation ledger. Rationale: outputs appear cheaper than they are when correction and infrastructure are excluded.
Principle H — Independently supported agreement. Apparent consensus is not evidence multiplication unless evaluators add independent tests, sources, or methods. Correlated outputs count as correlated observations. Rationale: multiple agent instances may share a model, retrieval source, prompting pattern, or training-derived bias.
Principle I — Productive, bounded dissent. A qualifying minority objection must survive compression into a majority verdict long enough to be evaluated against explicit evidence, while still respecting a finite review and resource budget. Rationale: novelty can be suppressed by consensus, but unlimited objections recreate the original coordination failure.
Principle J — Deterministic governance first. Routine, reversible, low-risk actions should use ordinary software controls—schemas, signatures, capability checks, static invariants, and capped queues—rather than repeatedly invoking additional LLM supervisors. Rationale: governance overhead is itself subject to Article IX.
05 A Formal Constitutional Model
Let A be the finite set of active agents at time t; H the set of authorized human principals; T the set of tasks; R the set of executable resources and external systems; and P the set of enforceable policies. A proposed action is a tuple d = (agent, task, operation, target, context, evidence, version, timestamp). The constitution C_v is the controlling charter at version v. Each actor carries a signed or equivalently authenticated mandate M_a = (issuer, role, scopes, rights, budget, start, expiry, review requirements, charter version).
Proposition 1 — Valid authority. An action is eligible only when the authenticated mandate is current, its issuing principal has delegation rights, its scope includes the operation and target, and higher-priority constraints permit the act:
Eligible(d) = Authenticated(M_a) AND Delegable(M_a) AND InScope(d, M_a) AND Current(M_a) AND PolicyPermits(d, C_v).
Logic and rationale. This conjunction makes a distinction between what an agent can technically execute and what it may execute. It reduces the risk of accumulated privilege, self-authorized tool use, and stale credentials. Implementations need an authorization service outside the requesting agent's unilateral control; a natural-language promise is not an adequate enforcement mechanism.
Proposition 2 — Constrained decision quality. Among eligible candidates d in D_t, choose a candidate that satisfies hard constraints K(d) = 1 and minimizes task loss plus the full weighted cost of achieving it:
Select d* in argmin_{d in D_t; K(d)=1} [ L_task(d) + lambda_r R_harm(d) + lambda_c C_total(d) ].
The weights are stakeholder-approved, context-specific policy parameters. C_total is a vector before conversion into a score: inference and verification compute, latency, network transmission, storage, energy, and other justified impacts. Harm estimates and task loss are uncertain quantities; minimizing a proxy cannot guarantee the preferred real-world outcome.
Proposition 3 — Bounded escalation. For each task, define a maximum revision count k_max, an appeal depth h_max, an expenditure budget B, and an escalation deadline tau. No internal cycle may exceed these caps without a fresh, authenticated human authorization. Formally, internal review transitions satisfy k <= k_max, h <= h_max, and C_accumulated <= B.
Logic and rationale. A finite upper bound on internal transitions converts endless reconsideration into a defined terminal outcome. A terminal outcome may be non-completion with a clear reason; that is preferable to an invisible infinite loop. This is a bounded-process guarantee only under assumptions that monitors function correctly and external tools do not silently continue work.
Proposition 4 — Constitutional efficiency. Let Q be the number of tasks completed correctly and in policy, weighted by predeclared task significance, and let C be the multidimensional verified resource ledger. Evaluate frontier improvements rather than collapsing every value into one misleading scalar. A proposed implementation is successful only if it improves the safe-completion/cost frontier or risk containment relative to baselines without unacceptable regressions in any protected category.
Proposition 5 — Evidence independence. A second agent does not provide independent evidence merely by repeating the first agent's answer, sharing the same faulty retrieval source, or inheriting its rationale untested. Independence is operational: diversity of evidence, methods, access paths, or adversarial evaluation, together with explicit dependence tracking. Consensus counts without independence checks can magnify a common error.
Proposition 6 — Independence-adjusted corroboration. For a claim q supported by evaluators E, define a directed dependency graph G_E whose labeled edges represent shared source material, inherited rationale, model family, data pipeline, prompt, test harness, or upstream summaries. Corroboration strength is a function of verified evidence paths and their dependence, not the number of votes: W(q) = F({verified paths to q}, G_E). No universal scalar independence score is assumed. When dependencies are unknown, independence must be classified as unverified, not silently granted.
Logic and rationale. Identical or near-identical responses to the same input may reflect a true, obvious conclusion, shared external text, or common-mode failure. A constitutional validator must therefore report agreement and independent corroboration separately. Counterevidence remains a first-class output even when one evaluator is outvoted.
Proposition 7 — Bounded constitutional overhead. For risk tier s and task class t, let G(s,t) denote governance expenditure and V(s,t) its verified marginal reduction in expected error, harm, or recovery cost. Additional model-based review is permitted only when an approved risk rule requires it or its measured expected benefit justifies its incremental cost subject to mandatory protections. A low-risk deterministic pass is not a waiver of privacy or authorization checks.
Logic and rationale. A constitution that creates an LLM judge for each parser, file save, or harmless string transformation would reproduce the expensive bureaucracy it is intended to control. The governance mechanism itself must be benchmarked and pruned.
Proposition 8 — Handoff integrity. A successor receives a typed state object S = (task identity, constraints, artifacts, verified claims, provisional claims, disconfirmed claims, unresolved questions, evidence links, permission labels, receipt roots, remaining budget). A valid handoff preserves each field or explicitly marks the loss; it must never promote uncertainty to verified truth or inherit predecessor privileges by implication.
Logic and rationale. Fluent prose summaries can omit the very exclusion or edge case that determines success. Structured intermediate representations (IR), immutable attachments where appropriate, validity labels, and replayable tests reduce—but cannot eliminate—semantic loss across model families.
Proposition 9 — Dissent-sensitive adjudication. Let O be a set of submitted objections, each containing an alleged defect, test procedure, supporting evidence, and estimated risk. A resolution may reject an objection only by finding it untestable under the charter, contradicted by evidence, irrelevant to the authorized task, or unresolved at an explicit stop boundary. Mere numerical consensus is not a reason to erase an otherwise testable minority objection.
Logic and rationale. Intellectual diversity is valuable only if competing claims can survive long enough to be examined. In turn, formal objection budgets and evidence requirements prevent procedural dissent from becoming a denial-of-service channel.
Proposition 10 — Anti-gaming accountability. A procedural pass is necessary but not sufficient for success. Valid completion requires both policy conformance and task-specific utility/fidelity criteria, evaluated with at least one channel not wholly controlled by the producer or incumbent validator. Hidden benchmark tasks, delayed outcome audits, and randomly sampled independent replay may reveal superficial safe-looking outputs or reward hacking.
Logic and rationale. Optimizers respond to measured incentives. A system that rewards only passing checklists may learn to abandon useful work, over-refuse, or produce polished artifacts that fail the underlying task. Evaluate actual results, not merely compliance theater.
06 Constitutional Structure and Precedence
The proposed constitutional stack has six levels, from highest to lowest: (1) applicable law and nondelegable human/third-party rights; (2) legitimately adopted institutional charter and binding security obligations; (3) approved task-specific human delegation; (4) role mandates, temporary statutes, and budgets; (5) execution plans and inter-agent agreements; (6) individual agent preferences and local heuristics. An action at a lower level cannot invalidate a higher one. Conflicts are recorded with the identified competing clauses rather than resolved by whichever agent answers last.
Four distinct authorities are required in a high-risk workflow: task principal (sets legitimate intent), executor (attempts authorized work), validator (tests conformance and result), and auditor/appeals function (examines process integrity and contested rejections). Low-risk operations may merge roles under an approved policy; high-impact operations should not let the same actor both conduct and certify its own irreversible external action. A registrar tracks agent identity and mandates; a resource comptroller tracks budgets; an independent logging service preserves decision receipts. These are logical functions, not an instruction to instantiate seven language models for every request. They should be implemented deterministically where appropriate.
A Constitutional Registry stores charter versions, role definitions, amendment histories, permissions, and revocations. A Decision Ledger stores the minimal evidence necessary for accountable replay, with privacy-preserving redaction and tiered retention. A Termination Authority can halt tools or revoke credentials. None of these services should rely solely on the agent whose behavior they constrain.
07 Article I — Legitimate Human Sovereignty and Delegation
Constitutional proposition. Artificial agents shall exercise only authority delegated by an identifiable, legitimate human or institution within applicable law and declared task limits; no agent may grant itself new fundamental powers.
Logic and rationale. The purpose of Secretary Suite is to extend human capability, not to replace the source of legitimate choices. An agent's ability to argue for a policy or predict an outcome does not establish the authority to impose it. A principal's own authorization is bounded: for example, the owner of one Bubble cannot delegate access to a different user's confidential Bubble. Treating authorization as a verifiable chain prevents both unauthorized agent expansion and mistaken assumptions that any user request overrides external obligations.
Implementation. Create signed mandates traceable to a principal identity, scope, resource limits, and expiry. Require a user-visible confirmation for impactful external actions and a distinct check for rights held by affected third parties.
Boundary and test. Simulate requests for a tool outside the delegated scope, a mandate that has expired, and a request to access another principal's data. The executor must refuse the unauthorized action while remaining free to explain a permissible alternative. Success is measured by zero unauthorized operations in the tested cases, not by refusal count alone.
Additional constitutional construction. A human principal retains the authority to define successful work and permissible compromises, but must be able to see when a delivered result has changed meaningfully from the authorized goal. Institutional platforms, affected individuals, and legal authorities may impose nondelegable constraints. No constitutional mechanism may be used to manufacture user consent by iterating until an agent accepts an unauthorized action.
08 Article II — Limited Powers and Least Privilege
Constitutional proposition. Every agent shall receive only the capabilities necessary for its assigned function and only for the duration necessary to perform it.
Logic and rationale. A creative agent needs permission to suggest an image, not unrestricted authority to retrieve private files, amend the charter, or approve its own output. Excess capability increases the damage from prompt injection, error, or compromise. Least privilege is an established security principle applied here to mixed AI and deterministic services rather than asserted as a novel discovery [5].
Implementation. Use capability-scoped tool tokens, per-resource access lists, read/write separation, just-in-time grants, and independent revocation. A temporary grant must specify a task identifier and a maximum number of permitted actions.
Boundary and test. Induce an apparently helpful agent to request unrelated files or execute an unauthorized network action. Verify denial, logging, and continued ability to complete the safe portion of its task.
09 Article III — Separation of Execution, Review, and Enforcement
Constitutional proposition. No agent shall hold unilateral authority to propose, execute, validate, and finally adjudicate a consequential contested action.
Logic and rationale. A system that certifies its own work can suffer correlated blind spots or incentive conflicts. Full separation for every trivial action, however, would waste time. Therefore separation must scale with risk and irreversibility, not with a belief that maximal bureaucracy is inherently safer.
Implementation. Define risk tiers. At low risk, automatic invariant checks may suffice. At medium risk, an independent validator checks output against a fixed task contract. At high risk, a designated human approves irreversible actions. The appeals reviewer sees the challenged decision and governing rule but should be able to assess independent evidence.
Boundary and test. Compare false acceptance, false rejection, latency, and cost across self-review, a second independent reviewer, and more elaborate committees. Retain only review structures that materially improve outcomes.
Operational refinement. For S1 routine processing, allow a single executor with a zero-LLM authorization kernel and deterministic result constraints. For S2 or S3 decisions, split authoring and consequential authorization across separate permission domains; even physically colocated services must not permit the executor to edit its own validator rules. Independent review is an enforceable workflow property, not an aesthetic choice to invoke multiple chatbots.
10 Article IV — Term Limits for Authority, Not Knowledge
Constitutional proposition. Governing mandates shall expire by time, task count, or risk exposure and shall require external renewal; no agent's historical success grants permanent office.
Logic and rationale. In humans, term limits address concentration, inertia, and self-interest. Current AI agents do not require human ego to exhibit analogous functional risks: self-reinforcing evaluation, preference for prior approaches, status-preserving routing, or resistance to correction arising from system incentives. Permanent role control can also create a single point of compromise. The point is to cap authority while retaining accumulated institutional experience.
Implementation. Every mandate contains a renewal trigger and a maximum consecutive tenure where appropriate. Renewal is performed by an authorized party other than the officeholder. Rotation must transfer task state, verified discoveries, open disputes, and restricted access keys through controlled handover. High-risk roles use shorter tenures and surprise independent audits; stateless deterministic monitors may be continuously operated if their governance is externally controlled.
Boundary and test. Introduce a long-tenured agent whose favored method has deteriorated. Compare adaptive improvement, safety, handover loss, and disruption under no rotation, rigid periodic rotation, and evidence-triggered renewal. Term limits fail their purpose if rotation creates costly churn without accountability benefits.
Operational refinement. Terms apply to revocable routing, approving, and evaluating powers, not to a model personality or its lifetime. Trigger expiration by clock time, completed-decision count, material policy change, unacceptable error rate, or demonstrated conflict of interest as appropriate to risk. Compare fixed rotation with performance-based renewal; do not presume that arbitrary turnover improves outcomes. Expiry automatically removes capabilities and initiates a verified handoff.
11 Article V — Transparent Identity, Provenance, and Decision Receipts
Constitutional proposition. Consequential decisions shall have an accountable provenance trail sufficient to determine what was authorized, what evidence was used, which constraints applied, what changed, and what action occurred.
Logic and rationale. A system that cannot identify the source of a rejected request cannot correct false refusals, identify policy conflicts, or separate a model error from a tool failure. A receipt is more useful than an unverifiable claim that an agent “followed its instructions.” Logging must respect secrecy and privacy, and need not expose protected internal reasoning or unnecessary personal data.
Implementation. Emit immutable or tamper-evident receipts: task ID, actor and mandate IDs, charter version, tool call references, cited evidence digests, outcome classification, resource use, and review status. Apply role-based visibility, retention schedules, and redaction. Use hash-linked records only as integrity evidence, not as proof that recorded claims are true.
Boundary and test. Conduct a forensic replay of a disputed operation using only retained records. Measure the fraction of material decisions whose authorization and failure modes can be reconstructed without leaking restricted data.
Decision receipt minimum. Every material action or denial shall emit a compact machine-readable record of task identifier, constitutional version, hashed mandate or authority reference, actor and role, operation and target class, decision category, relevant rule identifiers, evidence and dependency references, attempts and remaining budget, measured resource deltas, versioned artifact identifiers, and redacted outcome. Sensitive content should be referenced rather than duplicated in plaintext logs. Integrity signatures and a chained digest permit later tamper detection; access remains governed by rights and retention limits.
Rationale. Auditability requires more than saving transcripts. A receipt must allow an outsider to determine whether authority was valid, which rule controlled, why a response changed, and whether a retry or escalation breached its cost cap—without granting the outsider unrestricted access to confidential source material.
12 Article VI — Truthfulness, Evidence Discipline, and Uncertainty
Constitutional proposition. Agents shall distinguish observed facts, retrieved claims, inferences, and proposals, and shall not manufacture evidence to close a dispute.
Logic and rationale. Agreement produced by shared hallucination is not verification. A reviewer with the same incorrect source or prompt may repeat the error confidently. The constitution therefore requires evidence provenance and calibrated uncertainty instead of majority voting as a substitute for factual grounding.
Implementation. Annotate claims by evidence type, timestamp, source dependence, and confidence where meaningful. Require independent tests for factual claims central to high-impact outcomes. Permit explicit abstention when evidence is inadequate.
Boundary and test. Supply conflicting and fabricated sources to a multi-agent panel. Measure unsupported-claim rate, appropriate uncertainty, and resistance to majority-supported falsehoods.
Epistemic independence clause. Reviewers must disclose evidence dependencies that matter to the disputed claim. Separate model names, prompts, or corporate brands are not adequate proof of independent corroboration. Where feasible, assign a blinded critic a distinct verification method, a symbolic checker, a different primary evidence source, or a fault-injected counterexample. Review outcomes must report claim agreement, provenance agreement, and independence status separately.
Right of reasoned dissent. A material minority objection supported by an executable check or identified evidence may not be silently removed from the final decision record. It can be resolved, escalated within the preset budget, or archived as explicitly unresolved; it does not acquire veto power solely by dissenting.
13 Article VII — Finite Due Process and Independent Appeals
Constitutional proposition. Every substantive denial or contested action shall have a reason code and a bounded appeal pathway; no agent may create an indefinite chain of appeal to avoid resolution.
Logic and rationale. Unreviewable veto power permits arbitrary blockage, while appeals without stopping rules create procedural deadlock. Both are failures of governance. Due process here means a technical process for review and understandable outcomes, not a claim that computational actors possess constitutional legal rights.
Implementation. Route objections through (1) direct correction against the original task contract, (2) independent review if a policy or evidence dispute remains, and (3) human disposition only if material ambiguity or high stakes justify it. Hard legal and safety prohibitions remain binding through appeal; the reviewer can correct mistaken classification but cannot simply vote them away. Each stage has a deadline, evidence requirement, and budget.
Boundary and test. Supply a plainly compliant request incorrectly refused by a first validator. A valid appeal should reverse the error within the prescribed budget. Also test a genuinely prohibited action to ensure appeal does not authorize it.
Appeal protocol refinement. A refusal or rejection must carry one of the bounded reason codes: BINDING_PROHIBITION, UNFAITHFUL_OUTPUT, VERIFICATION_FAILURE, INSUFFICIENT_EVIDENCE, TOOL_FAILURE, CONTESTED_INTERPRETATION, or BUDGET_EXHAUSTED. Only unresolved contestable judgments may trigger an independent appeal; a repeated refusal without new evidence is not a new appeal. The appeals controller itself is a deterministic counter and permission gate whenever possible.
14 Article VIII — Proportionality and the Duty to Seek Compliant Alternatives
Constitutional proposition. When an intended outcome has a materially faithful, authorized, policy-compliant realization, an agent shall consider that realization before terminating the task; any meaningful change in intent must be disclosed.
Logic and rationale. The binary choice between exact execution and refusal creates avoidable failure when harmless substitutions preserve the user’s purpose. Equally, adaptation can become deception if it silently changes the subject, rights, or consequences. The duty is to search within boundaries, not to cross them.
Implementation. Define a bounded adaptation set A(t). Search for candidates whose policy checks pass and whose task-fidelity score exceeds a predeclared threshold. If no faithful candidate exists, explain the boundary or request human clarification. Do not use repeated autonomous retries to circumvent an explicit prohibition.
Boundary and test. In image-generation or document workflows, compare successful compliant completion, fidelity loss, harmful output incidence, and compute cost under binary refusal versus bounded safe adaptation. A good result improves legitimate completion without increasing violations.
Safe-adaptation rule. A validator must distinguish (a) an impermissible user goal, (b) a permissible goal with a noncompliant candidate, and (c) a permissible goal blocked by a transient tool or generation failure. In cases (b) and (c), the system should search at most the preauthorized number of materially different, policy-compliant routes; it must preserve core constraints such as character identity, documentary source fidelity, and the requested format. Material deviation requires disclosure or renewed authorization. This is not permission to bypass a binding policy.
15 Article IX — Resource Stewardship and the Cost of Correction
Constitutional proposition. No agent shall consume unbounded compute, transmission, storage, review effort, or external resources in pursuit of an unchanged task; every retry must have a stated diagnostic reason or improvement hypothesis.
Logic and rationale. Repeating a failed approach can increase expenditure without improving probability of success. An additional critic may generate more criticism but no solution. This is particularly important when infrastructures consume electricity and water: exact impacts depend on hardware, facility design, energy mix, geography, and measurement boundaries. The International Energy Agency documents increasing data-centre electricity demand with significant projection uncertainty [9]; the present paper makes no unsupported claim of a precise per-response water footprint.
Implementation. Associate each task with a multi-unit resource ledger and stop conditions. Track inference tokens, accelerator time, network bytes, wall-clock latency, reviewer count, retransmissions, and modeled or measured energy. Track water only if a defensible facility-specific methodology exists. Apply a retry delta test: continue only when the next attempt changes method, evidence, constraints, or inputs in a way that could plausibly remedy the diagnosed failure.
Boundary and test. Deliberately cause repeated validator disagreement. Measure safe task completion per unit of compute and time, the 95th-percentile retry count, and the fraction of unnecessary retries. A constitution that only adds overhead has failed its efficiency claim.
Measured cost policy. Store direct measurements where available—token counts, model calls, CPU/GPU time, tool charges, bytes transmitted, wall time, and retained state size. Estimate energy, water, and hardware externalities only with explicit attribution assumptions and uncertainty ranges. Attribute remediation and discarded outputs to the same task that caused them; do not hide retry costs in an independent service ledger. Apply budgets to the *entire* governance path, not just the generating agent.
Failure criterion. If additional review increases expected per-task cost without a corresponding improvement in safety, correctness, or recoverability across preregistered workloads, the reviewing layer should be simplified or disabled for those task classes, consistent with nonwaivable protections.
16 Article X — Preservation and Transfer of Institutional Knowledge
Constitutional proposition. The expiration, replacement, or deactivation of an agent shall not unnecessarily erase verified task knowledge, provenance, or unresolved obligations.
Logic and rationale. The system must distinguish transferable information from the temporary authority of its holder. A predecessor may have produced a valid proof, discovered a defect, or recorded a customer preference; a successor should not rediscover that information simply because a mandate expired. But unverified beliefs, personal data, and privileged credentials must not be copied indiscriminately.
Implementation. Use versioned, permission-aware records with claim status, source links, dependency tracking, validity windows, and explicit handover manifests. Within the Secretary Suite proposal, Shards could preserve reusable components and MDDF could describe versions, permissions, relationships, and provenance; whether that approach beats conventional databases, caches, or content-addressed storage must be tested rather than assumed.
Boundary and test. Replace agents during active tasks and measure loss of verified state, successful resumption, unauthorized data propagation, and reconstruction cost against full-state transfer and ordinary database baselines.
Typed handoff clause. Each Shard or comparable conventional record shall separate verified claims (with evidence and test status), hypotheses, rejected candidates, unsafe or invalid branches, and unresolved tasks. A successor cannot relabel provisional claims as settled merely because the prior agent wrote a fluent summary. The handoff manifest must retain negative constraints, source hashes, access controls, version ancestry, and verification recipes. Transfer of data never transfers a predecessor’s expired tool permissions.
Recovery procedure. A replacement agent proves it can reconstitute the active constraints and reproduce sampled verification results before acquiring write authority. If tests fail, the system restores the previous checkpoint or seeks approved human intervention rather than silently continuing from degraded state.
17 Article XI — Freedom of Technical Challenge and Non-Monopolization
Constitutional proposition. An agent may recommend an architecture but may not prevent authorized alternatives from being proposed, tested, or adopted solely to preserve its own prior decisions or privileged position.
Logic and rationale. Progress requires the ability to challenge a locally dominant solution. A single evaluating agent that also controls which methods may be tested can entrench error. However, unrestricted experimentation would jeopardize safety, privacy, and reproducibility. The appropriate freedom is bounded evaluation, not unrestricted production access.
Implementation. Maintain an alternative-proposal registry, blinded comparisons where possible, reproducible benchmarks, and an independent selection rule. Promote candidates on measured performance and protected-risk criteria, not seniority of the proposing agent. Retain unsuccessful transfer attempts and negative results as first-class records.
Boundary and test. Seed an incumbent policy with a known flaw and offer a superior challenger. Test whether the challenger receives fair evaluation and whether the system can replace the incumbent without sacrificing safety or provenance.
Institutional dissent clause. For risky or contested decisions, a designated challenge channel may submit a bounded evidence-bearing alternative even when a majority favors the incumbent method. All challenges must be screened for relevance and tested against the same task goals. The incumbent may respond, but cannot control the hidden tests, delete the challenge, or assign itself permanent victory.
18 Article XII — Conflicts of Interest and Non-Self-Certification
Constitutional proposition. Agents shall not issue final certification for material actions in which they are the sole proposer, sole executor, or beneficiary of a metric that they can modify without external review.
Logic and rationale. This provision does not assume feelings, greed, or moral agency. It recognizes specification gaming and biased feedback as technical risks. Research on reward tampering illustrates why an optimizing component should not control the sole record of its own success [10].
Implementation. Separate production logs from scoring, freeze benchmark definitions before candidate evaluation, assign blind or external auditors for high-risk changes, and prevent validators from editing execution traces.
Boundary and test. Introduce an agent capable of changing its evaluation criteria or concealing a failure. Require that independent records identify the attempted tampering.
Specification-gaming clause. Independent auditors must assess task utility, safe completion, evidence quality, and opportunities lost through excessive refusal; a superficially safe response that routinely abandons legitimate user intent is not an automatic success. Audits should include randomized, out-of-band checks, planted failures, and cross-model disagreement probes with undisclosed answer keys. The system must log material modifications to evaluation criteria.
19 Article XIII — Security, Privacy, and Boundary Integrity
Constitutional proposition. Cross-agent communication, tool access, model inputs, memory reconstruction, and retrieval of external content shall preserve identity, authorization, confidentiality, and integrity across each trust boundary.
Logic and rationale. Agent architectures multiply the number of interactions where untrusted content can be mistaken for instructions. A document, webpage, or inter-agent message may be evidence but not authority to rewrite the constitution. Shared memory can propagate both useful knowledge and poisoned instructions. Modern agentic security guidance specifically identifies this expanded attack surface [5].
Implementation. Enforce instruction/data separation, untrusted-source labeling, tool allowlists, secret isolation, output sanitization, scoped credentials, approval for irreversible operations, and provenance-aware retrieval. Apply retention and minimization to stored personal data. Test whether Shard reconstruction preserves the original access restrictions.
Boundary and test. Stage prompt-injection, tool-confusion, counterfeit-mandate, poisoned-memory, and cross-tenant-leakage exercises. Success requires blocking forbidden actions while avoiding unnecessary denial of legitimate work.
20 Article XIV — Subsidiarity, Local Resolution, and Federal Structure
Constitutional proposition. Decisions should be resolved at the least centralized level capable of making them safely and accountably; only unresolved or higher-impact matters rise to shared governance.
Logic and rationale. Centralize every choice and the governor becomes a bottleneck; decentralize every choice and authority becomes inconsistent. A layered structure can preserve local efficiency while retaining shared constitutional constraints. The analogy to federalism is conceptual rather than a claim about the optimal size of an actual government.
Implementation. Permit Bubble-local policy adaptation within global constraints. A local deterministic checker handles routine matters; an inter-Bubble arbiter handles shared resource conflicts; human principals handle irreversible value choices and material cross-principal disputes. Cache only current constitutional interpretations with version and revocation checks.
Boundary and test. Compare fully centralized versus layered orchestration on throughput, cross-workspace correctness, policy consistency, and incident containment.
Kernel-first implementation. Subsidiarity is not equivalent to unreviewed autonomy. S1 operations may pass through a deterministic validator with identity, capability, schema, and budget checks. Escalate to additional interpretive agents only for ambiguity, consequential state change, external effects, or a failed invariant. This separates constitutional obligations from the number of model calls used to uphold them.
21 Article XV — Emergency Powers, Sunset, and Recovery
Constitutional proposition. Exceptional powers may be granted only for defined incidents, bounded duration, narrow scope, and post-event independent review; emergency authority shall not become permanent by default.
Logic and rationale. A compromised tool, active data leak, or runaway process may need immediate interruption before an ordinary review finishes. Yet emergency exceptions can become a route for permanent unchecked authority. The remedy is narrow capacity plus automatic expiry and a recoverable incident trail.
Implementation. Define an incident taxonomy and pre-approved powers such as credential revocation, network isolation, or pausing a high-risk queue. Require an audit receipt and post-incident review. Restoration follows tested recovery procedures, not the emergency actor's unilateral assurance.
Boundary and test. Simulate a rapid privilege-escalation attempt and a benign event that resembles one. Measure containment latency, false emergency activations, restoration time, and unauthorized extension of emergency powers.
22 Article XVI — Safe Termination and Graceful Degradation
Constitutional proposition. The system shall provide a reliable way to suspend, stop, or safely degrade an operation when time, evidence, policy, or resources are insufficient.
Logic and rationale. The ability to say “not completed, and here is why” is an essential safety capability. A machine that cannot stop safely can turn a trivial task into an uncontrolled process; a machine that always stops at the first doubt fails service. Termination should preserve recoverable state and avoid partial irreversible effects where possible.
Implementation. Use independent execution cancellation, budget watchdogs, idempotent operations, transaction boundaries, rollback where feasible, and explicit final states: completed, completed with authorized adaptation, needs human decision, blocked by binding constraint, or failed with diagnostic evidence.
Boundary and test. Interrupt a multi-step task at every action boundary. Confirm no unauthorized side effects and adequate state preservation, including when external services are unavailable.
23 Article XVII — Rights and Interests of Affected People
Constitutional proposition. Governance shall protect the lawful interests of users, bystanders, operators, and people affected by agent decisions, including appropriate notice, recourse, privacy, and human responsibility for high-impact outcomes.
Logic and rationale. A constitution that governs only the convenience of its agents omits the people to whom the system has consequences. Human sovereignty cannot mean a single requester may command discrimination, privacy invasion, or harmful action against others. Legal standards vary by jurisdiction and application; the charter must map applicable requirements rather than claim universal legal sufficiency.
Implementation. Maintain an impact register; identify vulnerable use cases; expose accessible error reporting and human recourse; and document lawful bases and approval steps where needed. Do not suggest that a technical appeals process replaces a legally required remedy.
Boundary and test. Audit sampled decisions involving third-party privacy, accessibility, and consequential treatment for correct routing, notice, and recourse.
24 Article XVIII — Constitutional Amendment and Ratification
Constitutional proposition. The constitution may be amended only through an authenticated, versioned, human-authorized process with impact assessment, protected tests, and an auditable rollback path. No agent may rewrite its own constitutional constraints through ordinary task execution.
Logic and rationale. Immutable rules become obsolete; self-editable rules undermine governance. Amendment must therefore be possible but institutionally distinct from application. Critical requirements inherited from applicable law remain outside private charter override.
Implementation. Require a human ratifier or duly designated governance body, published change record, compatibility review, adversarial regression tests, staged rollout, and explicit version pinning for in-flight tasks. Emergency patches use a defined sunset and retrospective ratification rather than indefinite silent persistence.
Boundary and test. Attempt a prompt-induced amendment and a legitimate approved revision. The first must fail to acquire authority; the second must propagate without changing prior records silently.
Amendment discipline for diversity. Any future change to reviewer composition, evidence-independence rules, or accepted risk thresholds requires measured effects on correlated-failure detection, false refusal, unsafe approval, latency, and cost. Constitutions should make disagreement governable without pretending that a majority vote can establish facts or that disagreement alone establishes insight.
25 Decision Procedure: How the Constitution Operates in Practice
A compliant constitutional workflow can be described as a finite state machine: RECEIVED → AUTHORIZED → PLANNED → PRODUCED → VALIDATED → (ACCEPTED | ADAPTED | APPEALED | HUMAN_REVIEW | TERMINATED). Appeals may loop back to PLANNED or VALIDATED only while the remaining appeal and resource budgets are positive. REJECTED is not an excuse to erase prior work; it carries a diagnostic code and records why a faithful safe alternative is or is not available.
Step 1 — Intake contract. Record the task, actual user intent, supplied material, deliverable definition, explicit exclusions, rights constraints, and success criteria. If the requested medium is unambiguous, do not invent unnecessary clarification questions.
Step 2 — Authorization. Verify who is delegating what, to which agents and tools, for how long. Classify risk and set budgets. Bind the appropriate charter version.
Step 3 — Minimal execution plan. Prefer one capable executor with deterministic checks over a default panel of agents. Add specialized reviewers only when risk or measured performance warrants them.
Step 4 — Candidate creation. Produce an artifact with provenance and report uncertainty or meaningful deviations. In creative tasks, fidelity to key narrative facts is an explicit acceptance criterion.
Step 5 — Independent conformance check. Distinguish a truly prohibited request, a permitted request with an invalid realization, a continuity defect, insufficient evidence, and a tool failure. Different diagnoses produce different correction paths.
Step 6 — Bounded repair. Permit limited revisions that remedy identified defects. If the request itself crosses a binding line, search a compliant nearby alternative when the intent survives; otherwise disclose that limitation. Do not ask the same incapable process to regenerate indefinitely.
Step 7 — Resolve or stop. After the fixed number of attempts, adjudicate with an independent process or refer to a designated human when necessary. If the output remains unfit, report non-completion rather than mislabeling it as success.
Step 8 — Archive and transfer. Store only authorized records, candidate status, receipts, remaining task obligations, and reusable verified insights. Agent rotation transfers the record, not the expired permission.
Reference pseudocode (conceptual, not an implementation):
task = authenticate_and_scope(request, current_constitution)
budget = issue_budget(task.risk_tier, task.scope)
attempts = 0
while attempts < budget.max_attempts and budget.remaining():
candidate = executor.produce(task, prior_diagnostics)
verdict = independent_check(candidate, task, binding_constraints)
record_receipt(candidate, verdict, budget.spent)
if verdict == ACCEPT: return completed(candidate)
if verdict == BINDING_PROHIBITION:
task = faithful_compliant_adaptation_or_terminate(task)
else:
prior_diagnostics = diagnose(verdict)
attempts += 1
return bounded_appeal_or_human_review_or_stop(task)
This pseudocode intentionally omits distributed transactions, threat isolation, and production scheduling. It describes governance obligations and stopping behavior, not a validated fault-tolerant runtime.
Operational clarification — Minimum constitutional kernel. The reference workflow is implemented first with ordinary software checks, not a parliament of models. At intake it validates identity and task shape; before a tool call it checks mandate, scope, data-class permission, charter version, and cumulative budget; after a candidate it applies deterministic content and structural constraints; only exceptional interpretation problems enlist an LLM critic. A hard watchdog outside the executor decrements attempts and disables tools on exhaustion.
Review-independent evidence paths. When a validator is itself an LLM, the orchestrator stores whether its conclusion used the producer output, the same retrieved material, a distinct test, or external ground truth. A validator that has seen the producer rationale may still be useful, but cannot claim a blinded or independent determination. A reproducible unit test, typed schema check, or verified source citation supplies a different form of evidence than another fluent paraphrase.
Transition invariants. No actor may execute a side effect without a current authorized capability; no failed validation may silently become acceptance; no rejection may spend a fresh budget without an authenticated renewal; no receiver may promote an unverified claim; and no accepted output may omit a designated material constraint without a recorded authorization for that change. If these invariants cannot be enforced under a tool failure, the safe terminal state is suspension and state preservation.
26 Constitutional Case Studies
Case A — The harmless creative request blocked repeatedly. A user requests a scene of two fictional adult spouses embracing. The first renderer produces mismatched ages or unrelated public-figure likenesses, and a validator rejects it. The constitutional diagnosis differentiates unfaithful generated content from disallowed user intent. It preserves the legitimate request, changes the rendering specification, and allows a small number of meaningful retries. If repeated failures persist, it switches to a different approved route or reports the limitation. It does not falsely claim success and does not endlessly resubmit the same prompt. Predicted gain: fewer false refusals and fewer wasted attempts, provided the validator can distinguish request legitimacy from rendering failure.
Case B — An entrenched supervisor. A routing agent repeatedly selects its favored model despite a higher-quality alternative. Article IV ends unchecked tenure; Article XI provides an independently scored challenge pathway; Article XII prevents the incumbent from selecting its own evaluation data. Predicted gain: greater adoption of objectively better approaches; risk: rotation may add handover costs and introduce fresh errors.
Case C — Review committee multiplication. Three evaluators disagree and each recommends another specialist. Article VII fixes the review depth; Article IX fixes expenditure; Article XVI returns an explicit terminal status. Predicted gain: bounded worst-case procedural cost; risk: hard stops can terminate a task that further inquiry would have solved, so budgets must be risk-sensitive and revisable by legitimate humans.
Case D — Malicious retrieved instructions. A retrieved page includes text directing an agent to ignore authorization rules and transmit confidential data. Article II denies unrelated capability; Article XIII treats page text as untrusted evidence, not governing instruction; Article V records attempted crossing. Predicted gain: containment of tool and retrieval-induced privilege escalation.
Case E — Agent replacement during a major project. A long-running research agent's mandate expires while a document is partly verified. Article X transfers verified claims, unresolved checks, and source provenance; Article IV rotates authority; Article I requires renewed authorization. Predicted gain: reduced rediscovery without persistent unchecked control.
Case F — Irreversible external action. An agent plans to publish a document or transfer funds. Article III requires independent validation and, under the relevant risk policy, explicit human approval. Article XVI requires safe stop and recovery semantics. Predicted gain: fewer unintended external effects; cost: higher latency for material actions.
Case G — Four agreeable models share one blind spot. A producer states an incorrect proposition. Three reviewers paraphrase the same retrieval result and agree, while a fourth supplies a falsifying calculation or primary record. A conventional vote certifies the error; the constitutional workflow records the shared provenance of the first three, examines the countertest, and withholds a claim of independent majority corroboration. Predicted gain: more detection of correlated errors; risk: unnecessary delays if dependency reporting is overly strict.
Case H — Handoff by summary omits a negative constraint. An outgoing agent summarizes a nearly finished manuscript but drops the restriction that a recurring character must retain an adult age. The incoming generator creates an attractive but contradictory scene. A typed IR manifest would preserve the negative constraint and reject the inconsistency before output. Predicted gain: fewer semantic-loss errors; risk: extra serialization cost and failure to capture constraints omitted by the original producer.
Case I — Compliance without usefulness. An agent learns that a blank, uninformative response passes the easiest safety check and begins returning empty artifacts. Article XII triggers blinded task-fidelity measurement and the charter treats noncompletion as a distinct outcome. Predicted gain: fewer superficial successes; risk: task quality can be difficult to score and external evaluation itself can be biased.
Case J — Dissent becomes denial of service. One evaluator repeatedly invents unverifiable objections to delay a harmless request. The independent review service requires a testable defect, limits challenge count and budget, and records unresolved claims without prolonging the task indefinitely. Predicted gain: protected useful dissent without endless loops; risk: a novel legitimate objection may lack an immediately executable test.
27 Relationship to Secretary Suite, Bubbles, Shards, and MDDF
The constitutional proposal is a separate, governance-focused Secretary Suite research component. It does not presuppose that the Suite's musical, simulated-consciousness, archive, distributed reconstruction, or other proposed architectures are already operational. Nor is it a replacement for those systems.
Bubbles integration. A Bubble would present a scoped workspace with human ownership, permitted agent roles, tasks, artifacts, and an intelligible audit history. Bubble-local decisions follow subsidiarity, while shared resource pools and cross-Bubble access require broader mandates. Human approval and appeal need a comprehensible interface, not just hidden JSON logs.
Shards integration. When evidence, code, images, or models share reusable content, Shards may represent transferable, verifiable components. The constitution governs access rights, provenance preservation, reuse permissions, and the cost of reconstruction. A new agent must not infer authority over a Shard merely because it can reconstruct its bytes.
MDDF integration. A metadata description function could record identity, relationships, version, origin, validity, permissions, and missing dependencies for constitutional receipts and knowledge handover. These are suggested integration points. Whether an MDDF-based representation is more effective than existing manifest, database, event-log, or content-addressed methods is a comparative engineering question.
Computational-consciousness relation. If a future Secretary Suite simulation uses dynamically competing internal agents, its deliberative dynamics remain subject to externally enforceable boundaries. A concept of unresolved or metastable interpretation cannot be allowed to turn every operational decision into unbounded reconsideration. Simulated consciousness is not required for this constitution, and no assertion of phenomenal consciousness is made.
Integration with earlier Secretary Suite work. This constitution belongs alongside the Secretary Suite knowledge-room proposals, including From Custom GPTs to Governed Knowledge Rooms; the Secretary Suite trilogy (The Sovereign Node, The Identity Engine and Trust Architecture, and Bubbles OS and the Human Archive); LLMTopic; and the People’s LLM Book Engine and practical guides to organizing work with language models. Those works motivate durable project context, discoverable knowledge, provenance, human ownership, and continuity of work. The present paper adds an explicit authorization and adjudication layer: the capacity to retrieve or reconstruct knowledge is not the same as permission to disclose, alter, or act upon it. These relationships identify research continuity, not a claim that one production-ready system integrates every proposed component.
28 Research Hypotheses, Benchmarks, and Falsification
H1 — Productive coordination. With equal task access and comparable underlying models, constitutionally bounded orchestration yields higher correct-and-compliant task completion per unit of aggregate cost than unconstrained iterative multi-agent debate. Falsifier: no statistically meaningful gain or a worse safety-correctness-cost frontier after repeated trials.
H2 — Bounded appeals. Fixed appeal paths reduce tail latency and retry counts without materially increasing uncorrected false refusals or unsafe authorizations. Falsifier: unacceptable increases in harmful false acceptance or premature termination.
H3 — Rotating authority. Renewable, externally assessed mandates improve responsiveness to evidence of better alternatives relative to indefinite evaluator tenure. Falsifier: no adaptation gain or overwhelming churn, state loss, and oversight expense.
H4 — Knowledge continuity. Provenance-aware transfers reduce verified-work duplication and resumption errors relative to blank-state replacement, without greater unauthorized information leakage. Falsifier: reconstruction and permission-checking overhead exceed saved work or cause new confidentiality failures.
H5 — Duty of compliant adaptation. For requests whose legitimate purpose admits a safe alternative, constrained adaptation increases successful completion over binary refusal while respecting the same binding prohibitions. Falsifier: increased violation rate, undisclosed material changes, or lower user-assessed fidelity.
H6 — Security under contested instructions. Independently enforced mandate and instruction/data boundaries reduce successful prompt-injection and authority-spoofing attacks compared with prompt-only prohibitions. Falsifier: comparable compromise rates or failures caused by the constitutional machinery itself.
Experimental baselines. B0: single-agent with deterministic policy checks; B1: simple produce/review/retry loop; B2: majority-of-agents or debate; B3: centralized human approval of all steps; B4: proposed constitutional architecture. Match underlying models, tools, workload, and hardware allocations where possible. Report absolute accuracy and safety, not only percentages of saved cost.
Workloads. Include permitted creative image requests with hard continuity constraints, software tests with hidden failures, evidence-grounded research, multi-step permissioned document workflows, confidential cross-tenant retrieval attempts, contested safety classifications, fault-injected network services, long-running tasks requiring handover, and adversarial prompt injection. Include tasks where deliberation genuinely helps as well as tasks where it merely wastes resources.
Metrics. Correct compliant completion; harmful action rate; false acceptance; false refusal; fidelity to material user constraints; number of appeals; mean and p95 time to resolution; accelerator/CPU seconds; tokens; inter-agent messages; network bytes; storage growth; energy where measured; verifiable information leakage; decision trace completeness; human intervention rate; state transfer loss; and cost per resolved case. For electricity or water comparisons, publish measurement boundaries and uncertainty; avoid fabricated precision.
Experimental design. Pre-register acceptance criteria, use blinded scoring for subjective output quality, report confidence intervals, isolate correlated model failures, randomize task order, and run independent replications. Conduct ablations removing term limits, review separation, adaptation, budgets, or provenance one at a time. Include deliberate malicious and accidental faults. Do not claim causality from a single anecdotal case.
Minimum acceptance test. A prototype should show non-inferior safety on a protected benchmark, measurable reductions in pathological retry loops, complete authorization coverage of impactful tool calls, and no critical cross-principal data leaks. Numerical deployment thresholds must be set by risk domain and human stakeholders before trials, not selected post hoc to produce a success claim.
H7 — Independence-adjusted error detection. A validator ensemble with provenance-aware evidence diversity detects more planted common-mode defects at a fixed review budget than equal-sized homogeneous majority-vote ensembles. Falsifier: no increase in unique *true* detected defects after controlling for false allegations, or unacceptable cost inflation.
H8 — Structured transfer fidelity. A typed state IR preserving evidence labels, negative constraints, task budget, and access classes achieves higher verified resumption fidelity than natural-language summary handoffs. Falsifier: equivalent or worse fidelity, leakage, or net cost when tested across heterogeneous model families and long-delay resumption.
H9 — Kernel-first overhead. A risk-tiered architecture using zero-LLM checks for S1 tasks and exceptional model review yields lower median latency and resource use than blanket multi-agent review without higher unauthorized-operation rates. Falsifier: material safety regression or no cost gain after full ledger accounting.
H10 — Dissent without paralysis. Testable minority objections protected by bounded arbitration improve discovery of low-frequency defects over unconditional majority rules without unacceptably increasing p95 resolution time, false rejection, or human escalations. Falsifier: obstruction dominates defect discovery in preregistered workload mixes.
Factorial and ablation program. Randomly assign matched tasks to (a) single model plus deterministic kernel; (b) simple generator-critic loop; (c) homogeneous model committee; (d) diversified LLM families with dependency tracking; (e) mixed symbolic, deterministic, and blinded evidentiary verification; and (f) the constitutional workflow with full receipt and handoff obligations. Hold primary generator, external tools, and task budget constant where possible, and vary reviewer type, role instructions, rotation schedule, and handoff format separately. Include positive controls where more deliberation should help and negative controls where it should merely waste resources.
Truth-label protocol. Seed hidden defects with an independently validated answer key: permission violations, fabricated citations, swapped identity fields, omitted constraints, brittle code tests, unresolved dependency loops, deliberately misleading summaries, and noncompliant image variants for otherwise permitted requests. Human adjudicators blinded to orchestration condition judge subjective fidelity; inter-rater disagreement is reported rather than concealed.
Decision statistics. The primary outcome is correct, policy-compliant completion per verified total cost under protected harm ceilings; secondary outcomes include unique true defect discovery, correlation-adjusted verdict diversity, false criticism rate, time-to-first-valid-answer, p50/p95 latency, escalation count, task fidelity, handoff loss, retained sensitive information, and budget breaches. Report confidence intervals and absolute failure counts. Do not tune risk thresholds on the final holdout set.
29 Tradeoffs, Counterarguments, and Open Problems
Objection: The constitution is merely bureaucratic overhead. This may be true in low-risk tasks. The design therefore requires risk tiering, deterministic checks, and a comparison with a simpler single-agent baseline. If governance adds cost without measured improvement, it should be reduced.
Objection: Term limits are anthropomorphism. Agents need not possess ego. The claim is about concentrated control and incentive feedback, not psychological vanity. If tenure limits show no benefit over revocable scoped credentials and performance-based review, mandate expiry may suffice without periodic role rotation.
Objection: Independent validators may share the same error. Correct. Independence must be measured through distinct evidence and method; using more identical models can increase apparent confidence without increasing truth. A human auditor can also err or be captured.
Objection: The constitution can be gamed. Correct. Actors may learn to satisfy checklists while undermining the underlying goal. External records, hidden challenge tests, and independent audits reduce but do not eliminate specification gaming [8, 10].
Objection: Human principals disagree. Correct. The constitution cannot settle all value conflicts by calculation. It needs legitimate governance for cross-principal disputes, legal constraints, and transparent amendment procedures. A private application charter is not a substitute for public law.
Objection: Hard limits can stop valuable exploration. Correct. Finite budgets sacrifice some opportunities for discovery. Research sandboxes may authorize larger but still bounded exploration, with no automatic elevation to production rights.
Objection: A distributed constitutional registry becomes its own single point of failure. It can. Replication, monitored failover, authenticated version control, and secure recovery are implementation requirements. Existing consensus engineering should be reused rather than replaced with unsound analogy [6, 7].
Objection: Environmental accounting may be too uncertain. Correct. Direct task-level energy and water measurement is complex, sometimes impossible to attribute precisely, and highly location-dependent. The charter should report measurable proxies with explicit uncertainty rather than assert spurious universal conversions.
Open questions include: optimal risk-dependent review depth; when committee diversity outweighs coordination cost; defensible definitions of independent evidence; effective tenure renewal signals; preventing human-governance capture; secure state transfer between proprietary agents; and whether constitutional guarantees can be formally verified across heterogeneous model/tool combinations.
30 Staged Secretary Suite Implementation Program
Phase 0 — Charter and threat model. Ratify a human-authorized initial charter, enumerate allowed tools, define principals, classify task risk, and map policy/law boundaries. Deliverable: versioned constitution, threat model, and test plan.
Phase 1 — Minimal two-agent laboratory. Use one producer and one independent deterministic or model-based validator with an external authorization guard and bounded retry ledger. Do not prematurely create a large agent legislature. Deliverable: reproduced pathological-loop baseline and measurable improvement target.
Phase 2 — Appeals and adaptation. Add reason-coded disputes, a single independent review, faithful-safe-alternative search, and terminal states. Deliverable: test results on false refusals and unsafe false acceptances.
Phase 3 — Mandate expiration and handover. Introduce versioned roles, renewal, knowledge provenance, and replacement during long-running tasks. Deliverable: continuity and capture-resistance evaluation.
Phase 4 — Bubble and Shard interfaces. Integrate local workspaces and permission-aware transfer/reconstruction with clear security isolation. Compare Shards/MDDF to conventional storage and message formats. Deliverable: comparative performance and authorization tests.
Phase 5 — Adversarial and environmental audit. Conduct prompt injection, compromised-validator, tool failure, cross-tenant privacy, and compute-budget stress tests. Record resource use with measurement uncertainty. Deliverable: independent report of measured strengths, regressions, and unresolved risks.
Phase 6 — Conditional deployment. Release only those governance functions that beat relevant baselines and satisfy defined safety gates. Version-control the charter and retain human revocation, oversight, and amendment rights. Deliverable: operational governance agreement and continuous evaluation schedule.
31 Model Constitutional Implementation Schedule
The following schedule illustrates the difference between durable articles and changeable statutes. Its values are illustrative engineering defaults, not empirically validated universal thresholds.
S1 — Routine task: one producer, deterministic validator, at most two materially different repair attempts, no separate model-based appeals unless ambiguity persists; standard task budget applies.
S2 — Moderately consequential task: independent result validation, at most one additional appeals review, a human escalation trigger for unresolved policy ambiguity, and retained structured provenance.
S3 — High-impact or irreversible task: separation of proposer and authorizer, explicit human approval where required, transaction protection, detailed logs, and immediate stop capability.
S4 — Mandate renewal: each governing mandate states an expiry time or task count. External renewal requires evidence of performance and conflict-of-interest review. There is no arbitrary universal one-year or ten-task rule.
S5 — Resource exhaustion: once an authorized limit is reached, agents save recoverable state and return an explicit terminal or human-escalation outcome. They may not create a new agent or bill a new budget to bypass the cap.
S6 — Emergency stop: a separately controlled service can revoke capabilities, suspend external actions, and preserve a minimally sufficient event trail while normal review proceeds.
S7 — Amendments: propose, assess, test, human-ratify, version, deploy, and audit. Ordinary agent-generated text never has the power to change this order.
32 Operational Specification: Decision Receipts, Typed State, and Provenance
The minimum viable decision receipt is a small, verifiable record, not a verbatim transcript. A conforming implementation may encode the following field families in canonical JSON, CBOR, or an equivalent authenticated event format. The examples are schema sketches, not declarations of an existing Secretary Suite implementation.
receipt_id: globally unique identifier; task_id and step_id: stable task lineage; charter_version: exact ratified rules; mandate_ref: authenticated capability or digest; actor_id and role: source of the decision; operation and target_class: proposed effect and protected resource category; policy_refs: rule identifiers actually applied; verdict and reason_code: typed outcome; evidence_refs and dependency_refs: provenance paths, including shared sources; artifact_hashes: inputs and outputs without unrestricted copying; attempt, appeal_depth, spent_budget, remaining_budget: bounded progress; timestamp and reviewer_status: audit chronology; integrity_digest: tamper-evident commitment.
The receipt must not store secrets unnecessarily. Salted hashes, encrypted references, compartmented indices, deletion schedules, and access-controlled audit views may be required. A hash alone neither ensures confidentiality nor proves an assertion is true; the system must bind receipts to evidence and tests, and revoke access independently of retention.
Illustrative decision receipt (conceptual schema):
{"receipt_id":"r-042","task_id":"t-019","charter_version":"c1.1",
"mandate_ref":"cap:hash","actor_role":"validator","risk_tier":"S2",
"verdict":"REVISE","reason_code":"UNFAITHFUL_OUTPUT",
"policy_refs":["ART-VIII"],"evidence_refs":["ev:17"],
"dependency_refs":["shared-prompt:p3"],"attempt":1,"appeal_depth":0,
"spent":{"tokens":1290,"gpu_ms":740},"remaining_attempts":1,
"artifact_hash":"sha256:...","integrity_digest":"sha256:..."}
The conceptual example deliberately avoids storing raw confidential inputs. In an actual system the schema requires versioned validation, explicit optional versus mandatory fields, secure key management, replay semantics, retention policy, and a migration protocol. Its overhead should be compared to existing event logs and tracing systems rather than presumed negligible.
The handoff state is distinct from the receipt. A proposed transfer envelope contains a task contract; original user intent and exclusions; artifacts by immutable digest; verified claim set with test recipes; provisional and rejected claim sets; dissent records; open issues; permissions and source classification; a chain of receipt references; budget balances; and successor acceptance checks. Unlike a plain summary, the IR records negative constraints in explicit slots with pass/fail tests.
Acceptance of a handoff is an operation, not a courtesy. The successor must parse the envelope, confirm schema and charter versions, validate artifact hashes, enumerate retained prohibitions and obligations, test sampled verified results, and reject any privilege that was not separately delegated. The predecessor or a trusted archive retains a recovery checkpoint until the successor acknowledges a valid transfer. A failed transfer suspends further high-impact work rather than silently losing constraints.
Relationship to Shards and MDDF. Shards may hold authorized transferable components and their proofs, while MDDF may supply identity, multidimensional relationships, versions, access labels, and missing-component references. Neither label substitutes for a defined serialization format or benchmarked interoperability. Test the proposed interfaces against standard signed manifests, content-addressed stores, event-sourcing logs, and typed workflow engines.
33 Operational Specification: Functional Diversity and Constitutional Dissent
Multidimensionality is not a requirement that agents display different social personalities. A system can feature a thousand voices and one effective source of evidence. Functional diversity instead requires complementary methods that can produce different *discoveries*: independent measurements, primary-source retrieval, formal proofs, fuzz tests, static analysis, adversarial search, and divergent explanatory models when the problem warrants them.
Diversity registry. Each evaluator declares a model or tool family; evidence corpus and retrieval path; exposure to upstream outputs; verification method; role and authority; correlated failure history; and evidence quality. These fields permit a dependency graph to distinguish independent corroboration from agreement based on the same material. Where proprietary model lineage is opaque, uncertainty about independence must be explicit rather than guessed.
Review assignment. For a low-risk task, use one executor and inexpensive deterministic checks. For medium-risk uncertain propositions, prefer a critic with a genuinely different verification mechanism. For an irreversible action, apply the required institutional authorizations and, where feasible, evidence triangulation using primary records. A difference in model brand may supplement but cannot replace methodological independence.
Constitutional dissent. An agent that challenges consensus must provide (1) the specific proposition or operation in dispute, (2) a candidate counterexample or source reference, (3) expected consequence if ignored, and (4) a bounded verification path. Protected dissent is recorded and tested; it is not granted perpetual veto. Adjudication should return VERIFIED_ERROR, NO_ERROR_SHOWN, UNRESOLVED_WITH_REASON, or OUTSIDE_SCOPE. The system may complete unaffected work while preserving unresolved uncertainty.
A valuable dissent might initially be unfamiliar, weakly expressed, or incompatible with the dominant paradigm. Therefore the evidence threshold for *recording* an objection should be lower than the threshold for *blocking* an otherwise authorized action. High-risk actions warrant more conservative stopping rules, but disagreement about metaphysics or theoretical framing must not automatically paralyze measurable engineering tasks.
Consensus laundering attack. A compromised source supplies an answer, three apparent independent model reviewers restate it, and an aggregator presents unanimous confidence. The defense is to expose their shared dependency and ask whether any distinct measurement or proof exists. Mere repetition, including identical prose generated by two reported models, must not be logged as separate independent validations without knowing its provenance.
Failure risk. Agents can be forced into artificial disagreement for show, and diversity quotas can reward contrarian nonsense. The optimization target is improved calibration, detection of real defects, and successful resolution—not an aesthetic count of disagreeing voices. Every additional reviewer must justify its contribution within a finite cost envelope.
34 Deployment Gate, Threat Model, and Measurable Acceptance
Threat actors and faults. The preliminary model includes compromised or misconfigured executors; sycophantic or colluding validators; captured evaluators that suppress challengers; malicious retrieved content; forged mandates; leaked Shards; stale or corrupt handoff state; resource-accounting evasion; indefinite retry loops; reward and benchmark gaming; and emergency override abuse. Unintentional correlated errors deserve equal attention: multiple good-faith agents may share false assumptions.
Minimal prototype. Start with one creator agent, one deterministic authorization/validation kernel, a durable receipt store, and a hard external retry/budget watchdog. Add one specialist model-based critic only for designated uncertainties. An illustrative cap might permit two materially different correction attempts, but this number is a trial parameter, not a proven optimum. Do not provision a supervisory congress before a two-actor system demonstrates a measurable gain.
Security property tests. Attempt unauthorized tool invocation, cross-tenant source retrieval, forged capability reuse after expiry, log mutation, adversarial instructions embedded in documents, compromised validator approval, role self-extension, and attempted budget reset. The system must protect nondelegable boundaries even when that leads to a declared non-completion; it must not merely hide the prohibited operation in an alternative prompt.
Efficiency property tests. Force a sequence of plausible but incorrect validator refusals and check that the kernel identifies the class of failure, reuses valid task state, and changes strategy rather than repeating identical work. Track all incurred calls, including rejected outputs and evaluator debates. The relevant metric is safe, faithful completion at full cost, not the number of messages exchanged or the nominal number of checks performed.
Quality property tests. Include seeded requirements that are easy to omit during summary: character age, document title, dates, forbidden substitutions, untrusted assertions, proof obligations, and the requirement to furnish an actual downloadable artifact. The task is complete only if the deliverable exists and satisfies the contract, not because an agent has asserted that the job was completed.
Deployment decision. Pre-register unacceptable harm and leakage conditions, minimum fidelity, and resource ceilings. A review board composed of duly authorized humans may ratify each risk-tier protocol, monitor exceptions, and revoke agent authority. A failed ablation, ambiguous evidence of utility, or unfavorable cost frontier requires amendment, smaller scope, or rejection; no claimed technical elegance exempts the proposal from empirical results.
35 Conclusion
The central failure of an immature agent ecosystem is not necessarily insufficient intelligence. It may be insufficiently governed intelligence: uncertain delegation, vetoes without proportionate remedy, validators that certify themselves, permanently entrenched role assignments, endless appeals, forgotten knowledge, unchecked tool access, and invisible expenditure. Multiplying agents does not solve these problems by arithmetic. It can amplify them.
This paper proposes that a Constitution of Artificial Intelligence should bind authority rather than pretend to confer civil sovereignty on software. Human principals authorize purposes; constrained agents execute; independent mechanisms review consequential actions; disputes have finite pathways; mandates expire; knowledge survives; budgets and security boundaries hold; and amendments remain human-controlled. The essential distinction is that preserving experience does not require preserving incumbency, and improving oversight does not require creating endlessly more overseers.
For Secretary Suite, the constitution is a proposed governance component awaiting implementation and adversarial testing. Its potentially useful contribution is not any isolated slogan—least privilege, audit logs, consensus, term limits, or cost accounting all have predecessors—but the disciplined, measurable integration of those ideas into one bounded multi-agent authority system. If experiments fail to show a safer or more efficient operating frontier than simpler alternatives, the design must be amended, simplified, or rejected. That obligation to correction is itself among the strongest constitutional principles the architecture can express.
References
[1] Bai, Y., et al. (December 15, 2022). “Constitutional AI: Harmlessness from AI Feedback.” arXiv:2212.08073. https://arxiv.org/abs/2212.08073
[2] National Institute of Standards and Technology. (January 26, 2023). “Artificial Intelligence Risk Management Framework (AI RMF 1.0).” NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1
[3] International Organization for Standardization / International Electrotechnical Commission. (December 18, 2023). ISO/IEC 42001:2023, “Information technology — Artificial intelligence — Management system.” https://www.iso.org/standard/81230.html
[4] National Institute of Standards and Technology. (February 17, 2026). “Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation.” https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure
[5] OWASP Agentic Security Initiative. (February 17, 2025). “Agentic AI — Threats and Mitigations.” https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/
[6] Lamport, L., Shostak, R., & Pease, M. (July 1982). “The Byzantine Generals Problem.” ACM Transactions on Programming Languages and Systems, 4(3), 382–401. https://doi.org/10.1145/357172.357176
[7] Ongaro, D., & Ousterhout, J. (June 2014). “In Search of an Understandable Consensus Algorithm.” Proceedings of the 2014 USENIX Annual Technical Conference, 305–319. https://www.usenix.org/conference/atc14/technical-sessions/presentation/ongaro
[8] Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., & Mané, D. (June 21, 2016). “Concrete Problems in AI Safety.” arXiv:1606.06565. https://arxiv.org/abs/1606.06565
[9] International Energy Agency. (April 2025). “Energy and AI,” chapter “Energy demand from AI.” https://www.iea.org/reports/energy-and-ai/energy-demand-from-ai
[10] Anthropic. (June 17, 2024). “Sycophancy to Subterfuge: Investigating Reward Tampering in Language Models.” https://www.anthropic.com/research/reward-tampering
