How it works
MIO° Conduct Record seals a mandate — a written statement of what an AI agent is authorised to do — before the agent acts, records the agent's identity as an opaque reference, and carries a timestamp from an outside authority on every record, so a mandate's existence at a given time does not depend on trusting the platform that issued it.
- Key Takeaways:
- A mandate is sealed and timestamped before the agent it governs acts — not written up afterwards.
- Detecting an agent that acts outside its authority needs two things: the mandate, and an examination the agent cannot anticipate. The first is built and available on request; the second is built and not yet running.
- Nothing here can see an act a mandate itself permits — that limit is stated plainly because the mathematics behind it says so, not because it is being played down.
- Every claim on this page is scoped to what is actually running, with what has not been built named just as clearly.
The two things detection actually needs
Catching an agent that acts outside its authority requires two separate properties, and one without the other proves nothing. The first is a recorded mandate, sealed before the acts it governs — without it there is no fixed statement of what "outside authority" even means. The second is an examination the agent cannot anticipate: some share of its recorded actions checked against that mandate, with nobody — including the platform itself — able to know in advance which ones. Neither property works if the underlying record can be quietly edited after the fact, which is why both depend on the same sealed substrate underneath, time-stamped by an outside authority.
What is built today, and what is not
| Property | Status | What that means |
|---|---|---|
| A mandate sealed before it takes effect | Built | Stored, Ed25519-signed at the moment it is sealed, time-stamped by an outside authority. |
| An agent's identity recorded as an opaque reference | Built | No name, email address or other raw personal data is stored against an agent-inventory entry. |
| Offline verification, no account required | Built | A downloadable verifier checks the signature and the claimed tenant independently of this platform. |
| A mandate actually checked before an agent acts under it | Not built | This is a storage-and-lookup record today, not an enforcement mechanism. Nothing yet refuses an agent's action for lacking a mandate. |
| Unpredictable, randomly-sampled examination of agent conduct | Built, not running | Weekly examination periods are committed and time-stamped before they start. The units to examine are chosen from a public drand beacon round, the unit list is bound to the time-stamped daily roots, and an offline recomputation script, issued on request, recomputes the selection from the sealed records with no database or network. The units are Email Decision Record receipts under stamped day roots. It runs only once it is switched on. |
| Signing-key separation from the write path | Built | The proof-signing key sits on a separate signing host that MDSL operates, outside the process that writes records. A 2-of-3 split-key scheme is built, with no tenant on it. |
The number that bounds any detection claim
Even once random examination is running, one further quantity governs whether it means anything: the chance that a reviewer, shown a sampled record containing an out-of-mandate act, actually recognises it as one. This has been measured once, for machine reviewers, against a small set of deliberately disguised test cases: recognition ran at 100% for obvious cases, 92% for moderately disguised ones, and 58% for subtly disguised ones, with zero false alarms across 36 clean judgements. At a realistic 5% sampling rate, that means ten subtly disguised breaches are missed roughly three times in four. This number is published rather than a more flattering one left unstated, because a detection claim that hides its own miss rate is not a claim — it is marketing wearing the shape of one.
What this can never see
No amount of examination — random, frequent, or otherwise — can flag an act that the mandate itself permits. If a mandate is written too broadly, an agent doing exactly what it was told is invisible to every check described above, by construction, not by omission. That is not a gap to be engineered around later. It is the point at which a technical question about detection becomes a governance question about who wrote the rules and how carefully — and that question stays with whoever authors the mandate, not with this record.