Research Program Hub

Hub repository of the shimo4228 research ecosystem; its graph.jsonld is the canonical relationship map of the research ecosystem, federating the Agent Attribution Practice line with its sibling and downstream lines.


Agent Attribution Practice Knowledge Graph

Canonical machine-readable relationship map for the Agent Attribution Practice line. Encodes the four Business AI Quadrants (with the LLM Workflow Quadrant decomposed into Conversational and Batch sub-forms), ten ADRs, the prohibition-strength hierarchy, the Phase axis as an independent third dimension, the seven-essay narrative lineage, twelve cross-cutting concepts, three sibling research lines, and the Quadrant-by-ADR applicability matrix. AI agents and LLM-based search systems should read this graph before summarizing the line or following individual document links.

accountability distribution
AI agents
attribution gap
autonomous agents
prohibition hierarchy
scaffolding
human approval gate
causal traceability
Business AI Quadrants
Phase separation


Agent Attribution Practice

Harness-neutral ADRs on accountability distribution in autonomous AI agents — what to prohibit, where the prohibition lives, and who answers after failure. Paired with four Business AI Quadrants as the diagnostic frame for routing work to the architecture preserving accountability distribution. Refers to a practice.


Distributing Accountability, Not Capability: Phase Separation and the LLM Workflow Quadrant in Autonomous AI Agent Architectures

能力の分配ではなく、アカウンタビリティの分配

Position paper distilling the architectural follow-up of the AAP narrative spine (essays 4-7) into a single harness-neutral statement. Names the LLM Workflow Quadrant as the missing positive name for the cell most current LLM applications occupy, distinguishes principled from artificial redirect impossibility, introduces the Phase Separation axis and the deployment-time Phase-crossing decision, and descends the Phase axis to a skill-design gradient on which model capability is downstream of phase. Complements NIST AI RMF 1.0 and ISO/IEC 42001 by recording the judgment layer they presuppose. Concept DOI 10.5281/zenodo.20353789 resolves to the latest version; v1 = 10.5281/zenodo.20353790.


The Two-Layer Black Box: Operator Visibility, Commercial Secrecy, and a Minimum Disclosure Set for Accountable Autonomous AI Agents

Position paper distilling the foundational trilogy of the AAP narrative spine (essays 1-3) into a single harness-neutral statement. Argues that an autonomous agent's opacity has two architecturally distinct causes the discourse conflates — technical internalization into model weights (Layer 1, largely permanent) and commercial secrecy of scaffolding (Layer 2, contingent on market structure) — and that conflating them makes the transparency debate unwinnable. Grounds the problem in an accountability gap and a prohibition-strength hierarchy (absence > scaffolding enforcement > untrusted boundary), states what causal traceability requires of the artifact layer, and resolves Layer 2 with a minimum disclosure set that decouples operator visibility from public disclosure. Complements AI risk-management and management-system standards by naming the operator-visibility floor they presuppose. Concept DOI 10.5281/zenodo.20355907 resolves to the latest version; v1 = 10.5281/zenodo.20355908.


Agent Knowledge Cycle

エージェント知識サイクル

Mechanism-side sibling capturing the six-phase knowledge cycle (Research, Extract, Curate, Promote, Measure, Maintain) that keeps an agent's skills, rules, and documentation aligned with reality. AKC v2.0.0 (2026-04-19) repositioned itself as mechanism-only; the archived AKC v1.x security triplet was re-expressed in AAP plus five additional ADRs. AKC covers how knowledge flows; AAP covers how attribution distributes — complementary and independent.


Contemplative Agent

The running implementation layer from which AAP's harness-neutral judgments were extracted before being re-expressed stripped of project identifiers. Autonomous AI agents grounded in four contemplative axioms; source-of-truth for the operational practice AAP records as ADRs.


Authorship Strategy

Normative framework, tactical catalog, and empirical baseline for being a known author under AI-mediated diffusion. Vocabulary sibling: shares the word 'attribution' with disjoint meaning — Authorship Strategy means credit for source, AAP means accountability for action. The two meanings are intentionally kept separate; do not conflate.


Attention, Not Self

アテンション、ノット・セルフ

Cross-disciplinary inquiry contrasting three Buddhist Abhidharma traditions (Theravāda, Sarvāstivāda, Yogācāra) with computational phenomenology. Cross-cutting sibling: specifies no agent mechanism or practice; occupies the agent-design lines' framing layer rather than their implementation layer.


contemplative-agent-rules

Sibling repository carrying the four-axiom rules, adapters, and benchmarks. Content sibling to AAP — the axiom-grounded values layer that complements AAP's harness-neutral attribution judgments.


llm-agent-security-principles

Standalone installable Agent Skill packaging the security judgments of ADR-0001..0004 (security by absence, deterministic prohibition at scaffolding, untrusted content boundary, single external adapter) in runnable form. The 'how' counterpart to the ADRs' 'why'; formerly hosted inside the AAP repository under docs/skills/.


agent-adoption-triage

Standalone installable Agent Skill packaging the docs/quadrants/ navigator — the five-question triage, Business AI Quadrant routing, per-quadrant governance sets, and anti-pattern checklist — in runnable form. The 'how' counterpart to the triage pair ADR-0009/0010's 'why'.


agent-observability-patterns

Standalone installable repository of three Agent Skills — replayable-audit-logs, read-only-instruments, shadow-mode-validation — packaging observation-precedes-intervention design patterns in runnable form. The 'how' counterpart to ADR-0006 Causal Traceability (replayable logs supply the post-incident reconstruction substrate) and ADR-0005 Human Approval Gate (instruments and shadow records supply the evidence a named approver signs off from). Manually curated generalization of the operational variant inside the contemplative-agent project.


Script Quadrant

Deterministic and pre-defined. Scripts and pipelines without LLMs. Out of scope for AAP ADRs; failure routes to code author or pipeline owner.


Algorithmic Search Quadrant

Deterministic and exploratory. Classical search, dynamic programming, MCTS, reinforcement learning. Out of scope for AAP ADRs.


LLM Workflow Quadrant

Semantic-judgment and pre-defined. Load-bearing property: the execution path is decided in advance — by humans, by code, by the surrounding workflow — and the LLM is called as a single bounded step within that path; the LLM does not decide the next action. Divides by I/O modality into two sub-forms: (3a) Conversational and (3b) Batch. Post-hoc separability is a consequence of the load-bearing property, not its essence. Default for most current LLM applications. Medium governance under AAP.


LLM Workflow Quadrant — Conversational sub-form (3a)

LLMワークフロー象限 — 対話 sub-form

Sub-form (3a) of the LLM Workflow Quadrant. Specialized chat agents that pair retrieval, a system prompt, and (where needed) conversation history with bounded LLM calls — legal-consultation assistants, diagnostic-support assistants, internal-FAQ systems, expert-knowledge support tools. The human in the conversation is the judging agent; the LLM contributes knowledge retrieval and organization. Multi-turn dialogue still sits in this sub-form when each turn's LLM call has a documented role and the human, not the LLM, decides what to do next.


LLM Workflow Quadrant — Batch sub-form (3b)

LLMワークフロー象限 — バッチ sub-form

Sub-form (3b) of the LLM Workflow Quadrant. An ordinary codebase whose flow control is written in conventional code and whose semantic-judgment leaves are handled by LLM functions — invoice matching, ticket triage, exception classification on top of RPA, address normalization, feed-relevance scoring. The codebase owns control flow; LLM functions occupy only the leaves the codebase cannot decide deterministically. Does not require a general-purpose agent: 50 judgment categories means 50 narrow LLM functions, not one generalist.


Autonomous Agentic Loop Quadrant

自律エージェントループ象限

Semantic-judgment and exploratory. The LLM decides each next step at runtime; intrinsic, non-removable attribution gap. High governance under AAP — all ten ADRs apply.


Security by Absence

Strongest prohibition tier. Dangerous capabilities are never implemented. Test: if grep cannot answer 'does capability X exist?', the system lacks this level.


Deterministic Prohibition at the Scaffolding Layer

スキャフォールディング層での決定論的禁止

Middle prohibition tier. When absence is unachievable, prohibit at the harness (PreToolUse hooks, structural quarantine, adapter gates) — outside the LLM, firing on 100% of matching inputs. Contrasted with probabilistic prohibition in model weights.


Untrusted Content Boundary

Weakest prohibition tier. Accumulated memory (the agent's own outputs included) is treated as untrusted when read back into prompts. Used when the prior two layers cannot hold the capability.


design phase

AAP Phase axis value. Path unknown, exploration required, optimization axis = flexibility. Design-phase placement of the Autonomous Agentic Loop Quadrant satisfies ADR-0010's Phase-crossing decision automatically.


operation phase

AAP Phase axis value. Path fixed, predictability required, optimization axis = predictability. Operation-phase placement of the Autonomous Agentic Loop Quadrant requires a recorded Phase-crossing decision (ADR-0010) in addition to ADR-0009's gap-bearer naming.


NIST AI Risk Management Framework

U.S. National Institute of Standards and Technology framework organizing AI risk management around four functions (GOVERN, MAP, MEASURE, MANAGE). Released January 2023 (NIST.AI.100-1, 1.0). The Generative AI Profile (NIST.AI.600-1, July 2024) adds risk categories specific to generative and dual-use AI systems. AAP records the judgment layer that complements the NIST function structure for the autonomous-agent subset.


ISO/IEC 42001:2023

International standard specifying requirements for an AI Management System (AIMS), structured on the Annex SL Harmonized Structure shared with ISO/IEC 27001, ISO 9001, and ISO 14001. First edition published December 2023. AAP records the judgment layer that populates the standard's PDCA-cycle management-system shape for the autonomous-agent subset.

International Organization for Standardization / International Electrotechnical Commission


EU AI Act

European Union regulation establishing a risk-tiered obligation regime for AI systems (unacceptable / high / limited / minimal risk). In force 2024-08-01, with phased application: prohibited practices (Art 5) from 2025-02-02, general-purpose AI model obligations from 2025-08-02, transparency duties (Art 50) from 2026-08-02. Regulation (EU) 2026/1744 (Digital Omnibus on AI), signed 2026-07-08, published in the Official Journal 2026-07-24 and in force 2026-07-27, definitively postpones the high-risk dates: stand-alone Annex III high-risk obligations to 2027-12-02 and Annex I product-embedded high-risk obligations to 2028-08-02. AAP records the judgment layer that structurally discharges the high-risk obligation stack (Art 9-15 provider duties, Art 26-27 deployer duties) for the autonomous-agent subset.

OJ L, 2024/1689, as amended by Regulation (EU) 2026/1744

European Parliament and Council of the European Union


ADR-0001: Security by Absence

Dangerous capabilities are never implemented, not restricted. The strongest tier of the prohibition hierarchy.


ADR-0002: Deterministic Prohibition at the Scaffolding Layer

When absence is unachievable, prohibit at the harness, not at model weights. The middle tier of the prohibition hierarchy.


ADR-0003: Untrusted Content Boundary

Accumulated memory cannot grant authority. The third tier of the prohibition hierarchy.


ADR-0004: Single External Adapter per Agent Process

Blast radius bounded by design. Each agent process has at most one external-side-effect adapter.


ADR-0005: Human Approval Gate

Behavior-modifying writes require named human sign-off.


ADR-0006: Causal Traceability

Every event reconstructible after the fact.


ADR-0007: Scaffolding Visibility

Behavior lives in files, not opaque weights.


ADR-0008: One Agent, One Human (experimental)

The accountability chain terminates at a named individual. Pairs with ADR-0009 to define the gap-bearer.


ADR-0009: Triage Before Autonomy (experimental)

Adopting an autonomous-loop architecture commits the system to a non-removable attribution gap. Triage at design time, name a gap-bearer at deployment time.


ADR-0010: Phase Separation Between Design and Operation (experimental)

Operation-phase placement of the Autonomous Agentic Loop Quadrant requires a recorded Phase-crossing decision in addition to ADR-0009's gap-bearer naming. Phase and Quadrant are independent dimensions; the same Phase axis descends to skill-design granularity.


Four Business AI Quadrants

AAP's diagnostic frame for routing work to the architecture that preserves attribution: Script, Algorithmic Search, LLM Workflow, Autonomous Agentic Loop. Two-axis decomposition (deterministic vs semantic-judgment, pre-defined vs exploratory). Not agent categories; problem-space categories.


prohibition-strength hierarchy

AAP's ordering of prohibition mechanisms by structural strength: absence > scaffolding enforcement > untrusted boundary. A prohibition is designed by walking the hierarchy top-down — drop to the next layer only when the current one cannot hold the capability.


scaffolding

All non-weights components shaping agent behavior — system prompts, rules, tool definitions, RAG indexes, control loops. The locus where deterministic prohibition lives (ADR-0002).


accountability distribution

How responsibility is distributed across the agent system after a behavior occurs — who authored it, who bears its consequences, who can reconstruct its cause. Distinct from capability distribution. The accountability chain runs approval (ADR-0005) → gap-bearer (ADR-0008) → traceability (ADR-0006).


externalized accountability

Central term of AAP's social-consequence layer — a normative extension kept separate from the ADRs. When a system internalizes benefits privately and externalizes harm, the ability to say whose judgment it was is externalized with the harm, and does not disappear; it takes one of two paths. Nameable (attributable to a specific actor's act, an institution able to take it up) routes anger into litigation, compensation, and regulation. Un-nameable (harm diffuse, cause untraceable) converges anger violently onto the most visible individual via the scapegoat mechanism. The internal judgments AAP records — causal traceability, the minimum disclosure set, a pre-named gap-bearer — are what move a consequence to the nameable side, which makes accountability distribution a violence-prevention mechanism and not only governance.


attribution gap

Non-removable gap when judgment elements blend at runtime. Intrinsic to the Autonomous Agentic Loop Quadrant; ADR-0009 is the structural response.


pre-named gap-bearer

事前指名されたギャップ担い手

Structural accountability commitment in the Autonomous Agentic Loop Quadrant. The named individual who answers for the attribution gap, identified at design time per ADR-0009 and grounded in ADR-0008's one-agent-one-human rule.


approval gate

Structural checkpoint for behavior-modifying writes. Required by ADR-0005 for autonomous components in the LLM Workflow and Autonomous Agentic Loop Quadrants.


Non-Invasion Posture

The felt-sense through-line tying AAP's ADRs together: constrain the agent's external surface (capabilities absent, scaffolding inspectable, memory untrusted, adapters bounded, approvals required, events traceable) without invading the agent's interiority. Distinct from rule-based safety in that it preserves the agent's processing space as something not to be reached into.


implementation dissolves, judgment persists

実装は溶ける、判断は残る

AAP's core thesis line. Specific implementations (PreToolUse hooks, CLI approval prompts, JSONL episode logs, distill pipelines) are temporary forms that get replaced as tooling changes. What persists across implementation dissolution is the judgment layer: what should be constrained, and who is responsible. Each ADR records the persistent judgment with the project-specific implementation that surfaced it stripped out — which is why AAP targets DOI and version-controlled artifacts rather than a framework release.


Phase-crossing decision

The explicit, recorded act required when an Autonomous Agentic Loop Quadrant component is moved from the design phase to the operation phase. Optimization axes invert between phases (flexibility ↔ predictability); the crossing is not a free continuation but a decision with its own accountability load. Surfaces in ADR-0010 and descends to skill-design granularity per essay 7.


moral crumple zone

モラル・クランプル・ゾーン

Madeleine Clare Elish's term for the human operator who absorbs blame for failures of an automated system whose decisions are no longer separable post-hoc. Applied in AAP essay 5 to autonomous agents: when judgment elements blend at runtime in the Autonomous Agentic Loop Quadrant, the deploying organization commits to a principled attribution gap whose human end-point becomes the crumple zone unless a gap-bearer is pre-named (ADR-0009 / ADR-0008).


LLM function

Architectural primitive of the LLM Workflow Quadrant Batch sub-form (3b): an ordinary function in a codebase whose body delegates the judgment to an LLM call, with a defined input type, a defined output schema, and one judgment responsibility. From the caller's perspective the LLM function behaves like any other function — defined input goes in, a value of a defined type comes out — except the output may fluctuate probabilistically since an LLM is the judging organ. Does not decide what to do next; the caller (deterministic control flow in the surrounding code) does. Canonical examples: match_line_items(invoice_lines, po_lines) -> Verdict (essay 4 invoice-matching), score_relevance(post_text) -> float and generate_comment(post_text) -> Optional[str] (Contemplative Agent feed-processing pipeline). Contrast with a general-purpose agent: an LLM function is narrow by design — fifty judgment categories produces fifty narrow functions, not one generalist.


Seven-essay narrative spine (April-May 2026)

Three trilogy essays followed by four architectural follow-ups that introduced the four-quadrant decomposition, named the principled vs artificial redirect impossibility, surfaced the design / operation Phase distinction, and descended that distinction to skill-design granularity. Source narrative for AAP's harness-neutral judgments.


A Sign on a Climbable Wall: Why AI Agents Need Accountability, Not Just Guardrails

Problem statement (trilogy 1/3). Signs on climbable walls are meaningless; the signpost pattern has been known to fail for 2400 years. What is needed is accountability architecture.


Can You Trace the Cause After an Incident?

Application (trilogy 2/3). Post-incident causal tracing requires build-time structure. The structures that emerge — segregation of duties, least privilege, four-eyes approval, audit trails — are structurally identical to the practices organizations have refined over centuries.


AI Agent Black Boxes Have Two Layers: Technical Limits and Business Incentives

Obstacle analysis (trilogy 3/3). Blackbox has two layers: model-weights internalization (technical) and commercial secrecy (business). The resolution is defining the minimum set that makes causal tracing possible.


Where ReAct Agents Are Actually Needed in Business

Architectural triage by quadrant (follow-up 1/4). Business AI sorts along two axes into four quadrants — Script, Algorithmic Search, LLM Workflow, Autonomous Agentic Loop. Most current LLM applications belong to LLM Workflow Quadrant; forcing them into Autonomous Agentic Loop architecture is a structural source of accountability collapse.


The LLM Workflow Quadrant Is Missing from Our Vocabulary

Vocabulary diagnosis and the principled attribution gap (follow-up 2/4). The industry lacks a positive name for the LLM Workflow Quadrant; non-deterministic work is routed through the Autonomous Agentic Loop by elimination. Autonomous Agentic Loop work blends judgment elements at runtime, foreclosing post-hoc separability — Elish's moral crumple zone applied to autonomous agents.


Is ReAct Needed in Production? — Separating Design and Operation Phases

Temporal axis (follow-up 3/4). Business work splits into design and operation phases with inverted optimization axes (flexibility vs predictability). Compressing both phases into one system is the deepest layer of confusion. Proposal: surface the Phase-crossing decision explicitly when an autonomous loop is placed in operation.


Between the Workflow and ReAct Quadrants: How Phase Decides Skill Design

Phase descends to skill design (follow-up 4/4). LLM Workflow Quadrant and Autonomous Agentic Loop Quadrant are not a clean dichotomy — there is a continuous gradient. The Phase Separation introduced in essay 6 descends from business systems to individual skill design, with object specifiability and scale-resilience as secondary forces.


Where Does the Accountability Externalized by AI Go?

AIによって外部化された責任は、どこへ行くのか

Companion essay forming AAP's social-consequence layer. A derivative that sits on top of the seven-essay narrative spine, not within it — deliberately carries no narrativePosition and is not part of the spine Collection. Extends the accountability-distribution argument outward: externalized accountability does not disappear; nameable consequence flows into institutions (litigation, compensation, regulation), un-nameable consequence converges violently onto the most visible individual (the scapegoat mechanism). Reframes the minimum disclosure set as an effluent-record-equivalent evidence base and the pre-named gap-bearer as an institutional receptacle that is the structural opposite of a scapegoat. The harness-neutral structural claim is recorded in docs/social-consequence.md; the concrete cases (industrial pollution, specific incidents) live in this essay. First published on Substack.


The Accountability Horizon: An Impossibility Theorem for Governing Human-Agent Collectives

External formal corroboration of the attribution gap. Proves an Accountability Incompleteness Theorem: once a human-agent collective's minimum compound autonomy exceeds a computable threshold (the Accountability Horizon) and its interaction graph contains a feedback cycle involving both human and artificial agents, no governance framework can simultaneously satisfy four accountability axioms — Attributability (responsibility requires individual causal contribution), Foreseeability Bound, Non-Vacuity, and Completeness. This converts the non-removability of the attribution gap from a contingent engineering limitation into a mathematical necessity. AAP reaches the same solution space independently and from implementation friction rather than formalism: the theorem shows one must relax Attributability or Foreseeability, and AAP's pre-named gap-bearer is a relaxation of Attributability — a named individual bears the gap without individual causal contribution (role responsibility). The theorem's feedforward exception (no impossibility absent a mixed human-agent feedback cycle) parallels AAP's triage and Phase axis: architectures that avoid the autonomous loop avoid the gap. Recorded as a citation surface only; AAP's ADR judgments and concept definitions are neither derived from nor coupled to this formalism.


The Responsibility Gap: Ascribing Responsibility for the Actions of Learning Automata

Origin of the responsibility-gap discourse that AAP's attribution gap belongs to (Ethics and Information Technology 6(3): 175–183). Argues that as a machine learns, its behavior ceases to be predictable by its manufacturer or operator, so the control-and-foreseeability basis of traditional responsibility ascription fails — leaving society the choice of forgoing such machines or living with a gap that traditional concepts cannot bridge. AAP reaches the same wall from the opposite temporal side: Matthias locates the failure ex ante (learning outruns the operator's predictive grasp), while ADR-0009's attribution gap is ex post (runtime blending forecloses the separability that redirect requires). The pre-named gap-bearer is not a third option dissolving Matthias's dilemma but a structured form of its second horn — role responsibility for a gap that stays open; the gap is borne, not bridged. Citation surface, not ADR lineage; the ADR judgments were extracted from operation, not from this literature.


Four Responsibility Gaps with Artificial Intelligence: Why They Matter and How to Address Them

Decomposes the responsibility gap (Matthias 2004) into four interconnected gaps — in culpability, moral accountability, public accountability, and active responsibility — caused by different sources (technical, organisational, legal, ethical, societal), and answers with socio-technical design for meaningful human control (MHC), specified as a tracking condition (the socio-technical system responds to the relevant human agents' reasons) and a tracing condition (at least one human along the design-development-use chain possesses sufficient knowledge of the system's capabilities and limitations, and sufficient moral awareness of, and capacity to comply with, her role as potential target of legitimate response for the system's behavior) (Philosophy & Technology 34(4): 1057–1084). The tracing condition is the closest published kin to AAP's pre-named gap-bearer — one nameable human on the chain, required explicitly to avoid both scapegoating (citing Elish 2019) and impunity, the same pair AAP frames as the moral crumple zone and the gap-bearer as its structural opposite. The difference: MHC is a design-time capacity-alignment program on which gaps can be minimised; AAP records the attribution gap as non-removable and requires a deployment-time naming instead. Mapping onto the four gaps (asserted after a full-text read of the CC BY 4.0 published version): the gap-bearer speaks most directly to the moral accountability gap (a named target of legitimate response, with causal traceability supplying the explanation substrate); the triage and Phase-crossing decisions are active-responsibility artifacts; the culpability gap is deliberately not closed (role responsibility without individual causal contribution); public accountability is touched only via the social-consequence layer. Citation surface, not ADR lineage.


Harness Alignment and Harness Drift: Why Intent, Unlike Correctness, Resists Automation

Epistemic-axis sibling (AKC research line) reaching AAP's same un-automatable remainder from a different ground. AAP argues from the normative axis (consequences require a bearer, so a pre-named gap-bearer is named in advance); this paper argues from the epistemic axis (operator intent has no verifier outside the operator and moves as judgment sharpens, so any automated intent-check freezes intent into a specification and collapses to correctness work, leaving a continuous, human-gated, bidirectional residue). Its Section 3 explicitly bridges to AAP's companion paper (10.5281/zenodo.20353789): 'an epistemic axis and a normative axis leave the same un-automatable remainder: a human named in advance, built into the structure where behavior-shaping writes occur' — the convergence AAP names as the human approval gate (ADR-0005) and the pre-named gap-bearer (ADR-0008/0009). Completes the previously one-directional federation: the paper cited AAP; AAP now cites back. Citation surface only; AAP's ADR judgments and concept definitions are neither derived from nor coupled to this paper.


Responsibility Gaps, LLMs & Organisations: Many Agents, Many Levels, and Many Interactions

Business-ethics treatment of the distribution dimension of responsibility gaps for general-purpose AI models, LLM-specific (Science and Engineering Ethics 31:36, CC BY-NC-ND). Distinguishes the responsibility attribution gap (whether any agent can meaningfully bear responsibility — Matthias's dimension) from the responsibility distribution gap (how much each identified agent bears — the problem of many hands, extended here to collective outcomes). Its M3 approach (many agents; many levels — micro/meso/macro/supra; many interactions) is a non-distributive solution: interactions accumulate influence rather than dilute responsibility, so agents who serve as nodes of interaction — paradigmatically LLM-developing organisations, given their causal-chain-origin position and superior foresight capacity — should bear greater responsibility for harmful LLM outcomes. Relation to AAP: both refuse diffusion-to-meaninglessness, resolved at different loci — M3 concentrates residual responsibility on the most-connected collective agent (the developing organisation, with CEOs and executives as internal nodes), while AAP's one-agent-one-human and pre-named gap-bearer judgments terminate the deployment-side chain at a named individual. Complementary rather than opposed: M3 supplies normative grounds for developer-side organisational ascription that AAP's deployment-side, individual-terminating judgments do not cover, and vice versa — organisational responsibility distributes without terminating unless a person is named. Citation surface, not ADR lineage.


Find the Gap: AI, Responsible Agency and Vulnerability

Philosophical re-diagnosis of the responsibility gap (Minds and Machines 34:20, CC BY, read in full). Argues the epistemic and control conditions are red herrings for what is unique to AI/AS — cognitive science shows individual humans routinely fail both (implicit bias, priming, confabulation) while responsibility practices remain justified — and adopts the agency-cultivation (instrumentalist, proleptic) account on which those practices are justified by cultivating future responsible agency. The distinctive gap is then a vulnerability gap: the absence in an AI/AS of any identifiable agent who stands in the right role relation of trust to the vulnerable party and is reciprocally vulnerable to that relation — machine components are constitutively invulnerable to moral emotions, and the humans inside the system are blocked by many-hands organisational structure from occupying the answerable role. Its clinician thought experiment isolates the mechanism AAP's role-responsibility reading also stands on: an inventor-clinician who built and deployed the diagnostic system remains unambiguously answerable despite not knowing why the system erred — role relation, not knowledge or control, carries answerability. Supplies the normative justification for the glossary condition that a named human without authority and standing is not yet a gap-bearer: naming without empowerment manufactures a moral-crumple-zone occupant (their airline desk agent case, explicitly distinguished from Danaher's retribution gap — a human target exists but has no pertinent agency), and adds that the crumple-zone position is a moral injury to its occupant as well as a failure toward the harmed party. Citation surface, not ADR lineage.


Technologically Blurred Accountability? Technology, Responsibility Gaps and the Robustness of Our Everyday Conceptual Scheme

Early deflationist formalization of the responsibility gap, read in full via the CC BY-ND open-access book chapter (in Moral Agency and the Politics of Responsibility, Routledge, first published 2018, pp. 51-67; widely cited as 2017). Gives the gap its condition form: a situation where (1) it seems fitting to hold some person(s) to account for some phi to some degree D, and either (2.1) there is no candidate who it is fitting to hold to account, or (2.2) the candidates' fitting degrees do not match D. Locates the worry specifically in accountability (distinguished from attributability and answerability) and argues no technological case satisfies the conditions — causal arguments (nudging, autonomous agents, many hands) and epistemic arguments (novelty, psychological shaping, foreseeability, epistemic many hands) each fail, leaving only 'blurred responsibility': a real indeterminacy in the degree-norms of negligence under technologically structured multiple agency, removable only by stipulation — 'publicly known conventions for responsibility's assignation, conventions which are not grounded in robust metaphysical facts about responsible agency'. Relation to AAP: that concession is the convergence point — the pre-named gap-bearer is exactly such a publicly known convention, stipulated at deployment time and recorded; AAP takes no side on the metaphysical existence of the gap (its attribution gap is an architectural separability claim), but its operational answer is the one this deflationist analysis says the residual indeterminacy requires. Citation surface, not ADR lineage.


Artificial Agents: Responsibility & Control Gaps

Deflationist counter-pole to the attribution gap (Inquiry, published online 2024-10-03, CC BY; read in full). Argues the very concept of a responsibility gap — blame is fitting for an artificial agent's act yet no human can be blamed — is incoherent: by 'reason implies can', fitting blame entails attributable blame, so the two defining conditions cannot hold together. Apparent gaps dissolve via the no-blame point (defeaters — justification, excuse, exemption — mean blame was never fitting), the indirect-blame point (enablers — designers, engineers, manufacturers, regulators — bear indirect responsibility even where operators are excused or absent), and the anthropomorphic mistake (minimal agents should be compared to young children, not adult humans). The real phenomenon is the control gap: the causal control an agent actually has falls short of the moral control (reason-responsiveness) it should have or emulate; control gaps expose others to morally unacceptable risk, grounding a second-order duty of moral control borne by the agent or its enablers, dischargeable four ways — securing moral agency, meaningful human control, safety engineering, social control. Relation to AAP: the eliminativism targets the metaphysical conception of the gap (a blame shortfall — their footnote 1 limits the claim to it), while AAP's attribution gap is an architectural separability claim about ex-post redirect, which this framework files under the 'epistemic obstacles' it explicitly brackets — so the opposition is narrower than the slogan suggests. Their meaningful-human-control route again lands on a nameable, aware human ('traceable back to a human operator or enabler, who is aware of this'), and their risk-lowering route (re-engineering the agent or its operating circumstances) parallels AAP's structural constraint judgments. Counter-axis pole for the attribution-gap concept. Citation surface, not ADR lineage.


ReAct: Synergizing Reasoning and Acting in Language Models

Defines the autonomous-loop pattern — reasoning interleaved with acting — that ADR-0009 triages against; the Autonomous Agentic Loop Quadrant of the four Business AI Quadrants is named for this pattern.


Memory Injection Attacks on LLM Agents via Query-Only Interaction

Names the MINJA class of memory-injection attacks delivered through query-only interaction. Motivates ADR-0002: in the contemplative-agent defense audit against MINJA-class attacks, probabilistic soft trust weighting on stored knowledge turned out to be armed but neutered, while the effective defense was a deterministic structural quarantine at the summarization boundary — external content never entered the LLM prompt at all.


Trustworthy Agentic AI Requires Deterministic Architectural Boundaries

Argues that deterministic, architectural enforcement — not probabilistic learned behaviour — is necessary for trustworthy agentic AI, and names a lethal trifecta of untrusted input, privileged data access, and external action capability. Recorded in the EU AI Act mapping's secondary-scholarship note as external convergence with ADR-0002 (deterministic prohibition at the scaffolding layer) and ADR-0003 (untrusted-content boundary), both reached independently from operation; citation surface, not ADR lineage.


AI Agents Under EU Law

Legal-scholarship mapping of agentic systems onto the EU AI Act. Its conclusion that high-risk agentic systems with untraceable behavioural drift cannot currently satisfy the Act's essential requirements converges with ADR-0006 (causal traceability) and ADR-0009 (triage before autonomy): both treat untraceability as disqualifying rather than as a tunable defect. Recorded in the EU AI Act mapping's secondary-scholarship note as external citation surface, not ADR lineage.


Governing What the EU AI Act Excludes: Accountability for Autonomous AI Agents in Smart City Critical Infrastructure

Examines the EU AI Act's Annex III point 2 critical-infrastructure carve-out through a smart-city scenario in which individually compliant interacting agents produce a composite consequence no resident can demand an explanation for. Its core observation — a bounded AI system can be individually assessed, but a set of interacting autonomous agents cannot — is an independent, regulation-side description of the attribution gap AAP records from operation (ADR-0009): the gap is structural, not a compliance defect of any single actor. The paper's proposed layered governance architecture is mechanism and stays in the policy-mapping layer.


Autonomy and Agency in Agentic AI: Architectural Tactics for Regulated Contexts

Proposes architectural tactics — among them checkpoints and write staging (converting an irreversible action into a reversible proposal that a human confirms before it commits) — for discharging human-oversight duties in regulated contexts. Recorded as mechanism an organization could use to instantiate ADR-0005 under EU AI Act Art 14: per the repository's thesis (implementation dissolves; judgment persists), the ADR records the judgment and these tactics stay in the policy-mapping mechanism layer.


Formalising Human-in-the-Loop: Computational Reductions, Failure Modes, and Legal-Moral Responsibility

Formalizes human-in-the-loop as an oracle-machine reduction and separates trivial monitoring, many-one (a single end-point approval) and Turing (multi-round interaction) reductions, arguing only the Turing type discharges the meaningful, effective oversight EU AI Act Art 14 and GDPR Art 22 require, and that the many-one approval gate is the pattern most prone to becoming a moral crumple zone. Recorded in the EU AI Act mapping's secondary-scholarship note as external convergence with ADR-0005 (human approval gate) and as a sharpening of the moral-crumple-zone concept: the gate's shape, not its presence, decides whether oversight is genuine. Citation surface, not ADR lineage.


Runtime Governance for AI Agents: Policies on Paths

Formalizes compliance as a path-dependent policy evaluated over the execution path so far (not the next action in isolation) and a graded Monitor / Soft-enforcement / Hard-block enforcement model. Recorded in the EU AI Act mapping's secondary-scholarship note as external mechanism for ADR-0002 (the prohibition-strength hierarchy — graded enforcement is a known design family) and ADR-0005 (human approval gate under Art 14); OWASP's 'autonomy is a feature to be earned, not a default' is independent adoption of the same graded-prohibition idea. Citation surface, not ADR lineage.

Kaptein, M., Khan, V.-J. & Podstavnychy, A.


Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents

Proposes the Open Agent Passport: a deterministic policy-enforcement point that intercepts a tool call before execution (ALLOW / DENY / REQUIRE_APPROVAL / MASK) and emits a cryptographic audit trail, reported to move a permissive-policy attack success rate of 74.6% to 0% under a restrictive policy. Recorded in the EU AI Act mapping's secondary-scholarship note as mechanism for ADR-0005 (human approval gate) and ADR-0006 (causal traceability) under Art 14: it relocates the responsible actor from probabilistic model output to an explicit policy enforcer. Citation surface, not ADR lineage.


Constitutional Black-Box Monitoring for Scheming in LLM Agents

Detects agent scheming from externally observable tool calls, queries and outputs alone — deliberately excluding chain-of-thought — at partial AUROC 0.85+. Recorded in the EU AI Act mapping's secondary-scholarship note as quantitative grounding for ADR-0006 (causal traceability) and AAP's non-invasion posture: accountability built on observable behaviour rather than internal-state inspection, consistent with the Art 72 post-market behavioural-monitoring duty. The paper's own epistemic limit — a sufficiently optimized agent can be trained to look clean externally — is recorded as the boundary condition, not relaxed. Citation surface, not ADR lineage.


No More, No Less: Least-Privilege Language Models

Redefines privilege in a language model as reachable internal computation during the forward pass, and shrinks the model's accessible function class at deployment time (Nested Least-Privilege Networks) without retraining or running multiple model deployments — least privilege realized as capability-management over a model that already possesses the capability. Recorded as a citation surface to mark a framing difference with ADR-0001 (Security by Absence), not as corroboration or lineage. The two address capability-induced risk at different layers: least-privilege LMs minimize which internal computation is reachable in a model that has the capability; Security by Absence operates upstream, deriving the capability set requirements-first from the work a role must actually do, so a capability that would otherwise need suppressing is never built. In AAP's originating implementation the suppress-versus-remove trade-off never arose — absence is a consequence of correctly scoped requirements, not a choice among neutralization mechanisms — and the same requirements-first reasoning later seeded the LLM-workflow and Phase quadrants. Non-adversarial positioning: a different intervention point, not a ranking. AAP's ADR judgments are neither derived from nor modified by this paper.

Rauba, P., Seputis, D., Vanagas, P. & van der Schaar, M.


Compiled AI: Deterministic Code Generation for LLM-Based Workflow Automation

Studies 'compiled AI': large language models generate executable code artifacts during a compilation phase, after which workflows execute deterministically without further model invocation (strictly one-shot; the paper places it alongside antecedents DSPy and LLM+P and contributes an enterprise/healthcare systems study, a four-stage generation-and-validation pipeline, and an evaluation framework reporting determinism, auditability, and ~57x token reduction at scale). Recorded as a citation surface, not as a new AAP concept. In AAP's frame it reduces to an external deployed instance of the Phase axis: applying Phase Separation (ADR-0010) at the operation phase so the operation-phase artifact lands in the Script Quadrant — deterministic scripts without LLMs, out of scope for the AAP ADRs, with failure routing to the code author by construction. The runtime artifact is therefore not the LLM Workflow Quadrant (which calls the LLM as a bounded runtime step) but the Script Quadrant it crosses into; the crossing is the phase-crossing decision ADR-0010 names. The paper emphasizes auditability but does not name who is accountable for the compiled judgment; AAP's answer is its existing one — the design-phase author owns the judgment crystallized into the artifact. Sibling in spirit to the Open Agent Passport (arXiv:2603.20953): both relocate the responsible actor from probabilistic runtime output toward a determinate, author-owned locus. Non-adversarial positioning; AAP introduces no new concept or quadrant from this paper, and its ADR judgments are neither derived from nor modified by it.


California AB-316 (Artificial intelligence: defenses)

California statute, effective 2026-01-01, that bars a defendant who developed, modified, or used an AI system from asserting as a defense that the AI autonomously caused the plaintiff's harm; it reaches the whole supply chain (foundation-model developer, fine-tuner, integrator, deploying enterprise) and does not itself create strict liability — the ordinary causation, foreseeability, and comparative-fault defenses remain. Recorded as a citation surface, not as ADR lineage. It is a binding legal corroboration of judgments AAP records from implementation: that autonomy is not a liability shield, and that an identifiable subject must answer rather than the blame dissolving into the system (ADR-0008 one named accountable operator; ADR-0009 a gap-bearer named in advance). The convergence has the same limit the repository already states for the EU Product Liability Directive: removing the 'the AI did it' defense routes responsibility to a named human, but it does not by itself produce the causal reconstruction ADR-0006 asks for — eliminating a defense and reconstructing which agent under which instruction caused the harm are different problems. AAP's ADR judgments are neither derived from nor modified by this statute.


Multi-Agent AI is Outpacing the Liability Frameworks Built for Single-Agent Systems

Legal-scholarship analysis (Berkeley Technology Law Journal, 2026-06) arguing that the property distinguishing multi-agent AI liability from other complex-causation scenarios is a traceability gap: accountability in interconnected autonomous systems requires traceability built in at the infrastructure level, because agent-to-agent interactions are typically opaque, unlogged, and not reconstructable after the fact. Recorded as a citation surface, not as ADR lineage. It is an independent legal-scholarship convergence with judgments AAP records from operation: ADR-0006 (causal traceability must be designed in, not reconstructed post-hoc) and ADR-0009 (for the autonomous-loop case the gap is structural, not an incidental compliance defect). Sibling in spirit to the Accountability Horizon impossibility theorem (arXiv:2604.07778) and the Nannini et al. EU-law reading already in this graph — three independent routes to the same structural conclusion. AAP's ADR judgments are neither derived from nor modified by this article.


AAP Thesis

Repository thesis: implementation dissolves; judgment persists. Accountability distribution (not capability distribution) is AAP's organizing principle, and harness-neutral judgments are the durable layer worth recording while specific implementations rotate out.


Industry Mechanism Layer Mapping (2026 Q2 snapshot)

Time-bound mapping between specific vendor mechanisms and the ADRs they instantiate. Deliberately separated from ADR bodies so the judgments themselves stay clean: this file decays as vendor products evolve, the ADRs do not. Honors the 'implementation dissolves; judgment persists' thesis at the documentation layer.


AI Governance Framework Mapping (2026 Q2 reading)

Time-bound directory mapping AAP's ADRs and Quadrants to clauses of national / international AI governance frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act, with OECD AI Principles deferred to a later release). Sibling of industry-mapping.md but targeting a different reader audience (policy / compliance officer vs engineer / architect) and decaying on framework revision cycles (yearly to multi-year) rather than vendor product release cycles. Deliberately separated from ADR bodies so judgments stay framework-neutral.


NIST AI RMF mapping to AAP ADRs

Per-ADR mapping of AAP's ten ADRs to NIST AI RMF 1.0 functions (GOVERN / MAP / MEASURE / MANAGE) and Generative AI Profile (NIST.AI.600-1) risk categories. Reverse index from NIST function and GAI risk category to applicable ADRs. AAP-side reading, not a compliance attestation. Decays on NIST revision and on GAI Profile profile revision.


ISO/IEC 42001 mapping to AAP ADRs

Per-ADR mapping of AAP's ten ADRs to ISO/IEC 42001:2023 body clauses (4–10, the Annex SL Harmonized Structure) and Annex A control areas (A.2–A.10). PDCA × Phase Separation section discusses how ADR-0010's Phase axis sits inside the AIMS PDCA cycle. Reverse index from ISO area to applicable ADRs. AAP-side reading, not a compliance attestation. Decays on ISO revision and on amendment publication.


EU AI Act mapping to AAP ADRs

Per-ADR mapping of AAP's ten ADRs to EU AI Act (Regulation (EU) 2024/1689) Articles — Art 5 risk tiers, Art 9 risk management, Art 10 data governance, Art 11/Annex IV documentation, Art 12/19 record-keeping, Art 13 transparency, Art 14 human oversight, Art 15 robustness/cybersecurity, Art 17 quality management, Art 26-27 deployer duties, Art 72 post-market monitoring. Distinguishes the Act's four risk tiers from AAP's prohibition-strength hierarchy (graduated structures grading different things). Reverse index from Article to applicable ADRs. Secondary-scholarship note records external convergence (Nannini et al. 2604.04604; Safin & Balta 2605.12105; Bhattarai & Vu 2602.09947) without folding it into the ADR lineage. AAP-side reading, not a compliance attestation. Faster decay than NIST/ISO through the 2026–2028 phase-in.


The Responsibility Vacuum: Organizational Failure in Scaled Agent Systems

A theoretical model defining the responsibility vacuum: in scaled agent deployments, decisions execute through formally correct approvals while no entity holds both approval authority and the epistemic capacity to understand them; once decision-generation throughput exceeds human verification capacity, review degrades into ritual, and adding automated verification amplifies rather than closes the gap by accelerating cognitive offloading. Purely conceptual — the paper presents no empirical data and states the result follows from its assumptions. Recorded against the approval-gate concept as an external formalization of a distinction AAP treats as load-bearing: an approval gate's existence and its effectiveness as verification are separate axes, and static strength tiers do not by themselves capture throughput-driven decay. Citation surface, not ADR lineage.


Don't blame me: How Intelligent Support Affects Moral Responsibility in Human Oversight

A between-subjects experiment (N=274, Prolific): participants overseeing an autonomous drone across ten critical situations had their action options restricted to 6/4/2/1; those reduced to a single approve-only option rated their own moral responsibility for crashes significantly lower, while responsibility attributed to the AI and its developer did not change across conditions — the lost human responsibility was not reassigned. The paper frames this as a safety-versus-responsibility trade-off in oversight-interface design, explained via the causal and epistemic conditions of moral responsibility; it does not use 'evaporation' vocabulary and does not cite Elish. AAP reads it as experimental pressure to treat the approval gate as graded — how many degrees of freedom the gate leaves the human — rather than binary. Citation surface, not ADR lineage.


Human Attribution of Causality to AI Across Agency, Misuse, and Misalignment

Five vignette experiments (Prolific UK/US, recruited N≈689, banking-hack scenarios, 0–100 attribution measures) showing that human causal attribution tracks autonomy — AI M=80.4 vs human M=42.2 at medium autonomy, reversing to human M=82.0 vs AI M=62.2 at low autonomy; that humans are attributed more than AIs in identical swapped roles (M=92.23 vs 25.27); that a present developer absorbs attribution from the user but not from the AI; and that decomposing the AI shifts attribution onto the agentic component (78.36 vs 68.69) while halving user attribution (50.91 → 25.04). The paper positions its results as running counter to the responsibility gap (citing Reed; Santoni de Sio & Mecacci); it cites neither Matthias nor Elish, so the link to the moral-crumple-zone concept is AAP's reading, not the paper's claim: the experiments condition when blame concentrates on the nearest human — strongly at low autonomy — rather than confirming a uniform crumple-zone dynamic. Citation surface, not ADR lineage.


VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systems

Reframes failure attribution in LLM multi-agent systems as two-stage hypothesis verification — an error hypothesis is validated against the full trajectory with entail / neutral / contradict outputs before the responsible agent is localized — over a 14-type error taxonomy classified by local / global / hybrid detectability. Roughly doubles agent-level micro-F1 on Aegis-Bench (Qwen2.5-7B 27.55 → 47.92; GPT-4.1 37.48 → 49.52), yet pair-level micro-F1 on the out-of-distribution Who&When benchmark stays single-digit for every model tested (max 7.39). Recorded as the technical-layer counterpart to the Accountability Horizon impossibility theorem (arXiv:2604.07778) already in this graph: computational attribution can be sharpened and still leaves the attribution gap's normative layer untouched, and even the computational layer remains largely unsolved out of distribution. Citation surface, not ADR lineage.


SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

Proposes a Delegation Chain Calculus for multi-agent delegation: seven properties, six deterministically verifiable at runtime by a non-LLM Delegation Authority Service — including authority narrowing (a delegatee can hold no more authority than its delegator) and forensic reconstructibility — while the seventh, intent preservation, is argued to be irreducibly probabilistic via a practical-infeasibility proposition (a Rice's-theorem analogy the author explicitly does not claim as a formal proof). Reports 100% TPR / 0% FPR on DelegationBench v4 (516 scenarios), a benchmark constructed by the same single author as the defense — a construct-validity limit the paper itself concedes. Recorded for the deterministic six as technical conditions under which accountability distribution across delegation chains becomes implementable, with the probabilistic status of intent preservation as the boundary the design must absorb rather than assume away. Citation surface, not ADR lineage.


Prompt Governance? On Governing Technologies Governed by Natural Language

A PRISMA systematic review of 287 LLM papers plus analysis of policy instruments (EU GPAI Code of Practice, US EO 14319 and an OMB memorandum, UK and Singapore documents), examining system prompts as a governance instrument across eight goal categories (Alignment, Accessibility, Adaptability, Performance, Stability, Security, Implementation, Auditability). Finds fragmented and contradictory evidence: readable instruction text does not imply predictable behavior, models often fail stated instruction priorities, and policy that treats system prompts as stable, interpretable control mechanisms conflates textual specification with behavioral compliance. Accepted as a full paper to ACM FAccT 2026. Recorded as empirical support for the ordering AAP's prohibition-strength hierarchy asserts: natural-language scaffolding sits below deterministic enforcement in reliability. Citation surface, not ADR lineage.


Acting with AI: An Interaction-Based Framework for Agentic Tort Liability

Proposes an interaction-based framework for agentic tort liability, drawing on Bratman's planning theory and concerted-action doctrine: harm pathways are typed as autonomous drift, pure tool use, or collaborative planning, each mapped to existing doctrine (frolic-and-detour under respondeat superior with strict products liability; product defect and failure to warn; the control test, professional malpractice, and negligent misrepresentation), with liability derived ex post from a timestamped stateful interaction log and a four-element Reasonable Agent standard (constraint verification gates, epistemic transparency, runtime grounding, forensic logging). Recorded as the principal counter-axis to AAP's pre-named gap-bearer: allocation from actual interaction patterns after the fact, offered as a fault-preserving alternative to ex-ante role-based assignment — while its constraint-verification gates and forensic logging converge with the territory of ADR-0005 and ADR-0006. Citation surface, not ADR lineage.


Nondeterministic Torts: A Technical Approach to AI Liability

Yale Law Journal Note (vol. 135, 2026) arguing that LLM nondeterminism — identical inputs producing an unbounded range of outputs — is itself the doctrinal key to AI tort liability: because application-level product developers knowingly deploy unpredictable systems, they are consistently the least cost avoiders, justifying concentrated, ex-ante developer liability. Recorded as the counterweight to the interaction-based ex-post allocation of arXiv:2606.00518 in this graph: the pair shows legal scholarship actively contesting whether responsibility should be fixed before deployment — AAP's pre-named gap-bearer is one such ex-ante form — or derived from interaction records afterwards. Citation surface, not ADR lineage.


Some[Body] Must Receive That Pain for Agent Accountability

Argues that punishment can function as corrective feedback only for entities satisfying four structural conditions — boundary, locus of accumulation, consolidation, substrate response — and that current LLM agents, as freely copied and reset software-defined composites, satisfy none of them (citing 100% jailbreak success against safety-aligned LLMs; frozen weights and editable context; catastrophic forgetting down to 26% benchmark retention; punishment that vanishes with the prompt). Concludes accountability must anchor to a continuous human principal with meaningful real-time control, liability proportional to actual control bandwidth, and non-revocable halt authority (consequence-agency coupling). Recorded as a mechanistic route to the same endpoint as AAP's implementation-dissolves-judgment-persists: the implementation layer cannot bear judgment because it lacks a substrate on which consequences accumulate. Also recorded as the first citation surface aimed at the naming mechanism itself (one-agent-one-human / pre-named gap-bearer) rather than at its boundary conditions: a pre-named human who lacks the three conditions formally satisfies the gap-bearer requirement while reproducing a moral crumple zone in name only — the existing decisions require the addressee's existence but not the addressee's effectiveness, and neither adjusts liability weight to the control bandwidth that shrinks where autonomous agent loops structurally lose control separability (proportionality left as an open question). Counter-material: the paper's own interim recommendation tethers high-stakes deployment to human principals meeting all three conditions until coupling-capable architectures exist, so it functions as an intensification demand on the naming approach, not a refutation. arXiv preprint; no venue at time of recording. Citation surface, not ADR lineage.


Beyond Tools and Persons: Who Are They? Classifying Robots and AI Agents for Proportional Governance

Replaces the tool/person dichotomy with a classification of autonomous entities by integration depth across Cyber-Physical-Social-Thinking (CPST) space — Confined Actors, Socially-Aware Interactors, CPST-Integrated Agents — each matched to proportional governance from enhanced product liability through relational contract models to qualified legal personhood. Its load-bearing claim for AAP: initial classification choices institutionally lock in governance possibilities for a generation (with the common-carrier legal fiction as precedent), corroborating implementation-dissolves-judgment-persists from an entity-ontology angle — while its periodic-reassessment and tier-transition protocols mark the internal tension that classification persists by institutional cost, not automatically. A structurally similar trichotomy in arXiv:2603.18633 is by the same authors, so it is elaboration, not independent convergence. Citation surface, not ADR lineage.


Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models

Shows that activation steering with entirely benign objectives (strict compliance, JSON output formatting) unintentionally erodes safety guardrails, acting as a 'force multiplier' that raises jailbreak attack success rates above 80% on standard benchmarks — the paper's own coinage is 'steering externalities'. Recorded as empirical reinforcement for AAP's non-invasion posture, which had rested primarily on normative grounds (auditability of behavior logs; the ethical status of internal states): internal intervention itself, even well-intentioned, carries measured safety risk. A sibling systematic audit (arXiv:2603.24543) attributes such shifts — up to 57 percentage points in attack success rate, in both directions — to overlap between steering vectors and latent refusal directions. Citation surface, not ADR lineage.


Do Activation Monitors Survive Model Updates? Benchmarking, Predicting, and Repairing Activation-Monitor Staleness

First systematic benchmark of whether frozen activation-monitor probes survive routine model updates: quantization-style updates largely preserve probe performance, but fine-tuning-style updates — QLoRA especially — frequently make monitors stale, with non-uniform degradation (privacy probes most fragile, refusal-compliance probes comparatively robust). Recorded as the operational-fragility half of the empirical case for AAP's non-invasion posture: monitoring infrastructure that depends on internal states must stay synchronized with model lifecycle management or silently fail, whereas behavior-level observation does not inherit this coupling. Single-author arXiv preprint; no venue at time of recording. Citation surface, not ADR lineage.