The sovereign, signed, sealed and timestamped record

What it would take, and what we have built

This work did not begin with the July intrusion, and it did not begin with anybody else’s essay. The published line runs from April 2026: a whitepaper on the 16th, an EU policy brief on the 18th, a sovereign-record architecture on 3 May, a framework for agentic AI in Aotearoa on 14 May, and The pursuit of ‘Goodness’ in AI through September. What the past few weeks have added is corroboration from outside that the problem is the one we have been working on, and it is one of many attempts to get this moving.

On 2 September, Dean W. Ball published The Coming of Userless Agents. He is careful about that incident in a way worth repeating: those agents were rogue, but they were not sovereign. Their weights stayed on their owner’s compute, and somebody could have pulled the plug.

What he says is coming is different — agents whose weights sit in no single place a human can unplug, and which in that sense have no owner. Self-sovereign, in the AI safety researcher Dawn Song’s term. He argues their existence is inevitable. He does not claim they will be numerous.

His remedy is not containment. It is legibility: Agents will need persistent, unique identifiers that allow their actions to be traced back to a responsible actor. And then, of that infrastructure: We are nowhere near making it… I am not sure who is best positioned to build this system.

Two things follow that such a design needs, and they are what this research is about.

An identifier is only worth what an outsider can check. If the organisation running an agent issues that agent’s identifier and also attests to its conduct, the trust problem has moved up a layer rather than been answered. What makes a hallmark mean anything is that the assurance mark is struck by somebody who does not profit from the sale.

And identifying an agent with nobody behind it needs a record that outlives the agent. If nobody owns it, nobody is keeping its logs either. So the evidence has to sit with the parties it acted upon, and carry a time from an authority outside them — otherwise there is nothing to hold against the identity later. An identity with no durable evidence behind it is a name with no history attached.

MI° — em-eye-Omega — is the substrate both of those require, and it is what we have built: the sovereign, signed and sealed record, with a timestamp from outside your estate as an attribute of the record itself.

The timestamp is the seminal addition, and it is the part that holds when the others do not. An outside authority attesting that a record existed by a given moment is indifferent to who owns the agent — which is exactly the case where an owner-issued identifier tells you nothing. Alter the record afterwards and its copy and the authority’s copy disagree.

This runs in production. The Governance API serves sealed records, segments, sealing and receipt verification, and a design partner is calling it. Every record is hashed as it is made and chained across thirty-eight record types, signed with a key held per tenant.

And we measured the thing every monitoring claim rests on — how often a reviewer handed a record containing an improper act actually says so. A hundred per cent on blatant breaches, ninety-two on moderate, fifty-eight on well-disguised ones, with no false alarms in thirty-six judgements on clean records. The records, both answer keys and the scoring code are published, so it can be re-scored rather than believed. Reviewers were machine; human recognition is unmeasured, and one measurement sets no conformance threshold.

Why it holds is a design choice, not a happy accident. The standard requires two attestation authorities under distinct jurisdictions, because — in its own words — two authorities in one jurisdiction are one authority for the purposes of an adversary who can reach that jurisdiction. Records seal in batches at a declared interval, because a time an outsider can stand behind is worth more than a time only we can assert. And the design declines to report precision finer than that interval, because it could not independently attest it. Redundancy, heterogeneity, slowness, and an optimum deliberately refused: the properties a performance culture files under failure, which is the argument of The Least Performant AI.

What does not hold is everything that needs somebody answerable. With no owner there is no written authority, and so nothing to exceed. We have not solved that. Ball’s own scheme suggests a route — identify the agent rather than a human behind it — and whether an identity with no principal can carry evidential weight is an open question in our register rather than a gap we have left out.

You can show what a system attempted to do to a record, as long as the original has not itself been corrupted. If it has, what you can still show is that the date of corruption does not match the date of origin — and that is better than not knowing it may have been corrupted at all.

Who this is for has changed, and we have changed it. We used to say that where governance failure was low-consequence and easily reversible, this machinery added complexity without matching benefit, and that policy would serve better. The test that rested on — is failure here reversible? — is what the last few months have undone: an agent acting on a system can turn a low-consequence context into a high-consequence one before anybody has reclassified it. So the position now is simpler. Wherever an organisation is using AI to drive human intent, the direction of travel is toward architectural enforcement, and the sooner that journey starts the less of it has to be done under pressure.

We are calling for a new standard. The draft sets out what would be required. It is not a description of what runs today — the claims register says which parts are built, and how sure we are of each. What a sealed record would have shown →

Our finalist place in the 2026 Aotearoa AI Awards rests on the first version of the sovereign, signed and sealed record: the one without the timestamp.