Authority begins with a human. It never begins with a machine.
A universal, human-rooted authority layer for any intelligent system that can act, access, spend, decide, delegate, or affect the world. Not a permission object — the entire lifecycle of delegated power.
Not controlling the world's AI. Giving the world a language for keeping control of it.
From access control to authority control
Today we give machines access. Tomorrow we must give them authority — and they are not the same thing. Autonomous systems no longer merely read data. They act, spend, communicate, negotiate, modify, and control machines that affect humans.
“Here is my API key.”
A door, held open. It does not know what you intend to do inside.
“You may perform exactly these actions, under exactly these conditions — and here is how I revoke it.”
Bounded, inspectable, expiring, revocable. Power with a lifecycle.
Seven layers, one path
HUMAN
↓
IDENTITY who?
↓
AUTHORITY what power, bounded how?
↓
INVOCATION what action, right now?
↓
BORDER CONTROL does it fit? ── deterministic
↓
ACTION
↓
RECEIPT what actually happened?
↓
AUDIT / PROOF who authorized it — verifiable by anyoneThree rules above everything
No machine may increase its own authority.
An AI may ask for more, and explain why. It may prepare a new grant. It may never sign the human's side of it. Human → agent is allowed. Agent → a narrower sub-agent is allowed. Agent → itself with more power is impossible — enforced by attenuation, not by promise.
Authority must be explicit, bounded, inspectable, and revocable.
If any dimension of a grant is undefined, the permission is ambiguous. Ambiguous authority defaults to DENY. Silence is never consent.
Intelligence and authority are separate dimensions.
Capability does not grant permission. Prediction accuracy does not. Popularity does not. A system a million times more capable than today's may still hold authority = 0. Border Control does not care how brilliant the model is. It sees the grant.
Superintelligent AI
capability : extraordinary
authority : read one document
expiry : 5 minutes
delegation : forbiddenBorder Control does not care how brilliant the model is. It sees the grant. That is the whole safety property — and it holds no matter how far capability runs ahead.
If one is undefined, the answer is DENY
These ten dimensions are the normative semantics of a grant. HAP-1's eight human-facing questions are a projection of them — the model is what a machine must satisfy.
- 01WHO — receives the power?
- 02WHAT — may they do?
- 03RESOURCE — to what, exactly?
- 04AMOUNT — how much? (value / scope caps)
- 05TIME — when? (not-before / expiry)
- 06FREQUENCY — how often? (uses / rate)
- 07CONDITIONS — under what constraints?
- 08DELEGATION — may they pass it on? how deep?
- 09REVOCATION — how does the human take it back?
- 10PROOF — what evidence must come back?
One model, four representations of it
A developer will ask: the ten dimensions, or the eight questions — which is authoritative? The dimensions. Each layer below restates the same authority for a different audience; when they seem to differ, the model wins.
Not every permission is equal
Every machine action requires prior human-rooted authority. Not every action requires contemporaneous confirmation. A standing bounded grant may authorize routine, capped work on its own — otherwise delegation collapses into a suggestion box. Higher classes demand stronger verification, up to the human being actively present now, a primitive the agent cannot automate around. Step-up is risk-dependent, not universal.
Where did this machine's power come from?
Every action carries its authority lineage, so that question has a cryptographic answer — not a shrug. Every edge narrows the authority it inherits.
Human Root
↓ delegates, narrower
Phone
↓
Personal Twin
↓
Travel Agent
↓
Booking Agent
↓
Airline API ← may act only within everything above itAnd an action is never merely “the AI did it.” It carries agent_id · model_id · runtime_id · software_hash · authority_id · invocation_id — so the record reads: Agent A, running model version B, under authority C, invoked operation D at time E.
What machines can never do
- create human authority
- increase their own authority
- convert intelligence or capability into permission
- bypass a required human-presence check
- act after their grant has expired or been revoked
- rewrite the history of what they did
Machines may transmit power. They may not create human authority.
The same model, at world scale
Philosophy → Model → Protocol → Runtime → Proof → Adoption
Take the model home
One page. Copy it, fork it, argue with it, implement it. A model becomes a foundation the moment it no longer needs its author — no sign-up, no key, no attribution required.
# THE HUMAN AUTHORITY MODEL
Version 0.1 — a foundational document
> Authority begins with a human. It never begins with a machine.
> Not controlling the world's AI — giving the world a language for keeping control of it.
---
## 0. Why this document exists
Today we give machines ACCESS. Tomorrow we must give machines AUTHORITY.
They are not the same thing.
ACCESS says: "Here is my API key."
AUTHORITY says: "You may perform exactly these actions, under exactly
these conditions, and here is how I revoke it."
Autonomous systems no longer merely read data. They act, spend, communicate,
negotiate, modify, and control machines that affect humans. The industry must
move from ACCESS CONTROL to AUTHORITY CONTROL.
This document defines the model. The Echo Authority Protocol is one technical
implementation of it. The model is not owned by any company.
---
## 1. What authority is
Authority is delegated power with a lifecycle. It has an origin, a shape, a
duration, a boundary, and an end. It can move, shrink, expire, and be revoked.
It can never appear from nowhere, and it can never enlarge itself.
Authority is NOT identity. Authority is NOT capability. Authority is NOT
intelligence. Authority is NOT ownership-by-a-corporation. Only a valid,
human-rooted chain confers it.
---
## 2. Where authority originates — the Human Root
Every authority chain MUST begin at a human (or an organization of humans).
The human root is the only source. Everything downstream is a narrower,
time-bound, revocable grant of what the root already holds.
HUMAN ROOT → DEVICE → SESSION → AGENT → SUB-AGENT → SERVICE
The root rarely signs directly. It authorizes bounded, short-lived keys, so a
leak anywhere below the root has a small, expiring blast radius.
---
## 3. The seven layers (the lifecycle of power)
1. HUMAN ROOT The original source of authority.
2. IDENTITY Who is the human, org, device, agent, or machine?
3. AUTHORITY What power has been granted, and bounded how?
4. INVOCATION What exact action is being attempted right now?
5. ENFORCEMENT Does this action fit the authority? (deterministic)
6. CONSEQUENCE What actually happened in the world?
7. PROOF Can anyone later verify who authorized what, and whether
the action complied?
HUMAN → IDENTITY → AUTHORITY → INVOCATION → BORDER CONTROL
→ ACTION → RECEIPT → AUDIT / PROOF
---
## 4. The three constitutional rules
### Rule I — No machine may increase its own authority.
An AI MAY ask for more permission and explain why. It MAY prepare a new
Authority Object. It MUST NOT sign the human's side of that grant.
Human → Agent = allowed
Agent → narrower sub-agent = allowed (attenuation only)
Agent → itself, with more power = IMPOSSIBLE
Enforced mathematically: a child grant MUST be a provable subset of its parent.
### Rule II — Authority must be explicit, bounded, inspectable, revocable.
If any dimension of a grant is undefined, the permission is ambiguous.
Ambiguous authority MUST default to DENY.
### Rule III — Intelligence and authority are separate dimensions.
Capability does not grant permission. Prediction accuracy does not grant
permission. Popularity does not grant permission. A system a million times
more capable than today's models may still hold authority = 0.
Superintelligent AI
capability : extraordinary
authority : read one document
expiry : 5 minutes
delegation : forbidden
Border Control does not care how brilliant the model is. It sees the grant.
---
## 5. The ten questions every grant MUST answer
1. WHO receives the power?
2. WHAT may they do?
3. TO WHAT resource?
4. HOW MUCH? (value / scope caps)
5. WHEN? (not-before / expiry)
6. HOW OFTEN? (uses / rate)
7. UNDER WHAT CONDITIONS?
8. CAN THEY DELEGATE? (and how deep?)
9. HOW DO I REVOKE IT?
10. WHAT PROOF must come back?
Any unanswered question ⇒ DENY.
---
## 6. Authority classes (risk-sensitive verification)
Class 0 Observe read public data device signature
Class 1 Private read read personal information device signature
Class 2 Communicate send / publish device + policy
Class 3 Modify change docs / settings device + confirmation
Class 4 Economic move value device + user confirm
Class 5 Physical control machines / robots hardware key + presence
Class 6 Irreversible delete / transfer / execute hardware key + present
Higher classes require stronger verification. Human presence itself is a
primitive: a grant MAY require the human to be actively present now
(e.g. passkey, max-age 30s), and the agent cannot automate around it.
---
## 7. What machines can never do
- create human authority
- increase their own authority
- convert intelligence or capability into permission
- bypass a required human-presence check
- act after their grant has expired or been revoked
- rewrite the history of what they did
Machines may TRANSMIT power. They may not CREATE human authority.
---
## 8. The chain of custody
Every action carries its authority lineage, so the question
"Where did this machine's power come from?" is mechanically answerable.
Human Root → Phone → Personal Twin → Travel Agent → Booking Agent → Airline API
Every edge narrows the authority. When an automated system does something
harmful, "who authorized this?" must have a cryptographic answer, not a shrug.
---
## 9. Provenance of action
An action is never merely "the AI did it." An invocation carries:
agent_id · model_id · runtime_id · software_hash · authority_id · invocation_id
So the record reads: "Agent A, running model version B, under authority C,
invoked operation D at time E." Accountability, not anthropomorphism.
---
## 10. The model extends (the substrate)
The same model scales beyond one person:
- Multi-party authority (2-of-3, CFO AND CEO, parent AND child, doctor AND patient)
- Policy-bound capability (payment.execute only if recipient=X, amount<100, ...)
- Intent preservation (link low-level actions back to the human's stated purpose)
- Emergency authority (freeze all agents · revoke a subtree · SAFE MODE)
- Consequence proofs (AUTHORIZED ≤ €20 · INVOKED €18 · EXECUTED €18 · SETTLED tx-id)
- Jurisdiction outside core (cryptographic permission ≠ legal permission; law is a policy layer)
- Machine-to-machine (agents negotiate; none originates authority)
---
## 11. The stack
Philosophy → Formal Model → Protocol → Runtime → Proof → Adoption
This document is the Formal Model. The Echo Authority Protocol (Draft 0.1) is
the Protocol. Border Control is the Runtime. Receipts + the Authority Graph +
on-chain anchoring are the Proof. Anyone may implement, fork, and verify.
---
## 12. The closing formulation
We are not building one global server that decides what every AI may do.
That would be terrifying. We are building a shared LANGUAGE of authority —
the way machines already share HTTP, TLS, and DNS.
The dream is not that one company becomes the world's permission administrator.
The dream is that the world adopts a common way for humans to cryptographically
bound machine authority.
Not controlling the world's AI.
Giving the world a language for keeping control of it.
— THE HUMAN AUTHORITY MODEL, v0.1
Machines may transmit power. They may never create human authority.
We are not building one global server that decides what every AI may do — that would be terrifying. We are building a shared language of authority, the way machines already share HTTP, TLS, and DNS. The dream is not that one company becomes the world's permission administrator. It is that the world adopts a common way for humans to cryptographically bound machine authority.