Abstract

Disclosed is a system and method for machine enforcement of AI regulation at the execution boundary, the final point at which an output computed by an AI model, AI agent or automated application becomes a real-world effect such as a payment, database write, API or tool call, message delivery, network configuration change or physical actuation. Existing controls, including identity and access management, OAuth tokens, policy engines, AI guardrails, model evaluation, logging and remote attestation, act before or after this moment but not at it, leaving a time-of-check to time-of-use gap that prompt injection, credential theft, model substitution and autonomous agent behaviour can exploit.

The disclosed architecture separates the authority to perform an operation from the capability to perform it. Every consequential operation is non-completable by default. The capability required to complete it, such as a decryption key, signing key, release token, fabric credit, reachability descriptor or electrical enable signal, is held inside a protected, hardware-rooted enforcement domain implemented in a trusted execution environment (TEE), hardware security module (HSM), secure element, DPU/SmartNIC or dedicated gating circuit that the AI system and its host cannot read or override. At execution time the enforcement point jointly validates five conditions: a scoped, revocable identity; a declared purpose bound in a signed policy token; a cryptographic measurement (fingerprint) of the exact approved model, code and configuration; legal jurisdiction proven through X.509 certificate chains, attestation and sovereign-cloud credentials rather than IP addresses; and temporal validity with single-use, replay-resistant semantics enforced by monotonic counters. A signed, hash-chained validation receipt is generated inside the protected domain before the capability is released or withheld. Receipts are created at both a computation-start boundary and an output-finality boundary, linked by a common invocation identifier, and they record refusals as well as approvals. Any failed, unreachable or uncertain check fails closed to a defined safe state. Possession of a credential is never by itself sufficient to act.

Applications described include AI agent tool-call and Model Context Protocol (MCP) authorization, prompt-injection containment, cross-border AI processing in which raw personal data stays in its home jurisdiction and sealed outputs are decrypted only after jurisdiction proof, credit and payment release, healthcare outputs, employment decisions, telecommunications reachability, critical infrastructure control planes, gated export of model weights, and drones, vehicles and robots. A withheld capability acts as an AI shutdown or kill-switch mechanism that remains effective even when the model or its host does not cooperate.

The document maps the architecture to the EU AI Act as amended by Regulation (EU) 2026/1744 (Digital Omnibus), including Articles 5, 9, 10, 12, 13, 14, 15, 26, 27, 50, 55 and 72–73, and to the GDPR, NIS2, the Cyber Resilience Act, DORA and the DSA. It also covers US AI regulation, including state laws and a politically neutral analysis of proposed US federal AI legislation addressing frontier-model oversight, human shutdown capability, suspension orders, pre-deployment approval, incident reporting, model-weight exfiltration and independent verification. Further coverage includes the UK, China, India, South Korea, Japan, Singapore, Brazil and Canada, the OECD AI Principles, the Council of Europe AI Convention, the NIST AI RMF and ISO/IEC 42001. The document contains more than thirty drawings, including regulation mapping drawings and a jurisdiction-by-obligation matrix.

This disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026, which claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026. The regulatory and industry-relevance mapping is AI-generated, and readers must cross-check it against the original PCT filings before drawing any conclusion. The author is open to acquihire or strategic collaboration.

Keywords

AI kill switch; AI shutdown capability; machine enforcement of AI regulation; execution-time enforcement; runtime AI governance; policy enforcement point; zero trust for AI agents; AI agent authorization; tool-call authorization; MCP security; prompt injection mitigation; capability-based security; separation of authority and capability; hardware root of trust; confidential computing; trusted execution environment; hardware security module; remote attestation; model fingerprinting; approved model version enforcement; fail-closed design; time-of-check to time-of-use; tamper-evident audit log; hash-chained signed receipts; AI incident reporting; model weight exfiltration prevention; frontier AI regulation; EU AI Act compliance; Article 14 human oversight; Article 12 record-keeping; Article 15 cybersecurity; Digital Omnibus; GDPR purpose limitation; data protection by design; data sovereignty; cross-border AI processing; jurisdiction attestation; compliance as code; policy as code; US federal AI legislation; state AI laws; NIST AI RMF; ISO/IEC 42001; AI governance; responsible AI.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS