Abstract

(Technically Relevant to AWS, NVIDIA, Meta, Apple, Google, Microsoft, OpenAI and Anthropic)

4 April 2026 filing

Most AI governance happens before deployment, through testing and evaluation, or after the fact, through logs and audits. Runtime safeguards that do exist usually rely on a confidence score or a simple allow-or-block decision. That leaves the hardest case unresolved: what should happen at the moment of action when the system cannot tell whether an AI output, payment or machine command is permitted?

Based on Indian Provisional Filing: 202631043195, filed 4 April 2026, and disclosed with the Mothership (PCT/IB2026/055615) on 16 July 2026.


AI systems are moving from answering to acting. They release outputs, commit payments, send messages and command machines. Most AI governance still happens before deployment, through testing and evaluation, or after the fact, through logs and audits. Neither stops a specific action at the moment it becomes real. Today’s runtime safeguards also tend to rely on a confidence score or a binary allow-or-block decision. That leaves the hardest case, when the system cannot tell, either to pass through or to be refused without recourse.

This disclosure describes a runtime execution-governance architecture built around three ideas:

  • Hold every action before its irreversible point. Every proposed AI action is intercepted before the point where it becomes externally effective. That point can be an output release, an API response, a transaction commit or settlement, a network transmission, a publication, a machine command or a physical actuation.
  • Check three conditions in a protected environment.Inside a cryptographically isolated enforcement domain, such as a trusted execution environment, secure enclave or hardware security module, the system checks:
    • purpose: whether the action is within its authorised purpose;
    • logic: whether the AI logic producing it matches approved logic, verified by an algorithmic logic fingerprint or attested model state;
    • context: whether current authority and context allow it.
  • Decide in one of three states:
    • Allow releases a single-use, time-limited, non-transferable capability, and the action proceeds.
    • Deny withholds the capability, and the system fails closed.
    • Escalate applies when admissibility cannot be established. The action stays held, never provisionally released, while a recovery path runs. Recovery paths include supplementary attestation, higher-authority review and multi-party approval.

Uncertainty is classified by cause rather than treated as generic noise. The seven causes are:

  • sensor uncertainty;
  • model-state uncertainty;
  • stale authority;
  • incomplete context;
  • revoked dependency;
  • unverifiable logic;
  • unresolved quorum.

Each cause has its own recovery action and domain-specific timeout, for example 50 ms for vehicle sensors and 2 s for financial authority refresh. An escalation that is not resolved in time becomes deny.

A core rule holds throughout: no confidence score, tolerance margin or approximation band can authorise an action on its own. Authority comes before probability.

Other protections:

  • Voided on change. A capability already released is voided when authority is revoked, logic drifts or context changes, and re-evaluation can occur at every step.
  • Evidence and anti-replay. Attested validation records and sealed state provide evidence and prevent replay and rollback.
  • No side doors. Alternate execution paths and human overrides are bound to the same controls.

The filing contains 44 claims and covers:

  • AI output release;
  • financial transactions and settlement;
  • autonomous machines and robotics;
  • multi-authority approval;
  • healthcare, insurance, data protection and platform governance.

Industry relevance. The architecture aligns with, and could complement, current industry directions:

  • AWS: Bedrock AgentCore Policy, which checks agent tool calls at a gateway, and Nitro Enclaves.
  • NVIDIA: the OpenShell agent runtime, NeMo Guardrails, confidential GPUs and BlueField-based enforcement.
  • Meta: Llama Guard, LlamaFirewall and the Muse/Sentinel separation of proposing from authorising.
  • Apple: Private Cloud Compute’s attested software and the Secure Enclave.
  • Google: Agent Gateway, Model Armor and confirmations in Gemini agents.
  • Microsoft: Agent 365, Prompt Shields, confidential computing, and the principle of keeping language models out of allow-or-deny decisions.
  • OpenAI: confirmations, Lockdown Mode and Agents SDK guardrails.
  • Anthropic: sandboxed agents with classifier-assisted permissions.
  • China: Alibaba’s Qwen and Alipay agentic commerce, Tencent’s WeChat agents, ByteDance’s Doubao assistant and Huawei’s AgenticCore.

In each case, the architecture offers a common decision model for the moment of action:

  • allow, deny or escalate;
  • named uncertainty;
  • approved-logic checks;
  • single-use capabilities.

These are potential complementary applications and opportunities for technical collaboration. They are not confirmed adoption, implementation or licensing.

Filing details. Indian provisional patent application no. 202631043195, filed 4 April 2026, made public on 16 July 2026 on WIPO PATENTSCOPE as a priority document of the Mothership application PCT/IB2026/055615 (WO 2026/150382), filed 4 June 2026 and publicly disclosed 16 July 2026. Inventor: Sangam Das ([email protected]). The inventor is open to acquihire or strategic collaboration.

Disclaimer. The invention described in the filing is the work of its human inventor. This title, abstract and the accompanying summary, including the industry-relevance and company references, were prepared with AI assistance. Readers must cross-check every statement against the original filed documents on WIPO PATENTSCOPE and official company sources, and draw their own conclusions from those primary documents. Naming a company or product shows topical relevance only. It is not an endorsement, a validation, a criticism or a statement of infringement, and no company named is affiliated with the inventor. The application is pending, and nothing here is legal advice. Licence: CC BY-NC 4.0.

Keywords: AI safety; runtime authorisation; execution governance; point-of-action control; allow deny escalate; non-permissive escalation; human-in-the-loop; fail-closed; purpose-bound authorisation; logic-bound authorisation; model attestation; algorithmic logic fingerprint; confidential computing; trusted execution environment; secure enclave; HSM; capability-based security; single-use capability; token revocation; real-time revocation; uncertainty classification; sensor uncertainty; model-state uncertainty; stale authorisation; dependency failure; multi-party approval; quorum; authority over confidence; AI guardrails; agentic AI security; tool-call authorisation; agentic commerce; agent payments; autonomous vehicles; robotics; financial AI; healthcare AI; attested audit record; replay prevention; rollback prevention; irreversible action boundary; EU AI Act; human oversight; Bedrock AgentCore; OpenShell; NeMo Guardrails; Llama Guard; LlamaFirewall; Private Cloud Compute; Agent Gateway; Model Armor; Agent 365; Claude; ChatGPT; Gemini; Qwen; Alipay; Doubao; WeChat; AgenticCore

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS