Who decides, and who checks the decider

Move the decision off the producer and onto an authority, and the obvious question follows: what stops the authority from being wrong? Two things. A verifier that can only lower a verdict, never raise it. And an acceptance anyone can re-run.

Back to evidence

Finality Assurance™Kernel Obligation Roster Account & Verdict Evidence Authority Licenses Continuous Finality™Ladder & Four Corners Accepted Work Semantic Computation™Vocabulary

The division

The agent supplies the evidence and does not grade it.

Three different parties, three different jobs. The agent produces the evidence; that part is mandatory. Someone who did not do the work decides whether the evidence is good enough. Whoever wants to act on the answer decides whether to.

Producers produce

Doing the work produces classified evidence as a by-product. The producer has no way to write the conclusion.

Authorities accept

An authority separate from the work takes the evidence as satisfying what the work was for, or does not.

Relying parties rely

Whoever is about to act decides whether to, on the strength of a license naming them.

That division is a security property. Where the producer’s report is the record, compromising the producer compromises the record, and a misdirected agent reports success in exactly the voice a correct one uses. Where done is computed by an authority that did not do the work, from evidence a second party can reconstruct, asserting success buys nothing, and the cheapest route to a result that counts is to do the work.

So who watches the watcher?

Not a second authority above the first.

That would just move the question up a level. The answer is in two halves.

A verifier that can only lower

It can narrow a result, hold it, or refuse it, and it can never raise one. A verifier able to turn a hold into a pass would be a second producer, and its agreement would be worth no more than the first one’s. When a verifier disagrees, the useful direction is down.

The acceptance can be run again

The authority is not trusted to produce the answer. It is trusted only to accept one, and acceptance is computed from bound evidence, so a second party can run the acceptance again. If an authority accepted on evidence that does not support the acceptance, the reconstruction shows it, without anyone’s cooperation.

The same applies one layer down, to whoever binds the evidence in the first place. Binding is itself a governed act with its own evidence, so the binder is checkable on the same terms as the accepting authority.

The write path has not disappeared; it has moved, and it has moved into the open: whoever binds the evidence is now a named, checkable party. Authority does not vanish. It stops being able to hide inside a status, and it becomes checkable on the same terms as everything else. You are not being asked to trust the authority’s judgment. You are being handed what the judgment was made from.

Where it stops

Exactly one declared root.

The chain does end. It stops at a declared root authority, taken as given rather than computed. Every system of this kind stops somewhere.

The difference worth having is not that the stopping point disappears. It is that there is exactly one of them, it is named, and everything between it and the result is reconstructible.

Compare that to the arrangement it replaces, where the trust is not eliminated either but distributed silently across every agent in the organization: unnamed, uncounted, and impossible to audit because nobody wrote down where it was placed.

A valid signature≠An authorized signer

Next steps

Authority declares and accepts. Licenses set the limits.

What may be said, and who may act, are different objects.

Discuss one workflow Read the Research