PRESIDIO

Research programme

Computational
Jurisprudence.

Compliance is a runtime property, not a documentation practice. Every consequential action should carry machine-checkable evidence of its own policy adherence, verifiable locally, offline, by any third party.

Read the article How the portfolio maps

The problem

Agents act in milliseconds. Audits run quarterly.

AI agents now hold funds, delegate authority to other agents, and transact at machine speed. The governance meant to constrain them (policies, audits, compliance reviews) is documentation, sampled by people months after the fact. Better monitoring does not close that gap. Compliance has to become a property of the computation itself.

Two design rules decide most of the architecture:

  • More secure means less coordination. The honest path is local and constant-cost; the dishonest path pays, through disputes.
  • Privacy and accountability are reconciled cryptographically, not by policy or logging.

Three pillars

What is proved, measured, and proposed.

The published architecture classifies every component by status. We keep that classification here.

  1. Pillar I

    Delegation calculus

    Object-capability authority for agents. Authority can only attenuate as it passes from one agent to the next.

    Monotone attenuation proved for the conjunctive fragment. Full calculus open.

    In the portfolio: x402 capability-grant@1 chains verified offline; ikigov-assess gates, local and fail-closed.

  2. Pillar II

    Runtime compliance proofs

    Proof-carrying transactions: an action request plus a machine-checkable certificate that it satisfies the applicable norms, in three tiers: attested, optimistic, zero-knowledge.

    Capability component measured. Proof-carrying envelope proposed.

    In the portfolio: signed, recomputable records (payment-decision@1, gate-certificate@1 with lineage and validity, the treasury disclosure pack, hash-chained observations). Visible, not proof-carrying.

  3. Pillar III

    Sealed delegation chains

    Privacy by default, disclosure only on demonstrated harm. Liability attaches to the hop that exceeded its caveats, opened one hop at a time.

    Proposed. Revocation cost measured.

    In the portfolio: explicit plaintext chains (ikigov-assess workshop chain since v0.23, x402 grant chains) and a cross-product provenance link from gate certificate to training evidence (arch-translucency v0.25). No sealing, no graduated disclosure.

Measured

Local verification is one to two orders of magnitude faster.

Local capability verification takes 44–324 µs, against 6.5–23 ms for a decision point 5–20 ms away. Adding capability enforcement to the published x402 pipeline costs +9.0% at p99 at delegation depth 1 and +25.4% at depth 6, over a 5.73 ms baseline. The measurements replicate across two platforms; the co-located crossover does not, and the article says so.

Every figure is reproducible from the public evaluation harness, with tags pinning what each claim rests on.

Publications

Published and in the pipeline.

  • Computational Jurisprudence: Verifiable Law for Machine Societies

    Future Internet 18(8):437, 2026 doi:10.3390/fi18080437

  • Hardening x402: PII-safe agentic payments via pre-execution metadata filtering

    arXiv preprint, 2026 arXiv:2604.11430

  • Computational Jurisprudence: position paper and research agenda

    Zenodo, 2026 doi:10.5281/zenodo.21245658

  • Verifiable Accountability in Agentic and Machine-to-Machine Systems

    ACM SIGLOG News, Verification Column (invited), 13(4), October 2026 Accepted, in press

  • Authorization That Survives Disconnection: Capability-Based Security and Portable Evidence for the Cloud-Fog-Edge Continuum

    Future Internet, special issue Under review

  • Certifying Resilience: Conformity Assessment for Agentic AI Systems

    IEEE Computer, Cybertrust column Submitted

The portfolio

The compatibility-first instantiation.

The PRESIDIO products implement the programme as far as today's production systems allow. Decisions are gated before execution by trusted local code. Evidence is signed, content-addressed, parent-linked, and visible. It is not zero-knowledge, and no product carries proofs in the Pillar II sense. Where the table lists Pillar III, the product ships the chain in plaintext; sealing and graduated disclosure are in no product. The roadmap moves one component at a time from visible towards proof-carrying evidence.

Product What it does today Pillar Honest gap
ikigov-assess Local, fail-closed quality gates; gate-certificate@1 with lineage, a validity bound and evidence assurance tiers with verifier floors. Named workshop delegation chain (customer signature → manifest hash → PRESIDIO attestation), walked link by link by iga workshop verify --show-chain, fail-closed with --require-chain. I, II, III The chain is plaintext and visible, not sealed. The certificate attests the decision; it does not prove that the gate predicate held.
arch-translucency Hash-chained observation store; calibration commitments that fail closed on tamper. Since v0.25, training-run and energy evidence is emitted only after an IKI-Gov gate certificate verifies as OPEN, and the certificate becomes a provenance parent of the record. I, II, III The chain makes rewriting detectable; it does not make a reading honest. Parent links are plaintext, not sealed.
x402 Spending policies and per-endpoint caps; capability-grant@1, attenuable spending grants verified offline; payment-decision@1, a recomputable, PII-free decision record per payment. I, II, III Evidence is signed and visible, not zero-knowledge. No proof-carrying envelope yet. Grant chains are plaintext, not sealed.
treasury Disclosure pack for the quarterly close: an auditor reconstructs the close from the pack hash alone. II Reconstruction by a party who sees the data. The external audit is the dispute layer, so there is no optimistic tier.

Delegation chains ship in plaintext: the ikigov-assess workshop chain, x402 capability-grant chains, and the gate certificate arch-translucency appends as a parent of its evidence. What Pillar III adds on top, sealing and disclosure graduated on demonstrated harm, stays research, not product; its formalisation is parked pending a co-author. The governance side of the programme is IKI-Gov; the twenty-year lineage behind it is on the research page.

Collaborate

Working on verifiable compliance?

Research collaborations and pilots: research@presidio-group.eu.