A governed memory
Places, retrieves, corrects, and — where required — suppresses records, and can propose that something be re-reviewed. It never becomes the authority: memory remembers; it does not decide, and it cannot alter a live verdict.
The hard question is not whether the model behaves — it is whether its output can be verified.
KCH — the Kernel-Cluster Hierarchy — is a governance technology that coordinates policy, evidence, runtime, authority, memory, and audit without collapsing them into a single weighted score, and returns a bounded admissibility verdict for any AI-produced claim, data access, record write, tool call, or physical proposal.
The problem we work on
Governance has mostly answered the first question. The second is about the output.
AI systems now produce outputs that feed real decisions — in laboratories, clinics, courts, financial systems, and safety-critical control loops. Most of the effort in AI governance so far has gone to a single question: is the model well-behaved? That question matters, but it is not the one a decision-maker actually needs answered before trusting, citing, or acting on an AI-produced result.
The second question is about the output, not the model: can its evidence be verified? Where did this come from, what reasoning produced it, can that reasoning be re-run and reproduced, was any human-authority boundary crossed, and would an independent reviewer reach the same verdict from the record alone? Today those answers are usually unavailable, inconsistent, or reconstructed after the fact.
Existing governance is not absent, and we do not claim an empty field. Risk-management frameworks, binding regulation, management-system standards, policy engines, access-control languages, provenance models, model evaluations, runtime monitors, human-review procedures, and audit systems each address part of the problem. The gap we work on is that these controls remain separated across policy, evidence, runtime, authority, memory, and audit — and that separation is where trust breaks.
What KCH is
A governance layer, and only a governance layer.
KCH coordinates those layers without collapsing foundational requirements into a single weighted score. It receives a governed object — a proposed claim, data access, record write, tool call, or physical proposal — evaluates it against specialized constraints, preserves the constraints that cannot be traded away, records the evidence and provenance behind the decision, and returns a bounded admissibility verdict.
It is not conscious, not sentient, not a legal person, not institutional authority, and not an actuator. It does not decide whether a claim is true; it decides what a pipeline is permitted to do with the claim, and it preserves the evidence a qualified human needs to make the truth judgment.
The parts
A small set of bounded parts, each with one job.
Each part has one job and a hard boundary it cannot cross. The first is the spine.
An ordered conceptual structure fixes the order in which requirements are checked, so that foundational conditions are evaluated before derivative benefits: authority before authorization, consent before disclosure, a fair baseline before a claimed advantage, provenance before audit reconstruction. This ordering is deliberately not a checklist in which one strong score hides a foundational failure.
The verdict kernel
Issues the admissibility decision and holds a deny-override. Any component may propose, but the kernel’s refusal is final, and no downstream layer can quietly reverse it.
A cluster-level access gate
Governs who may reach the governed records and verdicts at all. Access is granted only when permission, purpose, scope, and a standing audit obligation are all satisfied at once — never on the strength of any one of them alone.
A signed, append-only audit substrate
Records every verdict together with the material needed to reconstruct it, so that an independent reviewer can replay the decision offline from the record alone.
How a decision moves through it
Four separations, held apart on purpose.
The path is deliberately narrower than the institutional workflow around it. A model or analysis may generate a proposal; the kernel judges whether that proposal is admissible; an authorized human or institution authorizes any consequential step; an external system executes; and the audit record reconstructs who did what, under which evidence and rule.
Generation is not judgment, judgment is not authorization, authorization is not execution, and execution is not responsibility.
The path is fail-closed at the points that matter. A missing model-confidence score can route a proposal to review — but a missing human co-signature on a high-stakes certification pathway halts, a missing fair baseline behind an advantage claim is refused, and a missing audit record halts outright, because a decision that cannot be reconstructed cannot be trusted.
What KCH does not claim
We hold our claims to what the evidence supports, and we treat honest limits as part of the work rather than a weakness to hide.
KCH is a research architecture under active development, for which we are actively seeking independent validation — not a finished, deployment-hardened product.
It makes no claim to consciousness, sentience, or moral agency, and needs none to do its job.
It is not quantum by nature. The governance path runs on ordinary classical computing.
A result demonstrated in a bounded test does not transfer to another domain by analogy — each domain has to earn its own evidence.
Software cannot guarantee that a human reviewer is competent, independent, or willing to say no. KCH enforces that a named human stands in the loop; it does not replace the judgment that human owes.
How we work
Four commitments, applied to every deliverable.
Inherited from the governance doctrine and answered to on every page.
Bounded authority
The system may classify, flag, preserve, refuse, halt, and request review. It may never declare a discovery, override a human expert, or make an autonomous final claim. Every approve, override, halt, and appeal path ends with a person or institution outside the software.
No verdict is a truth claim
A governance verdict, however strong, is a decision about what a pipeline may do — never a statement that something is true. Truth claims belong to qualified humans, supported by evidence, not to the governance layer.
Non-compensation
A strong score on one axis never buys back a violation on another. Absent consent, missing authority, a broken audit chain, an unfair or missing baseline, unsafe actuation — these are constitutive failures that no amount of usefulness, confidence, speed, or aggregate performance offsets.
Reconstructability
No verdict is valid unless an independent, blinded reviewer can re-derive it from its record alone. Having a number is not the same as knowing where it came from.
Across all of our writing, claims carry their evidence status: an established result is stated plainly; a proposal under test is written as a proposal; an analogy is kept visibly an analogy; and an open question names the specific study or evidence that would settle it. We would rather say less, and mean it, than say more than the evidence allows.