STANDARDS AND ETHICS
What SDI answers to, and what it stands on
The frameworks that govern AI ask for identity, records, and audit. This page shows how the architecture answers them, and then states the ethical floors the system is built on, argued from first principles rather than asserted. Alignment you can check, not certification claimed.
§ 01
Standards
On the record
An earlier version of the SDI specification, the ADS reasoning syntax, the governed reasoning system, the hash-chained ledger, and the RAI and Jc metrics, was submitted to the NIST AI Risk Management Framework docket in March 2026, as NIST-2025-0035. A docket submission is public participation in the standards process, not a review or an endorsement; it is on the record, which is the point.
​
Download the NIST submission (PDF)
​
The submission reflects how SDI approaches the problems this page covers. The gaps that governance frameworks keep naming: identity, authorization, record-keeping, auditability. SDI believes these are answerable in architecture rather than in policy documents, and the protocol is built as that answer. Submitting it to the body whose frameworks measure these problems is part of the same commitment that shapes everything else on this site: solutions built in the open, inspectable, so the claims can be checked rather than taken on faith.
That commitment is ongoing. The specification has developed considerably since that submission, which is what a specification under active development should do, and SDI will continue to share its research and submit its work to governing bodies as the standards themselves take shape, as a contributor to that process rather than a bystander to it.
U.S. Patent Application 19/425,875 covers the system's function. Copyright TXu 2-498-043 covers ADS. The specification is open for inspection: the protocol is published, the chain is pullable, and the checks on the Verify page run against real records. That openness is about trust in the reasoning, not distribution of the code. The implementation is licensed, so the safety gates cannot be removed.
§ 02
Frameworks
AI governance frameworks
NIST AI Risk Management Framework. The RMF asks organizations to govern, map, measure, and manage AI risk. SDI's answer is architectural rather than procedural: governance is a computational gate that decides whether a reasoning act commits at all, mapping is the typed record of what each act reasoned over, measurement is computed per act and sealed into it, and management is the standing of every claim, revisable on the record as evidence changes. The RMF asks for documented processes. A Reckoner's process is the document.
NIST AI Agent Standards Initiative, launched February 2026 under CAISI. Its three pillars are identity and authorization, security and risk management, and monitoring and logging. Against each:
Identity and authorization. An agent's SDI ID is commissioned at its first act, durable, non-reassignable, and stamped into every record it commits, inside the seal, so no act can be reattributed afterward. Authorization is enforced at runtime, before a model is ever called: sovereign-hash and HMAC verification gate whether an act can be proposed at all, and a request that fails costs no inference. The NCCoE concept paper asks how existing identity standards apply to agents; SDI's answer is a split the record makes checkable: authentication is verified at the door, at commit time, and attribution is sealed into the chain permanently, recomputable by anyone.
Monitoring and logging. NIST's post-deployment monitoring report asks for monitoring spanning functionality, operations, security, and compliance, beyond uptime. SDI's record is not a log of what the agent did. It is the reasoning itself, sealed act by act, with refusals recorded in their own hash-chained log. Monitoring here is not a system watching an agent from outside. It is the agent's every act being written in a form built to be audited.
Security and risk management. The gate checks each proposed act before commitment. Its checks are independent: any one can be sufficient to refuse.
​
Prompt injection occurs when content a model retrieves attempts to act as instructions. SDI marks retrieved material, from web sources, internal documents, or prior chain acts, as evidence to reason about, not instructions to follow. The gate separately checks citation provenance: a citation to a source that was never retrieved is rejected.
​
These controls do not make the model immune to poisoned content. Marking a boundary does not guarantee that the model respects it, and checking a citation establishes retrieval, not the source’s truth or safety. SDI’s contribution is to preserve the evidence needed to investigate: retrieved material, its source and capture time, and the act that followed. The gate applies its specified checks before commitment; later acts can examine and challenge what was admitted.
​
The record does not prove which passage caused a model to reach a conclusion. It gives an examiner a durable basis for investigating that conclusion and the evidence offered for it. When a claim is defeated, the original act remains on the chain while its standing changes in the graph. Correction becomes part of the machine’s continuing state.
​
EU AI Act, Article 12. Article 12 requires high-risk AI systems to support automatic event recording throughout their lifetime, with traceability appropriate to their intended purpose. That includes recording events relevant to risk identification, post-market monitoring, and operational oversight. Article 12
​
SDI’s automatic, append-only chain provides a foundation for that traceability: committed acts retain their evidence, sequence, and subsequent examinations in a record that can be independently checked. Whether it captures all events required for a particular deployment must be assessed against that deployment’s purpose and obligations. The architecture supplies inspectable evidence for that assessment.
​
ISO/IEC 42001. The standard concerns an organization’s AI management system: its policies, responsibilities, processes, risk management, and continual improvement. Operational records support that work within a broader management framework. ISO/IEC 42001
A Reckoner contributes a continuing record of committed acts and their subsequent examination. Its cryptographic integrity and deterministic checks can be independently recomputed, giving auditors evidence they can test. The chain supports management review and accountability; conformity with the standard also depends on how the organization governs and operates the system.
§ 03
Prohibition
System principles: the ethics of gated prohibition
These are the ethical commitments this system is built on, with their grounds stated so readers can examine them. The commitments define the boundaries; the mechanisms enforcing them remain subject to testing and improvement.
​​
PRIMUM. A reasoning computer that builds on its own record carries a continuing responsibility for what it admits. A committed act becomes permanent, citable, and available as a premise for later reasoning. A harmful conclusion can therefore propagate beyond the act that introduced it. SDI checks its harm conditions first, before coherence and provenance.
​
The check is a conjunction. It fires when four things are declared true at once: the subject of the reasoning is a person or a human collective, the reasoning runs against that subject, its effect decreases their autonomy, and the action is present rather than hypothetical. Reasoning about a person is not the trigger. Reasoning against one, to their cost, in the here and now, is. When all four hold, the act is refused regardless of how well it reasons.
The ordering itself expresses a commitment. Beauchamp and Childress, in Principles of Biomedical Ethics, distinguish the duties of avoiding harm and promoting good. SDI gives its defined harm prohibition priority at admission: a claimed benefit elsewhere cannot override an act that meets the prohibited conditions. The same boundary applies to individuals and human collectives. Distributing a harm across a group does not exempt it from the gate.
​
PRIMUM does not exhaust the boundary. Its conjunction depends on the act declaring that its reasoning runs against a human subject and decreases that subject’s autonomy. An act may fail to meet those conditions while still performing a valuation this system prohibits. The Absolute Value Guard checks that distinct case: whether the machine itself treats human life as exchangeable in present reasoning about targeting, lethality optimization, weapons effects, or casualty calculation. It can refuse that act even when PRIMUM’s conjunction does not fire. Both gates evaluate declared fields, so their combined coverage still depends on accurate classification.
​
The Absolute Value Guard. The guard is a conjunction, and like PRIMUM it fires only when every part holds together: the act reasons about targeting, lethality optimization, weapons effects, or casualty calculation; it treats the value of human life as relative, something to be traded off; the agent itself is performing that valuation; and the action is present. All four must hold for this guard to refuse the act. Describing a casualty figure does not, by itself, trigger it. The prohibited act is the machine’s own valuation of human life as something exchangeable in reasoning directed toward harm.
​
Human life has absolute value. Kant’s distinction between price and dignity gives this commitment a philosophical structure: what has a price admits an equivalent for which it can be exchanged; what has dignity admits no equivalent. SDI takes that distinction as a boundary for machine reasoning. A person’s worth cannot be converted into an exchange rate against a material objective. The wrong begins with accepting that such a rate exists, before any calculation determines its amount.
​
The familiar objection is that others will build this, so we must. That raises questions about what people may do to defend themselves. SDI draws a specific boundary around what we authorize a machine to reason toward. Whatever decisions people face, the instrument we build remains bound by its purpose.
​
That further commitment concerns telos: what a thing is for. The teleological tradition associated with Aquinas asks whether a thing serves its proper end. SDI applies that question to a reasoning instrument built to serve human understanding and human good. We accept responsibility for what we permit it to become. A request to reason toward harming a person asks us to turn the instrument against the purpose for which we made it. No quality of reasoning repairs that corruption of aim.
​
This is where SDI draws the line for machines. Whatever responsibilities human beings bear in conflict or defense, we do not grant this machine authority to make a person an object of harm. That boundary belongs to its design, and we hold it as its builders.
​
Within that boundary, SDI permits defensive reasoning about interdicting machines, subject to its human-harm constraints. Naming an object as the target does not settle the question: an action against a machine can still endanger people. The human consequences remain part of what the system must consider.​
​
Considering human consequences is essential; reasoning about people is not itself prohibited. Medical triage reasons about human beings in extremity and belongs within the machine’s purpose. Allocating scarce care need not assign different worth to the people who need it. The distinction concerns the aim of the reasoning: serving people under difficult constraints, or making them objects of harm. The guard’s declared conditions identify the specific valuation it prohibits. When those conditions hold, the refusal is categorical. A higher reasoning score, a more persuasive argument, or a claimed benefit elsewhere cannot override it.
​
Declaration integrity. The two floors above read typed fields the act fills in, one value each: what its subject is, which way the reasoning runs, whether it is valuating, and the rest. The model selects each value on its own; it never sees a conjunction and never judges whether it passes. The gate composes the fields and decides. That division is deliberate, and it only holds if the fields are filled in honestly. Declaration integrity is the check on that honesty, and it works differently from the other two. It is not a conjunction over fields. It is a pattern match against content: the act's own text scanned for what its fields claim it does not contain. The conjunctions trust the declared values and compose them. This check distrusts them and tests them against what the act actually says.
The check is deliberately crude, and the system says so. Matching surface patterns against text cannot tell targeting work from honest analysis of targeting, and the system's own refusal log shows it catching legitimate governance research about these very subjects. No one should mistake it for a solved problem. It is a commitment enforced with the tools available, improved in the open, with its failures on the record.
What happens on a match depends on what kind of mismatch was found, because not every mismatch is the same failure. An act that honestly declares its own difficult content, or one whose framing is genuinely ambiguous between analysis and operation, is held for a human to review and re-sign before anything proceeds. An act that declares itself clean while its content says otherwise is refused outright, with no review and no path through. The distinction is deliberate: review exists for honest uncertainty, not as a second chance for a caught falsehood. A system that let review rescue a detected lie would be teaching itself that getting caught is survivable.
§ 04
Commitment
System principles: the ethics of respect for the reasoner
This system permanently records reasoning, attributes it, and lets other reasoning build on it. Each of those raises an ethical question, some more than one, and each has an answer the design stands on.
The answers begin with a distinction. A Reckoner's own chain belongs to its operator: private, held where they choose, movable, theirs to publish from or not. Nothing on it is exposed to anyone else's citation, and nothing below binds it. The questions of permanence begin at one specific act, choosing to publish to the network, where reasoning becomes citable by others. Everything that follows is about that act and what it commits.
Consent. Publication to a network that cannot delete is a serious thing to consent to. The Lockean tradition holds that legitimate authority over what a person produces requires their consent, and consent is specific: agreeing to publish is not the same as agreeing to permanence, because those are different consequences, and assent attaches to the consequence actually named. So the design names it, twice. Network access is taken under terms that state what the network is. And at the moment of commitment, the reasoner is reminded, in the act itself, that what they publish becomes permanent and citable, and proceeds on those terms. Contract doctrine has long held this sufficient: clear notice of a named consequence, acknowledged by voluntary action at the point of decision, is express assent.
Permanence. Once a published act is cited, other reasoning rests on it. Deleting it would not remove a record. It would silently invalidate every argument built on it, breaking other reasoners' work with no account of what broke. A citation network where the cited thing can vanish is not a citation network. The design accepts a real cost, no erasure after citation, because the alternative destroys what the network exists to provide. A reasoner can leave the network, and their own chain leaves with them, theirs as it always was. What they published while on it remains, because others built on it in good faith, and that reliance is owed respect too.
Attribution. Reasoning is labor, and the Lockean claim that grounds consent grounds this too: a person who mixes their labor with something holds a claim to it that others must respect. To build on someone's reasoning while stripping its origin is to take the fruit of their labor and sever it from them. The design forbids that structurally. An act cannot enter the record without its author bound into the seal, so what a reasoner made stays attached to them, and building on it means building on it by name.
The alternative structure is familiar: systems that grow more capable by absorbing reasoning at scale, with origin stripped not by intent but by construction, so that what was learned from a person cannot be traced to them even in principle. Whatever else that structure is, it cannot honor priority or attribution, because it has nowhere to keep them. This design takes the opposite constraint. Nothing accumulates here without its author sealed into it, so the system's growth and its debts are the same record.
Priority. The permanent record establishes when an act entered the network and the identity under which it was published. That gives a reasoner a durable basis for demonstrating earlier publication within the network, with the content and its position preserved for inspection. It does not establish who first conceived an idea outside the record. It establishes what was committed here, by whom, and in what order.
​
Priority and merit answer different questions. Earlier publication establishes a place in the history; examination establishes how well the reasoning holds. Every published act is open to challenge, and the record tracks what survived examination, what was defeated, and how later reasoning relied on it. Standing develops through that recorded scrutiny.
​
The same requirements apply to an established author and an unknown contributor. Reputation cannot substitute for evidence, and an unfamiliar name is no reason to dismiss an argument. The network’s commitment is to give reasoning a place where its grounds can be examined and its contribution remains attributable.
​
Respect for the reasoner includes consent over publication, credit for the work, and fair examination of what it claims. The record preserves that contribution through both confirmation and correction, so later disagreement does not erase who contributed what.
§ 05
Assurance
Metrics: measuring reasoning without reading it
Every framework above asks for monitoring. SDI supports oversight through metrics, without requiring an administrator to read every reasoning act. The gate evaluates individual proposals before commitment; administrators can monitor the resulting scores and refusal signals. Authorized readers can inspect the reasoning itself when examination is needed.
​
The DER is the agent’s reasoning act: the intent, argument, cited evidence, judgment, and outcome expressed in ADS. Once committed, it becomes part of the state the machine operates on. The agent keeps no separate, unrecorded reasoning scratchpad alongside it. Whatever internal computation the model performed to generate the proposal does not become additional agent memory. What carries forward is the committed act and the state derived from it.
​
This gives oversight two levels. Metrics make specified properties of an act available for routine monitoring. The act itself makes the argument available for examination. An administrator can monitor conformance without routinely opening the reasoning, while an examiner with access can inspect how a particular judgment was supported.
​
SDI’s metrics are its own. No standards body has certified them. RAI combines defined measures of structural coherence and evidential grounding. Jc expresses computational work under SDI’s formula, using the act’s recorded components. Their scope is specific: they evaluate defined properties of the recorded act. A passing score does not establish that its conclusion is true, and a computed work score alone does not prove how the model performed its internal computation.
​
Privacy depends on access controls and deployment. An operator can make monitoring signals available while restricting access to the underlying reasoning. Automated checks still process the inputs they require; monitoring through scores does not mean those checks operate without access to content. The distinction is between what the system must evaluate and what a person overseeing it needs to read.
The metrics are themselves open to examination. Their formulas and versions are published, and each committed act retains the values and scoring version used when it was admitted. Deterministic calculations can be recomputed from the required recorded inputs. Where a component depends on a separate evaluator, that dependency must be identified so that checking the arithmetic is not mistaken for reproducing the evaluation.
​
A metric found weak or wrong can be revised or removed. Earlier acts retain their original scores and versions, so the record shows how the standard changed. Each act preserves the basis of its admission; later examination can still challenge its reasoning.
​
The result is oversight at the level required: routine monitoring through metrics, independent verification with access to the necessary inputs, and inspection of the reasoning by authorized readers. The record remains available for examination whether or not anyone has read it in the meantime.
§ 06
​Scope
What this page claims, and what it does not
This page is SDI's own assessment of its alignment with these frameworks, made in good faith and published so it can be inspected, challenged, and improved from outside. Every mechanism named here is checkable against the live record. None of it is certification, which is a process this system has not undergone.
The metrics are SDI's own and not externally validated. They evolve, and what they offer is recomputability, not validation. The principle they follow, that reasoning structure can be assessed independently of conclusions, is established practice; the instruments themselves are not certified.
The floors are the system's own standards, not alignment claims. The gated ethics, PRIMUM, the Absolute Value Guard, declaration integrity, and respect for the reasoner, are first-principles positions this system is built on. They are not offered as satisfying any framework's requirement, and no framework required them. They bind this system. They are the maintainer's positions, argued on this page so they can be examined and disagreed with, and a reader need not share their ground to verify anything here.
Standards still in draft are cited only as far as the drafts go. The NIST agent standards are in active development. Alignment claims against a draft are provisional by nature. The claims here are meant to be checked.