The Constitutional Machine

#I. Coverage and Responsibility

The constitutional duties attach when practical dependency and computational determination coincide. Practical dependency exists when denial, delay, exclusion, or degradation at a service would impose a material loss that a reasonable substitute cannot timely cure. Computational determination exists when a rule, model, classification, or composed computational process materially determines, recommends, or executes the act.

Coverage is assessed act by act and does not depend on corporate form, public status, scale, or description. Scale may increase dependency and harm, but scale alone is not the jurisdictional test.

The same test applies to public and private authority. A regulator may be captured by the institutions it oversees. A private service may acquire sovereign effects where departure requires material forfeiture. Neither office nor contract answers whether refusal is practical.

The Operator is each entity responsible for a covered act. Where several entities materially contribute, each answers for duties within its control. If they cannot establish bounded contributions through inspectable records, their responsibility is joint. An adoption instrument may designate a lead principal to coordinate compliance, but the affected person need not reconstruct the combined system merely to identify a respondent.

Every delegation chain must identify a surviving principal with authority to constrain the system and answer after transient agents, services, or personnel cease to operate. An ownerless protocol or transient process cannot occupy that role alone. A party that deploys or integrates it, controls access to the covered passage, or derives authority from it must supply identifiable and durable answerability.

Coverage follows the combined effect of the act. Repeated omissions, delays, rankings, correlated low-severity acts, affiliates, or coordinated systems may not be divided to avoid a threshold that their aggregate effect satisfies.

#II. Receipt Architecture

A receipt records a coercive computational act in a form that supports review. It contains five fields:

Field	Required content	Function
Act	The decision, classification, restriction, denial, or state transition imposed	Identifies what occurred
Authority	The rule, policy, mandate, or delegated power invoked	Identifies the claimed power
Bounds	Scope, duration, reach, and affected services or identities	Defines the consequence
Justification	The material facts, evidence, and reasoning used	Makes the act evaluable
Appeal Path	Reviewer, procedure, deadline, and available relief	Makes contest practical

The Operator issues the receipt with the act. An emergency provisional receipt may state Act, Authority, and Bounds at once, with the remaining fields completed within forty-eight hours. Its status, omissions, deadline, and responsible official remain visible.

A field must identify the actual basis of the act. Generic policy language, an unapplied category, or possible reasons do not suffice. Material uncertainty must be disclosed without false precision.

The public, versioned schema states the date and time, stable identifier, responsible Operator and surviving principal, schema and materially relevant rule or model versions, decision mode, provenance of material inputs, material uncertainty, expiry or review date, and status of correction and appeal. It supplies an accessible human-readable form and an interoperable machine-readable representation sufficient for independent verification. Correction preserves the prior version, correcting party, authority, and change.

#Recourse and finality

Recourse is allocated by the kind of question presented. Mechanization reduces the cost of enforcing settled requirements. It does not enlarge what machines can decide.

Path	Trigger	Authorized consequence	Limit
Formal defect	Missing required field, expired authority, broken appeal route, or absent required attestation	Preserve evidence, toll deadlines, correct the record, and restore a prior state where the adopted rule has made that response safe and determinate	No conclusion about substantive legality
Observed cure	Bounded implementation failure with an undisputed governing rule	Operator correction within a published period under independent observation	Failure or dispute advances the matter
Systemic examination	Common fingerprints, audit predicates, missing-receipt patterns, severe incidents, or credible witness evidence	Aggregated independent audit and corrective findings	Auditor establishes facts but does not decide remedies
Adjudication	Novel interpretation, disputed systemic facts, proportionality, meaningful-review questions, or material individual differences	Reasoned judgment and effective remedy	Judgment remains attributable to an independent human Adjudicator

Low-severity acts that are readily reversible may proceed with a valid receipt and review path. A material but substantially reversible act may proceed provisionally only while the evidence and means of practical restoration remain available. A severe or materially irreversible act receives the independent human review required by Article 3 before final execution, except under the emergency rule. The deadline always shortens when delay would defeat the remedy.

Severity is assessed by cumulative effect. A sequence of related acts, omissions, delays, or rankings receives the review required by its aggregate consequence even when no component independently crosses the threshold. Any act satisfying the constitutional definition of a material adverse action receives independent human review regardless of its administrative label.

Machine-checkable evidence may establish that declared authority exists, versions are valid, fields are present, bounds have not expired, records are independently committed, and required attestations exist. It cannot establish factual truth, proportionality, practical substitutability, meaningful human judgment, nondiscrimination, or constitutional legitimacy. A formally conforming act remains contestable on those grounds.

#Human review and competence

Article 3 requires an independent human arbiter with relevant competence, time, evidence, authority to disagree, and protection against retaliation. The review receipt identifies the arbiter, evidence, tests, disposition, and material limitations.

Where substantive review cannot be distinguished from routine confirmation, the institution must narrow authority, reduce volume, increase capacity, or change the procedure until review becomes auditable.

#III. Temporal Use of Personal Records

Article 7 governs the present authority of personal records. It does not reduce the issue to deletion. Four questions remain separate: whether an event occurred, whether a record may be retained, who may access it and for what purpose, and whether it may materially contribute to a present adverse act. A record can remain accurate, retained, and accessible for a lawful purpose while losing presumptive authority in another decision.

Canonical construction of Article 7. After the applicable threshold, renewed adverse use requires fresh, purpose-specific justification and independent review.

Schedules are calibrated by record type, severity, present purpose, current evidence, affected-party interests, and narrowly specified safety, archival, investigatory, or adjudicative needs. After the threshold, non-use in adverse decisions is the default. The party seeking renewed use must show a present domain-specific nexus, explain why current evidence or a less restrictive means is inadequate, identify the duration, and obtain independent approval. Notice must precede the act where practicable. Protected investigative use may receive later notice under an independent and time-limited order.

Authorization permits only the stated use. It neither restarts the threshold nor restores general authority. The holder of the record may not unilaterally extend or suspend the threshold.

The rule follows functional reliance. An Operator may not evade it by routing a record through an affiliate, data broker, proxy, derived score, cached classification, embedding, or model output that contributes materially to the adverse act. The FTC's final Everalbum order required deletion of specified face embeddings and models or algorithms developed using covered biometric information. That was a case-specific remedy rather than a general rule.¹ The influence of individual data on trained systems can be difficult to trace, and machine-unlearning verification remains vulnerable to evasion.² Operators must preserve enough lineage for independent testing and disclose material uncertainty. No particular unlearning method is constitutionally prescribed.

Records of coercive authority are not entitled to the same temporal presumption. They persist to support public accountability, subject to lawful protections for personal data, security, and adjudicatory confidentiality. Public institutions may limit a record's future coercive use. They cannot forgive on behalf of a victim or community that has not done so.

#IV. Four Institutional Separations

Four separations prevent the same interest from creating the evidence, judging the evidence, and controlling the remedy.

#Issuer and Verifier

The credential issuer may not be its sole verifier. An independent path must permit assessment of authenticity, status, scope, and provenance without allowing the verifier to alter the claim. No named credential format is required.

#Operator and Auditor

The Operator may not control the Auditor's appointment, access, findings, compensation, or continued existence. The Auditor receives access adequate to test receipts, review, record custody, temporal use, portability, minimization, and composition. Controlled access may protect secrets but may not prevent a compliance finding.

#Rule-Maker and Adjudicator

The Standard-Setting Body writes prospective rules. The Adjudicator applies and interprets them in contested cases. The same person may not perform both functions in one matter. A later rule revision cannot reverse the judgment that prompted it.

#Credentialer and Identity Provider

A credentialer may not make continuing membership the exclusive means of proving identity or presenting an attestation. Public evaluation rules must permit presentment without the issuer's permission. They need not require every institution to accept every credential.

#V. Affected-Person Counterpower

Affected-person counterpower belongs to persons exposed to a covered act or rule through direct claims, common proceedings, claim-specific representation, prospective objections, and representative relief. Affectedness changes with the act, lineage, population, severity, and remedy. Permanent membership would give that changing relation incentives for institutional survival and jurisdictional expansion.

A valid receipt or independent exposure record establishes affectedness. Credible evidence of exposure with a materially defective or missing required receipt creates a rebuttable presumption and an independent duty to reconstruct the population. A finding by the Auditor or Adjudicator may also establish affectedness. A material-change receipt establishes prospective eligibility for persons credibly within the projected population to challenge the classification, seek audit, or request interim relief before an irreversible change.

Each affected person may contest, join or leave a common docket, delegate and timely revoke claim-specific representation, receive notice, seek individual relief, and object to closure. A mandate is non-transferable beyond the matter.

#Contest Registry

One or more interoperable Contest Registries may authenticate and administer recourse. No registry is a constitutional organ or final interpreter. An adoption must provide at least one accessible route that the Operator, registry provider, and assurance provider cannot unilaterally close.

Each contest record states stable contest and receipt identifiers; Operator and principal; act, passage, authority, and dates; schema, rule, model, and functional lineage; Article and claimed defect; severity, reversibility, exposure evidence, uncertainty, and requested remedy; representation mandate and revocation status; common-docket assignment; procedural status, decisions, deadlines, correction history, and appeal path; and an individual delta preserving material facts, consequences, substitutes, vulnerabilities, and remedies.

A decision rejecting, consolidating, prioritizing, severing, assigning a forum, applying precedent, or closing a contest issues a meta-receipt with the rule, evidence, reasons, version, result, correction procedure, and independent appeal. Registry rules are inspectable, versioned, tested for false negatives, independently recorded, and externally reviewable.

Privacy-preserving credentials or zero-knowledge proofs may establish exposure without public identification. They are optional means of authentication. They do not prove harm, unlawfulness, adequate representation, or the truth of a claim. Failure to satisfy an automated membership test remains reviewable on the ground that the test encoded the affected class incorrectly.

#Aggregation and precedent

Common dockets aggregate by authority, functional decision procedure, system lineage, failure mechanism, covered passage, and material factual predicates. Version strings alone neither compel nor defeat consolidation. Each underlying contest retains its individual delta, and the affected person may seek deconsolidation when that difference could alter liability, timing, or remedy.

An Operator may not evade an established common defect through version churn, personalization, affiliates, relabeling, or nominal pipeline changes. A successor system descended from a version found defective carries a rebuttable presumption of the same defect until the Operator shows that the relevant failure mechanism has been corrected.

A precedential disposition produces a reasoned opinion, a machine-readable statement of the holding, its factual and legal boundaries, a public conformance test where the defect is mechanically testable, a remedy template, material distinctions, and an expiry or reconsideration condition. An adverse systemic finding may create a rebuttable presumption for materially matched claims. A settlement creates no precedent. An exonerating finding does not bind absent persons without adequate representation, notice, and a demonstrated material match.

#Witness evidence and latent exposure

Employees, researchers, journalists, vendors, civil organizations, and other witnesses may submit credible evidence of a systemic defect. They may obtain preliminary examination or audit but may not control affected persons' claims, bind them, or claim their remedies.

The Auditor may act on random sampling, outcome discontinuities, missing-receipt patterns, abnormal withdrawal or abandonment, evidence of retaliation, divergence between declared and observed exposure, complaints concentrated among unusually sophisticated persons, or a single severe event. A low complaint rate is not evidence of low harm until access, notice, suppression, and retaliation have been examined.

#Temporary remedy panels

A temporary affected-person panel is constituted only when batch relief, settlement, or closure would bind or materially limit absent persons. An independent administrator uses stratified sortition among verified voluntary claimants and includes materially distinct groups. Members receive independent counsel, facilitation, expenses, and fixed compensation under a public schedule from the assurance mechanism. Compensation may not be paid directly by the Operator or vary with the outcome.

The panel reviews remedy design, notice, implementation, and closure and presents objections to the Adjudicator. It cannot decide merits, write rules, appoint officers, control a continuing budget, license systems, impose a stay, or extend its mandate. It dissolves after implementation review. Binding representative relief requires reasoned Adjudicator approval.

Only the Adjudicator may stay an operating rule or pipeline. A stay requires a reasoned order stating the evidence, scope, duration, interim protection, and route to expedited review.

#VI. The Three Constitutional Organs

The Standard-Setting Body defines schemas, interoperability profiles, thresholds, audit criteria, temporal-use schedules, and procedural rules. It publishes drafts, evidence, objections, reasons, versions, and review dates. It does not decide individual cases.

The Auditor examines compliance and system performance. It reports methods, findings, limits, uncertainty, and corrective deadlines. It does not write the governing rules for the matter audited or decide the affected person's remedy.

The Adjudicator decides contests, interprets the Articles, reviews exceptions, and supplies remedies authorized by the adopting instrument. It may receive technical assistance but remains responsible for the judgment and reasons.

Affected-person counterpower is a constitutional capacity rather than an organ. Contest Registries administer procedure and temporary panels participate in representative remedies; neither possesses rulemaking or adjudicatory authority.

The Operator is a regulated party. It may petition, answer, contest, and seek review. It does not vote as an organ. Courts and legislatures remain external backstops. Courts review judgments where jurisdiction exists. Legislatures may impose stronger rights, revise statutory institutions, or decline adoption.

#VII. Portability and Practical Exit

Export must preserve the structure, provenance, status, and relationships needed for a receiving system to evaluate identity, credentials, reputation, and context. Security and privacy limits must answer an identified risk.

Presentment and acceptance are distinct. A system is compatible when it implements a published interface or can evaluate the credential through reasonable technical adaptation. A compatible system must permit submission without the issuer's permission. The receiving institution may reject the credential under public rules governing provenance, validity, relevance, and current status. Self-declared incompatibility and rejection are covered acts when they govern a covered passage; each requires a receipt and review.

Practical exit requires switching procedures, service continuity, protection against retaliation, and disclosure of dependencies that cannot be ported. An unavailable alternative is not exit.

#Function-based necessity

Collection under Article 9 must identify the specific function requested by the person or the duty independently authorized by law. The Operator must use the least data-intensive reasonably effective means and state why a less intensive means would not perform the function with reasonable effectiveness. A broad service label, technical convenience, speculative future use, or a bundled secondary purpose does not establish necessity.

#VIII. Independent Record Assurance

Article 11 requires evidence of coercive acts to remain outside the Operator's unilateral control. Assurance is calibrated to the power constrained and the threat model.

Assurance	Suitable uses	Minimum properties
Standard	Lower-severity service and moderation receipts	Append-only history, independent replication, authenticated correction, periodic external audit
Heightened	Employment, housing, payment, and credential decisions	Multiparty custody or attestation, public consistency proofs or equivalent detection, tested recovery, separation from the Operator
High	Criminal justice, legal identity, systemic finance, and other exceptional powers	Several independent custodians, publicly detectable suppression or revision, durable recovery, and an external constraint costly to defeat in proportion to the authority recorded

The mechanism may use institutional replication, transparency logs, cryptographic commitments, multiparty attestation, independent archives, physically costly settlement, or another method that meets the required properties. A blockchain or proof-of-work system is neither required nor sufficient by name. The design must state the threat, the custodian set, the revision procedure, the detection method, the recovery path, and the consequence of compromise.

Integrity proves what was recorded, by whom, and how the record changed. It does not establish the truth of the underlying assertion. Objections, authenticated corrections, superseding status, and adjudicated findings remain linked to the original entry under the governing access and retention rules.

Independent-record failure model: the entity that controls the audit log can edit, suppress, or selectively disclose the evidence against itself. The remedy is an external verification and custody arrangement proportionate to the authority recorded.

#IX. Declared Rules and Formal Diagnosis

Article 8 requires a nameable and evaluable rule. For systems composed from declared conventions, the Operator must disclose the components, the mappings by which outputs cross boundaries, and the rule used to resolve disagreement. Formal local-to-global analysis may diagnose omitted compatibility requirements when the declared mappings satisfy the hypotheses of the chosen model.

That analysis does not infer an operative rule from opaque model weights, prove that a runtime act will fail, or establish that a disclosed convention is normatively justified. Register mappings are design choices. A seam or obstruction result is conditional on those mappings, the declared cover, and the mathematical assumptions. Where an opaque learned system materially contributes to a covered act, the Operator still owes an evaluable account of the procedure and principles actually applied. If the account cannot support contest, the unreadable output may not serve as the sole authority for coercion.

#X. Amendment and Emergency Operation

Any person or institution may petition for a technical calibration or constitutional amendment. A petition states the proposed change, reasons, affected rights and institutions, evidence, expected consequences, and transition rule. A calibration within delegated bounds requires public notice, a defined objection period, a reasoned response to substantive objections, and a two-thirds vote of the Standard-Setting Body. An objection that the change exceeds delegated bounds or weakens the constitutional floor is reviewable by the Adjudicator and may support a reasoned interim order.

An amendment to an Article requires the same notice and response, approval by two-thirds of the Standard-Setting Body, and ratification through the lawful procedure of the constituting authority that adopted the Constitution. If a private constituting authority is controlled by the covered Operator and practical exit is unavailable, ratification also requires matter-specific approval through an independently administered process open to authenticated affected persons. The adoption instrument states the quorum, voting rule, privacy protections, and treatment of materially distinct groups. The Auditor and Adjudicator may advise but do not vote.

An Operator may request an emergency exception by identifying the threat, provisions affected, scope, duration, evidence, and review channel. An independent authority designated by the adopting instrument authorizes the exception. Immediate action necessary to prevent imminent material harm requires a provisional receipt and independent authorization within forty-eight hours. The Adjudicator promptly reviews the exception.

Every emergency act receives a receipt. Any secrecy is separately justified, independently ordered, and time-limited. Articles 1, 2, 3, and 10 remain in force. Operational failure may move duties to a degraded channel but does not extinguish them. An exception expires after ninety days unless renewed through the amendment process.

#XI. Public Performance and Capture Controls

Each organ and recourse provider publishes measures sufficient to reveal whether the constitutional procedures work in practice. Measures include receipt completeness, registry rejection and severance, review volume, median and tail deadlines, rates of reversal and modification, interim-relief use, audit findings, repeated rule failures, portability completion, rejected presentments, temporal-use exceptions, record corrections, emergency invocations, and unresolved remedies. Publication protects personal data and legitimate security interests while preserving enough structure for independent analysis.

Performance measures do not determine whether an individual act was lawful. They identify patterns requiring audit, rule revision, funding changes, or common proceedings. A low reversal or complaint rate may indicate accurate initial decisions, inaccessible review, missing receipts, weak remedies, retaliation, or captured adjudication. The Auditor must examine access and incentives before treating any metric as evidence of compliance.

Capture controls apply to appointment, funding, information access, career incentives, and review. Each organ publishes conflicts, recusals, funding sources, appointment terms, removal standards, and material contacts with covered Operators. Rotating appointments and cooling-off periods may reduce dependence, but no single device establishes independence. The operative test is whether the institution can obtain evidence, reach an adverse conclusion, impose or seek a remedy, and survive the loss of an Operator's favor.

Each disclosure is versioned, retained, and available to the Auditor, affected persons through lawful access procedures, and any court with jurisdiction.

#XII. Adoption and Verification

An adoption instrument identifies the institutions assigned to each organ, the constituting authority, nomination and appointment procedures, confirmation where required, removal standards, initial and staggered terms, interim authority, succession, quorum and voting rules, compensation, conflicts, confidentiality and transparency duties, the interoperable recourse systems, the Operators and acts covered, data-access authority, transition periods, and relationship to stronger law. Its funding mechanism must be insulated from the unilateral control of any reviewed Operator.

Valid adoption supplies a solvent remedy path proportionate to the authority exercised. The mechanism may use an independently custodied reserve, bond, mutual pool, insurance, public appropriation, or a combination. Smaller Operators may pool assurance. The mechanism funds audits, adjudication, temporary-panel participation, restoration, and continuity when an Operator fails. No affected person pays for access to the constitutional minimum.

An assurance provider may price and finance risk. It may not determine standing, select the Adjudicator, control an audit, interpret the Articles, suppress a claim, or settle away non-waivable correction. Contributions may consider independently verified exposure, severity, reversibility, concentration, missing receipts, sampled violation rates, correction performance, and retaliation. Complaint counts alone are insufficient because the Operator may influence whether complaints are possible.

Valid adoption supplies a minimum remedial package: timely interim relief; correction; reversal, modification, or remand; restoration where practicable; evidence preservation and controlled access; protection against retaliation; and a direct claim in a designated independent forum. Representative action supplements rather than displaces individual invocation. Compliance with the Articles does not validate discrimination, fraud, retaliation, arbitrariness, or another unlawful act, and stronger substantive or procedural rights remain available. A private adoption may not make the forum or remedy withdrawable at the Operator's discretion.

Partial adoption is stated article by article. The adopter must not use a general claim of constitutional compliance where material articles or institutions are absent. Receipts and credentials carry adoption provenance so a receiving party can determine the rights, schema, record assurance, and review process that governed them.

Implementation is verified through receipts, appeals, audits, amendment records, emergency records, and public performance measures. A constitutional obligation that leaves no inspectable trace cannot be distinguished from an aspiration. The record must therefore show who exercised power, under which rule, against whom, for how long, subject to which review, and with what result.

#Notes

1. Federal Trade Commission, In the Matter of Everalbum, Inc., Decision and Order, Docket No. C-4743 (May 6, 2021), Definitions paragraphs 1 and 5-6 and Part III.B-C. The remedy reached specified face embeddings and affected work product developed using covered biometric information. ↩

2. Binchi Zhang, Zihan Chen, Cong Shen, and Jundong Li, "Verification of Machine Unlearning is Fragile," Proceedings of the 41st International Conference on Machine Learning, PMLR 235 (2024), pp. 58717-58738. The paper demonstrates adversarial evasion of several verification strategies; it supports caution about proof of removal, not a claim that removal is impossible. ↩