Appendix D

The Living Doctrines: Mutation, Delegation, Time, and Capture

14 min read

The Twelve Articles describe the constitutional floor; the living doctrines describe how that floor survives time. They govern consent after mutation, delegation beyond specification, records beyond mercy, and institutions that become captive to the powers they were built to constrain. Each is an interpretive extension, not a replacement, and each operates through a defined receipt, an institutional remedy, and a falsification condition. This appendix specifies the operational machinery the essay companion does not.

The first three doctrines form the family of living consent: consent fails through mutation, delegation, and time, and each death has a corresponding artifact and remedy. The public statement of those three lives in the companion essay, The Doctrine of Living Consent, in the essays directory. The fourth doctrine, capture-resistance, governs a different relationship: not between persons and systems but between the framework's own organs and their own corruption. It has no parallel essay because the institutional decay doctrine is distinct in kind from the consent family. Its canonical statement lives here.

Each section follows the same structure: failure mode, required receipt, institutional remedy, falsifier, example. The discipline mirrors Appendix A's pattern and reuses its register.

Failure mode. A user consents to a system; the system materially changes; the operator continues to invoke the old consent to license processing under the new conditions. The pattern recurs at quarterly cadence. A platform adds an agentic layer that did not exist when the user clicked through. A model is retrained on a different objective and reused on the same data the user originally licensed. A company is acquired by an actor with incompatible interests and the consent travels with the data. The text of the agreement persists; the system the agreement described is gone.

Required receipt. The re-consent trigger artifact: a structured record that names the conditions under which the substrate has materially changed, surfaces the change to the user in language the user can evaluate, and either obtains a new agreement or stops processing the user's data under the old one. The artifact contains five fields: (1) the prior witnessed system-state, sufficiently described that the user can identify what she originally consented to; (2) the changed system-state, with named delta; (3) the trigger that fired (purpose drift, retraining on new objective, third-party expansion, retention extension, identity-resolution scope expansion, or interface change that alters evidentiary position); (4) the affected data and processing operations; (5) the response options, which must include both renewal and discontinuation, with default behavior specified.

Institutional remedy. A standing authority empowered to certify that material change has occurred and to enforce the trigger. In the framework's institutional architecture this is the Standard-Setting Body, with the Adjudicator providing review when the operator and the affected person disagree about whether a change is material. The Affected-Person Representative Body has audit-trigger and floor-objection powers over substrate changes that affect populations.

Falsifier. If systems update their consent flows in step with their substrate mutations and users in fact face few situations in which old consent is invoked to license substantially new processing, the doctrine has identified a litigation artifact rather than a structural failure mode. The empirical claim that supports the doctrine is that mutation outruns re-consent at scale, not that any single instance proves the pattern.

Worked example. A photo-sharing service obtains user consent in 2019 for "improving the service through machine learning." In 2023 the service is acquired by a firm whose business model depends on selling face-embedding models trained on the same photographs. Under the current architecture the original consent travels with the data, and the embeddings are sold without further user contact. Under the doctrine, the acquisition is a material change in third-party expansion and in deployed objective: the re-consent trigger fires; the operator must either obtain new consent for the new processing or delete the data and the models derived from it. The FTC reached this result, narrowly and through enforcement rather than doctrine, in Everalbum. The doctrine generalizes the result and makes it ex ante rather than ex post.

D.2 The Specification Horizon: The Delegation Doctrine

Failure mode. A principal deploys an agent under specified parameters. The agent encounters a situation the parameters did not anticipate. The agent extrapolates from the parameters to a decision, and the decision is treated downstream as the principal's. Hart's incomplete-contracts result applies with greater force to computational delegation than to human contracting, because the objective function is the contract and the specification horizon is where it runs out. The agent does not become disobedient. It becomes obedient to something the principal did not say.

Required receipt. The intent-gap receipt: a structured record issued when an agent's action crosses the specification horizon. The receipt contains five fields: (1) the specified intent, named and pinpointed in the principal's deployment configuration; (2) the gap, identifying the contingency the specification did not address; (3) the extrapolation, naming the inferred intent the agent acted under; (4) the chain of accountability, traceable to the human principal at the end of the delegation chain (the surviving principal); (5) the affected party's recourse, with named arbiter and timeline.

Institutional remedy. The Adjudicator, supported by domain-specific arbiters bonded against systematic bias. The arbiter reviews the extrapolation against the specified intent, the affected party's position, and the principal's documented deployment parameters. If the extrapolation falls outside the principal's actual intent, the Adjudicator reverses the action and assigns liability to the principal under the strict-deployer-liability rule in the constitutional materials. The Affected-Person Representative Body has standing to bring claims when extrapolations affect populations.

Falsifier. If sufficiently capable systems can internalize principal intent across novel contexts without an intent-gap receipt, and if the gap closes in practice rather than widening with capability, the doctrine has identified a transient engineering problem rather than a structural condition. The cooperative-inverse-reinforcement-learning research program suggests one path to closing the gap; the doctrine bets that the path produces narrower gaps but not zero gaps, and that the residual gap warrants constitutional architecture.

Worked example. A procurement agent operating under the principal's parameters "maintain soybean meal inventory at forty-five days of projected demand" commits to a shipment under conditions the parameters did not anticipate: a force-majeure event in a producing region creates a price spike, and the agent must decide whether the inventory target overrides the budget cap. The agent extrapolates from the principal's history of similar trade-offs and commits at the spike price. The intent-gap receipt records the gap (no rule for force-majeure pricing), the extrapolation (inventory target overrides budget cap), and the chain of accountability (back to the deploying business unit and ultimately the principal). When the family in Mato Grosso who relied on the supply chain experiences a downstream disruption, the receipt traces the consequence to its origin. The principal answers. The agent does not vanish into the cascade.

Technical receipt stack. The receipt format reuses standard provenance and attestation primitives rather than inventing new ones. The W3C Verifiable Credentials Data Model v2.0 provides the three-party issuer–holder–verifier model and the credential status and revocation mechanisms (w3cvc2024). IETF RFC 9334 specifies the attester / verifier / relying-party architecture and the freshness considerations any attestation must satisfy (Rfc 9334). RFC 9711 provides the Entity Attestation Token's formal claims model for attested state (Rfc 9711). The in-toto Attestation Framework supplies the predicate / statement / envelope layering that the intent-gap receipt's nested structure requires (intoto_attestation). Necula's Proof-Carrying Code is the deeper conceptual ancestor: a structured artifact accompanied by a checkable proof, with the burden of proof on the producer rather than the consumer (Necula 1997). The receipt's job is to translate these primitives into the doctrine's specific use: making delegation extrapolations legible without requiring re-execution of the agent's reasoning.

D.3 Temporal Sovereignty: The Time Doctrine

Failure mode. Records, permissions, and decisional claims persist beyond their legitimate temporal scope. The borrower's default at twenty-two governs the loan application at forty-two. The juvenile flag follows the adult into employment screening. The training-data permission continues to authorize the model a decade after the data was given, on a deployment surface that did not exist when the data was collected. The Court of Justice of the European Union recognized in Google Spain that lawful processing can become unlawful through the passage of time alone (Googlespain 2014). The recognition is doctrinally important and operationally narrow; the doctrine generalizes it.

Required receipt. The doctrine deploys three artifacts, not one, because time fails consent in three operationally distinct ways. (1) The sunset attestation: an automatic record issued when a person-record expires, naming the expiration date, the surviving aggregate (if any), and the authority to which the expiration is attested. (2) The deliberation-interval receipt: a record that a consequential decision was held for a defined period before execution to allow the affected person to inform herself and respond. (3) The resolution-decay receipt: a record that a record's resolution has been reduced (from individual to aggregate, from full detail to category-level) rather than deleted, with the audit trail preserved at the aggregate level.

Institutional remedy. A combination of standing authority and standing schedule. The Affected-Person Representative Body has sunset-review power over record-retention regimes and may compel adjudicatory review of any extension. Records of power (institutional decisions, coercive acts) do not decay; records of persons (individual conduct, status, scoring) do, on schedules calibrated to the harm the record can do and the time over which persons can plausibly become otherwise. The schedule is the political work; the doctrine specifies that there must be one.

Falsifier. If permanent records produce no pathology of permanent exclusion, if perfect memory is compatible with the conditions under which persons can become otherwise, then the doctrine has named sentiment rather than structure. The empirical claim is that monotone retention generates exclusion at thresholds the framework's coherence-cost model formally predicts, and that the prediction is verifiable against the credit-reporting, employment-screening, and immigration-screening contexts where retention regimes are already operationalized.

Worked example. A user's social-media archive from 2014 includes a political comment that becomes politically dangerous in 2034. Under the current architecture the comment persists in full detail, retrievable by any downstream consumer, indefinitely. Under temporal sovereignty the archive enters a resolution-decay schedule at year five and a sunset schedule at year ten: by 2034 the platform may report that the user posted in a defined topic category during a defined period, but may not surface the individual post to downstream consumers without a fresh consent flow that names the new purpose. The audit trail is preserved at aggregate level, so a researcher studying speech patterns in 2014 retains analytic access; the individual user does not bear the indefinite cost of a comment whose context has been lost.

D.4 Capture-Resistance: The Institutional Decay Doctrine

Failure mode. The framework's own organs become procedurally dependent on the entities they were constituted to constrain. The auditor's revenue depends on continued retention by the operator; the adjudicator's appointment depends on the regulator the operator helped staff; the standard-setting body's members hold commercial relationships with the operators whose conduct the standards are written to govern. The captured organ maintains the appearance of independence while serving partial interests. Capture is the path from Protocol Republic to Neo-Feudal Stack, not through dramatic seizure but through gradual drift. Stigler's classical diagnosis is that regulation tends to be acquired and operated for the benefit of the regulated; the doctrine treats that diagnosis as a structural prediction and designs against it.

Required receipt. The capture receipt: a formal record that a constitutional institution has crossed a defined threshold of procedural dependence on the entities it was constituted to constrain. The receipt is structurally analogous to a default in financial law: it does not by itself dissolve the institution, but it activates a defined cascade of remedies (fork-rights notice, emergency reconstitution procedures, meta-amendment limits) that would otherwise remain dormant.

Threshold indicators. The capture-receipt concept is analytically sharp and operationally fuzzy unless at least one measurable indicator is proposed. The framework names three candidate indicators, each with a falsification condition. The indicators are illustrative; the political work is to calibrate the thresholds against the specific institution being measured.

Indicator	Measure	Capture threshold
Audit-operator correlation	Rolling-window correlation between audit findings and operator self-reports	Exceeds 0.95 over a twelve-month window
Adjudication reversal floor	Percentage of adjudicatory outcomes that reverse operator actions	Falls below 3% sustained over twelve months when comparable peer institutions average 8–12%
Standard-setter independence	Percentage of standard-setting body members with current or prior commercial relationships with operators above the systemic-significance threshold	Exceeds 30%

The indicators do not need to be final. Naming them with falsification conditions makes capture-resistance implementable rather than aspirational, and signals that the doctrine is operationalizable in the same register as the receipt regime itself.

Institutional remedy. When a capture receipt is issued, three remedies activate. (1) Fork-rights notice: the affected population is formally notified that the institution's independence is impaired, and exit paths to alternative governance are documented. (2) Emergency reconstitution: the institution's appointment process is suspended and replaced by an emergency procedure that bypasses the captured channels (typically a combination of sortition, judicial review, and Affected-Person Representative Body nomination). (3) Meta-amendment freeze: rule changes proposed by the captured institution are held in suspension pending reconstitution, preventing the captured body from amending the rules in its captors' interest before being reconstituted.

Sarbanes-Oxley provides the canonical statutory anti-capture template: §101 creates the Public Company Accounting Oversight Board with structural independence from the audit firms it oversees; §201 prohibits certain non-audit services that would compromise auditor independence; §202 requires audit-committee preapproval for permitted services (Sox 2002). The EU AI Act provides the modern AI-specific precedent: Art. 31(6)–(12) requires notified-body independence and impartiality, mandatory declarations of interests, and conflict-management mechanisms (Aiact 2024). Both regimes acknowledge what the doctrine formalizes: independence is a structural condition that must be designed for, monitored against measurable indicators, and remedied through pre-committed mechanisms when the indicators trip.

Falsifier. If the framework's organs maintain their independence through institutional culture and individual virtue without requiring threshold indicators and reconstitution procedures, the doctrine has named a problem that does not arise in practice. The historical record across financial regulation, environmental regulation, and platform governance suggests the opposite, but the doctrine remains falsifiable: a constitutional architecture in which the organs systematically maintain independence without the capture-resistance machinery would refute the necessity of the machinery.

Worked example. The Adjudicator's annual reports show that adjudicatory reversals of a particular platform's actions have fallen from 11% (year one) to 7% (year two) to 4% (year three) to 2% (year four). Comparable peer adjudicators report sustained reversal rates between 8% and 12% over the same period. The audit-operator correlation has risen from 0.78 to 0.93 over the same window. The standard-setting body's most recent appointments include three former employees of the platform whose conduct the body's standards govern. A capture receipt is issued, naming the three indicators that have tripped. Fork-rights notice is delivered to the affected population. The Adjudicator's appointment process is suspended pending an emergency reconstitution procedure that excludes the platform's nominees. Rule changes the Adjudicator had proposed (narrowing the affected person's right to escalate, extending the operator's response window) are held in suspension. The platform's actions remain subject to adjudication, but the adjudicator answering for them is reconstituted before the rules are amended in the platform's favor.

Cross-References

The public canonical statement of the first three doctrines (mutation, delegation, time) is The Doctrine of Living Consent, in essays/doctrine-of-living-consent.md. That essay carries the doctrinal load. This appendix carries the operational specification. The division is: the essay answers why the doctrines exist; the appendix answers how the doctrines apply.

Capture-resistance has no parallel essay because it is institutional decay rather than personal consent. Its canonical statement lives in D.4 above. Persons read the essay to understand the doctrine's reach over their own systems; institutions read this appendix to implement the artifacts the doctrine requires.

The doctrines are interpretive extensions of the Twelve Articles, not amendments to them. The Articles describe the constitutional floor. The doctrines describe how that floor survives time, delegation, mutation, and the capture of the institutions charged with its enforcement.

D.1 Living Consent: The Mutation Doctrine

D.2 The Specification Horizon: The Delegation Doctrine

D.3 Temporal Sovereignty: The Time Doctrine

D.4 Capture-Resistance: The Institutional Decay Doctrine

Cross-References