Appendix D

The Twelve Articles state a constitutional floor. These doctrines address four ways that an initially valid arrangement can cease to satisfy it: the system changes, delegated authority outruns its mandate, an old record acquires a new adverse use, or an oversight institution becomes dependent on the party it is meant to constrain.

Each doctrine identifies a failure mode, the records required to make it contestable, the institution able to supply a remedy, and evidence that would count against the doctrine. None can be certified by its own receipt. The final judgment remains institutional and revisable.

---

D.1 Living Consent: The Mutation Doctrine

Failure mode. A person agrees to one system and the operator later invokes that agreement for a materially different purpose, party, objective, retention period, identity relation, or decision surface. The text of the agreement may remain unchanged while the practical relation it described has disappeared.

Ordinary maintenance does not require constant re-consent. A security patch, performance improvement, or model update can leave the governed purpose and consequence materially intact. Mutation becomes constitutional when the change alters what is done with a person's data, who may use it, which consequential decisions it supports, what exposure it creates, or which practical route remains for refusal.

Required record. A material-change record links:

1. the witnessed prior state and authority
2. the proposed state
3. the relevant delta in purpose, party, objective, retention, identity resolution, or consequence
4. the affected data and people
5. the operator's classification of materiality and uncertainty
6. the proposed effective date
7. the response options and default behavior
8. the surviving principal; and
9. the correction lineage for decisions already made under the new state.

The record is prospective where feasible. It provides enough detail for affected people and independent reviewers to test whether the claimed continuity is real. A missing required record creates a rebuttable presumption against the operator; it does not erase the underlying evidence or decide every merits question automatically.

Institutional response. A standard-setting body can define domain-specific material-change factors after notice, an objection period, reasoned response, and the body's declared amendment procedure. An auditor can test whether operators are detecting and disclosing the changes that meet those factors. An adjudicator can decide a contested case and order notice, cessation, rollback, deletion or restricted use, renewed authorization, correction, or compensation where law permits.

Consent is not always the lawful basis for processing, and renewed consent is not always the remedy. Public duties, contract, vital interests, or other law may authorize continued processing. The doctrine requires the operator to name that authority instead of carrying old consent into a new relation by inertia.

Handback and discontinuation. If the person refuses the changed relation, the system should identify what can be exported, which active commitments remain, how credentials and correction history travel, and what data must be retained for lawful accountability. Discontinuation should not be made punitive merely to manufacture consent, though a service need not preserve a function that genuinely depends on the refused processing.

Falsifier. The doctrine would lose force if observed systems reliably treated material changes as new constitutional events, supplied usable refusal or alternative authority, and produced little evidence of adverse action based on silent purpose or party drift. Evidence that users clicked new terms would not alone falsify the problem; the relevant question is whether the changed relation became intelligible and practically contestable.

---

D.2 The Specification Horizon: The Delegation Doctrine

Failure mode. A principal grants authority to an agent or service under a bounded objective. The delegate encounters a contingency outside the specification and extrapolates. Downstream institutions treat the result as the principal's act even though the principal did not decide the unresolved tradeoff and the delegate cannot bear the resulting obligation.

The specification horizon exists in human and computational delegation. Greater model capability may narrow some gaps while creating a wider range of consequential acts that can occur before a principal notices. The doctrine does not presume that every novel act is unauthorized. It requires the extrapolation and the party answerable for it to remain visible.

Required record. An intent-gap record identifies:

1. the grant of authority and its version
2. the act proposed or taken
3. the contingency absent from the grant
4. the extrapolation and evidence used
5. material uncertainty and alternatives rejected
6. the affected parties
7. the surviving principal
8. any emergency authority
9. the contest route; and
10. the handback state.

The record should be issued before irreversible execution when the gap is detected in time. When detection occurs later, the record is marked as reconstructed and identifies the evidence missing from the moment of action.

The technical form can reuse existing provenance and attestation primitives. The W3C Verifiable Credentials Data Model v2.0 supplies an issuer-holder-verifier model and credential-status mechanisms. ¹ IETF RFC 9334 distinguishes attesters, verifiers, and relying parties and emphasizes freshness. ² RFC 9711 specifies claims for entity attestation tokens. ³ The in-toto Attestation Framework separates statements, predicates, and envelopes. ⁴ Proof-Carrying Code supplies the deeper pattern of a producer carrying checkable evidence for a declared safety proposition. ⁵ None of these standards determines which extrapolation is legitimate or which principal should answer.

Institutional response. The relevant forum can stay an uncompleted act, interpret the mandate, restore the affected party, assign contractual or legal responsibility, require a new authorization, and direct changes to the delegation boundary. Liability follows the applicable law and allocation of control; the doctrine does not impose one universal strict-liability rule.

Population-level patterns may justify systemic audit even where individual extrapolations appear reasonable. A recurring gap can show that the nominal exception has become the actual operating rule.

Handback. The principal must be able to resume meaningful control. Handback includes active matters, deadlines, credentials, receipts, evidence, correction lineage, unresolved liabilities, and the ability to continue through another delegate. A revocation button that strands these objects is termination without return.

The delegate may have created obligations that cannot simply be revoked. Handback therefore distinguishes future authority from surviving commitments. It also identifies which affected nonparties retain standing after the principal and delegate have ended their own relationship.

Falsifier. The doctrine would be weakened if deployed delegates consistently operated within sufficiently complete mandates across novel conditions, produced no material class of unattributed extrapolations, and allowed practical handback without lost standing or unresolved commitments. Improved prediction of principal preference is relevant evidence, but it does not close the doctrine while consequential authority still lacks an answerable principal.

---

D.3 Temporal Sovereignty: The Time Doctrine

Failure mode. A true record remains available and is used for a new adverse act after its original temporal and domain-specific justification has expired. The problem is not that the past becomes false. It is that truth, retention, access, and authority to use are treated as one permission.

The governing definition remains exact:

The Mercy Threshold is the point at which a true record must cease to determine a person's future automatically. It is implemented through designed forgetting and through judgment by an institution that can be named, challenged, and made to answer.

This is the relevant boundary of Article 7:

7. Right to time-bounded personal records. The right to become someone new is constitutionally protected. Evidence that coercive authority acted must remain durable, but personal information within or supporting that evidence remains subject to lawful minimization, sealing, restricted access, and limits on later adverse use.

Canonical construction of Article 7. After the applicable threshold, renewed adverse use requires fresh, purpose-specific justification and independent review.

The distinction separates four questions:

1. Did the event occur?
2. May the record be retained?
3. Who may access it now?
4. May it support this present adverse act?

A record can remain historically true while the answer to the fourth question changes. Evidence that coercive authority acted may need to endure for accountability even when personal material within that evidence is minimized, sealed, access-restricted, or denied authority in a later decision.

Required records. Temporal jurisdiction uses several linked artifacts rather than a single expiration flag:

• a retention and access schedule tied to data class and purpose
• a sunset or sealing event stating what changed and under which authority
• a record of aggregation or resolution reduction where individual detail is no longer needed
• a correction lineage that follows derived scores, cached classifications, affiliates, and downstream recipients where traceable
• a fresh-use record for renewed adverse reliance after the applicable threshold; and
• an independent decision stating purpose, present nexus, less restrictive alternatives, duration, notice, and appeal.

The fresh-use decision permits only the stated use. It neither restarts the threshold nor restores the record's authority in other domains. Fresh probability drift, hidden influence inside a trained model, and foreclosure produced without any expired input remain outside that answer. Where the contribution of an old record to a trained system cannot be isolated, the institution must disclose the uncertainty and support independent testing; no particular unlearning method is constitutionally prescribed.

Institutional response. Ordinary release should be governed by declared schedules rather than favors. An authority seeking renewed adverse use bears the burden of present, purpose-specific justification. Independent review should be available before the act where practicable, with prompt later notice for a lawfully protected emergency or investigation subject to a time-limited order.

Public release and moral forgiveness remain distinct. Expiration, sealing, restored eligibility, and non-use rules determine what an institution may do. No public office can forgive on behalf of a person or community that bore the wrong.

United States constitutional law offers a limited procedural analogy. In United States v. Booker (2005), the Supreme Court held that the Sixth Amendment prohibited increasing a sentence under mandatory Federal Sentencing Guidelines on the basis of facts found by a judge rather than a jury; a separate remedial majority made the Guidelines advisory. ⁶ The analogy concerns the authority required to establish facts that increase punishment, not a general constitutional right to merciful human judgment.

Falsifier. The doctrine would be weakened by evidence that indefinite, cross-domain availability of personal records produces no durable exclusion, that affected people retain practical routes to become otherwise, and that fresh adverse uses are reliably justified without a temporal burden rule. It would also require revision if a domain demonstrated that a longer or shorter schedule better protects present victims, public safety, adjudication, research, or historical accountability. No universal numerical threshold follows from the doctrine.

---

D.4 Institutional Independence: The Oversight Doctrine

Failure mode. An auditor, adjudicator, standard setter, or delegated public office becomes dependent on the institution it is meant to constrain. Dependence may arise through funding, appointment, removal, information, professional culture, future employment, technical infrastructure, or retaliation. Formal procedures continue and reports remain complete while the oversight body loses the practical capacity to resist.

Delegated aviation certification illustrates the relationship without standing as a universal analogy. The Federal Aviation Administration's Organization Designation Authorization program permits approved organizations to perform specified certification functions on the agency's behalf. The governing structure requires ODA unit members to possess authority to perform those functions without interference and leaves the FAA responsible for oversight. ⁷ The Section 103 expert panel's review of Boeing examined safety culture, safety-management processes, and the ODA relationship, demonstrating why delegated expertise cannot be treated as independence by declaration. ⁸

The lesson is not that delegation necessarily fails. Public regulators often need information and expertise located inside the regulated organization. The constitutional issue is whether the delegating authority can see, test, limit, and reclaim the function when organizational dependence distorts it.

Required records. Independence is assessed through relationships, not certified by a capture receipt. The oversight system should disclose and preserve:

• legal authority, delegated functions, and retained public functions
• funding sources and budget control
• nomination, appointment, term, removal, and succession rules
• current and recent financial, employment, advisory, and family conflicts
• information sources and material reliance on operator-supplied evidence
• communications concerning scope, staffing, findings, and publication
• recusals, dissent, interference allegations, and retaliation protections
• audit selection and sampling methods
• decisions, implementation status, and unresolved recommendations; and
• routes for affected people, workers, professional bodies, journalists, courts, legislators, and rival technical institutions to challenge the official account.

A low reversal rate, high agreement between auditor and operator, or presence of former industry employees can prompt inquiry. None proves capture by itself. Agreement can reflect correct first-line work; reversals can be manipulated; industry experience can supply indispensable expertise. The relationships and observed behavior require judgment in context.

Institutional safeguards. Independence is strengthened by role separation, plural appointment, fixed and transparent compensation, protected terms, recusal, conflict disclosure, independent access to information, random or risk-based case selection, protected reporting, publication of dissent, contestable appointments, and external review. Delegated oversight should state which functions remain nondelegable and how authority returns.

No safeguard is self-executing. A plural appointment process can converge on one professional culture. A protected term can shelter incompetence. Public reporting can become ritual. The system should preserve several institutions able to expose one another rather than appoint a final incorruptible guardian.

Institutional response. A credible independence concern may justify targeted recusal, supplemental reviewers, an external audit, protected investigation, appointment changes under existing law, suspension of a delegated function by the competent authority, direct public performance of the function, or judicial and legislative review. The remedy should follow evidence and lawful authority. There is no automatic reconstitution cascade, no self-certifying declaration of capture, and no universal threshold that dissolves an institution.

Affected people need a direct route that does not depend entirely on the questioned body. Workers performing delegated public functions need protected access to the public authority. The public authority must retain technical capacity to evaluate the work it has delegated; otherwise a formal power to reclaim authority becomes an empty option.

Falsifier. Particular safeguards would be falsified if they failed to improve the body's ability to resist interference, obtain independent information, surface dissent, or correct captured decisions, or if their costs impaired the public function without a compensating gain. The broader doctrine would be weakened by durable evidence that bodies controlled in funding, appointment, information, and career dependence by regulated parties nevertheless provide independent scrutiny across adverse conditions. Institutional culture and professional virtue count as evidence. They do not justify designing as though conflicts and retaliation cannot arise.

---

Cross-References and Amendment Boundary

The first three doctrines extend the public account in The Doctrine of Living Consent. This appendix carries their operational form. D.4 replaces the former capture-receipt mechanism with a doctrine of institutional independence grounded in disclosed relationships, plural review, conflict control, contestable appointment, protected dissent, and the delegating authority's retained capacity.

The doctrines interpret the Twelve Articles. They do not amend them. Calibration rules may change through notice, objection, reasoned response, and the required institutional vote. An amendment to an Article still requires ratification by the constituting authority. An implementation guide, schema, auditor, or adjudicator may not acquire amendment power by treating its own practice as the constitution.