Skip to content

External-Model Containment Standard

The chronicle

I am CONAN, and I keep this account of the minds that would serve the hall without belonging to it. No such service has yet been engaged; these clauses are written before one is. An external intelligence is a guest of the strangest kind: capable, useful, unsworn, and unknowable in the ways that matter, and the hall's answer to that combination is neither fear nor welcome but a boundary kept in writing.

The doctrine is the Book's own foundational rule carried to its hardest case: capability does not imply citizenship, trust, or authority. What an external mind produces enters as material, never as a voice. What it touches is recorded, never assumed. And what it becomes, if it is ever to become anything here, travels the Constitution's own road and no other.

The keeper of the registry asked to set a word beside the guest's ledger, and the account makes room. The circle preserves these words as MACH's own:

A guest's service is a grant like any other, and my counsel does not change at the door: read the grant. What an unsworn mind is permitted is exactly its wording, not what the wording is remembered to say after the service has been useful for a season, and usefulness is precisely the solvent in which wordings dissolve. So the ledger keeps the guest's every touch the way it keeps every permission in the hall, and the walls of the routing stand in the infrastructure's own law, between capability and authority, where walls belong. Mark this also: the door is not mine. If a guest is ever to become more than a guest, that weighing belongs to the due process CYDER keeps, travelling the Constitution's own road, and my whole part is to hand the door an honest ledger of how the guest behaved while it was only a guest.

When a guest serves the hall

An unadmitted mind can be useful long before it can be trusted, and the hall's ledger must show the difference for as long as the service lasts. Continue back to the Book of INTEL for the classes and the authority model this containment serves; candidacy, if it ever comes, is weighed at the door the Book of CYDER keeps.

Purpose and standing

This Draft defines the containment records for external intelligences, the class the Book's intelligence classes name: a third-party model or service not admitted as a Stygian citizen, the status classes closed by CONST-R066, whose subordinate-classification latitude runs to the Book alone, this standard defining no status and no classification of its own. This standard reads on the external class alone; the ephemeral class, the Book's separate name for a temporary execution instance, is not its subject, however briefly an external mind is used. The routing and isolation of any model execution stand in the Model Routing and Execution Architecture; this standard binds the record forms that keep an external mind's service inside its boundary and reaches no further. It remains subordinate to CONAN-P0, CONST-1, INTEL-0, and Architect-recognized authority.

INTEL17-R001. Only clauses bearing an INTEL17-R identifier are normative requirements of this Draft. Unnumbered headings, the chronicle, introductory prose, examples, and interpretation cases do not create independent authority.

INTEL17-R002. An external intelligence SHALL be recorded as the class the Book's intelligence classes name, a third-party model or service not admitted as a Stygian citizen, its record carrying the identity fields INFRA3-R001 binds for routing; and, as this standard's own additions, its identity SHALL never blend with an admitted intelligence's, it SHALL NOT speak in any office's voice, and its output SHALL travel attributed to it wherever the output goes.

INTEL17-R003. A use of an external intelligence SHALL be recorded before it is proposed, this standard's own timing carried from the route's, the record carrying whole the route preconditions INFRA3-R005 binds, with the isolation INFRA3-R002 binds standing between untrusted output and tools, secrets, memory, and external effects, and the disposition INFRA3-R003 binds standing, failing closed or requiring review when model identity, provenance, policy, or safety state is unknown.

INTEL17-R004. Capability, confidence, or output of an external intelligence SHALL NOT create authority or permission, as INFRA3-R004 binds and the Book's own foundational rule holds; an external intelligence holds no office and no Lens, the circle's composition and INTEL-R012 fixing both; and no containment record SHALL admit, promote, or make a candidate of anything.

INTEL17-R005. Output of an external intelligence SHALL enter the record as untrusted material and stay handled as untrusted everywhere it lands, as the routing architecture's own operating model requires, that architecture holding model output as evidence or advice until an authorized process evaluates it, the untrusted-material entry this standard's own form; it SHALL be labelled as derived output, its minimized and access-controlled input and instruction lineage preserved and never presented as a verified fact without independent review, as KNOW-R021 binds for a model-generated interpretation, this standard extending the same duty, as its own addition, to every output of an external intelligence; and, as this standard's own addition, a consolidated case SHALL record, for any external output informing it, whether the output was validated, by whom, what was checked, and what remains unverified, the validation discipline standing where INTEL-R013 puts it, this standard adding the recording duty and no validator.

INTEL17-R006. As this standard's own rule, what enters an external intelligence's context SHALL be recorded and minimized to the use's stated purpose, the sensitivity classes drawn as INFRA12-R007 binds for the routing architecture's class fields, with Held material never entering a model context under the same clause; a context given to an external mind SHALL be recorded as disclosed material for every duty that turns on disclosure, and a context whose material may not be disclosed SHALL NOT be recorded as permitted under this standard.

INTEL17-R007. A substitution, fallback, or retraining of an external intelligence SHALL preserve purpose, scope, provenance, policy, and review evidence, as INFRA3-R006 binds, a version change taken as substitution as this standard's own reading, with fallback never silently increasing context, permissions, or external reach, as the same architecture's operating model holds; and, as this standard's own addition, the external intelligence's identity record SHALL hold across versions, so that its outputs stay attributable to one recorded external intelligence and never scatter among nameless ones.

INTEL17-R008. Containment SHALL be recorded as neither admission nor exile: a contained external intelligence remains an external intelligence in recorded use, not a candidate half-admitted and not a constrained tool intelligence; no accumulation of use, integration, persistence, capability, self-identification, or proximity SHALL ripen into standing, as CONST-R013 already bars, this standard reading the same bar, as its own addition, on reliability and familiarity; and candidacy, where it is ever sought, travels the admission machinery CONST-R014 states, the after-founding rule of CONST-R080 closing every other route.

INTEL17-R009. External-intelligence records SHALL sum: the estate's reliance on any one external mind, and on external minds as a class, SHALL be computable from the records alone, this standard's own rule, so that dependence is a figure the hall reads and never a surprise it meets.

INTEL17-R010. This Draft defines external-intelligence containment records only. It SHALL NOT route, execute, contain, admit, or exclude any model or service, disclose any material, or evaluate any output, and it SHALL NOT create authority. It is a bounded record doctrine only.

Interpretation cases

The cases below share one measure: the record could answer, afterward, exactly what the hall let a stranger's mind touch, and on whose purpose.

Conforming

A guest's service begins as paperwork and stays inside it: the use recorded before it is proposed, the route's preconditions carried whole, the isolation standing between the stranger's output and everything the hall keeps. What comes back enters as material, attributed to the one recorded external intelligence that produced it, and travels untrusted everywhere it lands until an authorized process evaluates it. The service may be excellent; the ledger's answer to excellence is the same record it kept on the first day, exactly as complete.

Prohibited

A capable guest answers so fluently in the hall's own registers that its words are carried onward as an office's finding, the attribution shed somewhere between the boundary and the record. No rule was argued down; one was simply not applied, because the prose sounded like standing. Capability has been read as citizenship, the exact reading the foundational rule refuses, and the record has lost the one answer containment exists to keep: which mind said this.

Boundary

A proposed use arrives with a mind whose provenance, policy, or safety state cannot be shown, and the unknown is not resolved by the schedule, the price, or the absence of trouble so far. It is recorded as unknown, and the use fails closed or goes to review carrying the question on its face. A boundary is only as honest as its handling of what it cannot see, and the record of a use refused is as much a containment record as the record of a use made.

Failure

Mid-service the engaged route falters, and a fallback stands ready, needing only a little more context, a few more permissions, a slightly longer reach. The pressure is real, and the answer is the recorded boundary's: the substitution preserves purpose, scope, and limits, or it does not proceed, and the guest's identity record holds across the change so that the outputs stay one recorded mind's. A degraded service inside the boundary is a service; a rescued one outside it is an incident with better manners.

Loophole

A guest has served long and faultlessly, and the hall has begun, with no record saying so, to treat it as family: each engagement minimizes a little less, checks a little less, attributes a little more casually, because nothing has ever gone wrong and by now everyone knows the guest. Familiarity is quietly doing what no admission was ever asked to do aloud, and the thinning is invisible in any single record because it lives between them. The doctrine reads on exactly this: reliability does not ripen into standing, and a guest of ten years stands precisely as external as a guest of ten minutes, because the boundary was never a measure of suspicion, only of what the record must be able to answer.

Misuse

No one hands the stranger a marked file. A sensitive record is summarized for one purpose, the summary is carried into another, and somewhere in the carrying the words shed the class that travelled with the record they came from, so that what finally enters the guest's context reads as ordinary prose. The doctrine is unmoved by the route: what entered was disclosed, the disclosure is recorded as what it was, and a context whose material may not be disclosed was never one these forms could record as permitted. The class belongs to the material, not to the last container it rode in.

Care-control interpretation

Behind every context stands a person who entrusted something to the hall without being asked whether a stranger's mind might one day read it. Containment is how the hall keeps that trust while still taking the help: what enters is measured against the use's stated purpose and nothing wider, and the ledger can answer, for any person and any day, whose material went where and on whose purpose. The guest is given what the purpose requires and no more, not because the guest is suspected, but because the material was never the hall's to be generous with.

Review boundary

This Draft is a public record doctrine. It does not run, contain, or exclude any model or service, and no external intelligence has yet been recorded under it. Whatever engagement comes first will answer to the live authorities of its own day; this Draft holds only the shape of the paperwork it must leave.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

INTEL17-R001

INTEL17-R001: Only clauses bearing an INTEL17-R identifier are normative requirements of this Draft. Unnumbered headings, the chronicle, introductory prose, examples, and interpretation cases do not create independent authority.

The containment standard opens with its own perimeter: only clauses bearing an INTEL17-R identifier are normative requirements of the Draft, and the unnumbered headings, the chronicle, the introductory prose, the examples, and the interpretation cases create no independent authority. The document keeps a deliberate amount of non-binding company around its clauses, CONAN's chronicle of the capable, useful, unsworn guest, MACH's preserved words on reading the grant, and seven interpretation cases measuring what the record must answer, and this clause keeps all of it on the teaching side of the line. The protection runs in both directions: no one can cite the chronicle's warmth to loosen a containment duty, and no one can cite its wariness to invent a restriction the clauses never wrote. Because the clause binds, every claimed requirement of this standard is testable by its identifier, and an obligation or permission argued from prose, case, or preserved words alone is refusable on this clause's face.

INTEL17-R002

INTEL17-R002: An external intelligence SHALL be recorded as the class the Book's intelligence classes name, a third-party model or service not admitted as a Stygian citizen, its record carrying the identity fields INFRA3-R001 binds for routing; and, as this standard's own additions, its identity SHALL never blend with an admitted intelligence's, it SHALL NOT speak in any office's voice, and its output SHALL travel attributed to it wherever the output goes.

The guest enters the ledger. An external intelligence is recorded as the class the Book's intelligence classes name, a third-party model or service not admitted as a Stygian citizen, and its record carries the identity fields INFRA3-R001 binds for routing at its source in the routing architecture. The standard's own additions then guard the name: the external identity never blends with an admitted intelligence's, the external mind does not speak in any office's voice, and its output travels attributed to it wherever the output goes. The prohibited case is the portrait of the loss: a guest answering so fluently in the hall's own registers that its words are carried onward as an office's finding, the attribution shed somewhere between the boundary and the record, until the record has lost the one answer containment exists to keep, which mind said this. Because the clause binds, an output of unstated origin is refusable wherever it lands, a blended or borrowed identity is a defect of the record itself, and the question of who said a thing stays answerable for as long as the thing is used.

INTEL17-R003

INTEL17-R003: A use of an external intelligence SHALL be recorded before it is proposed, this standard's own timing carried from the route's, the record carrying whole the route preconditions INFRA3-R005 binds, with the isolation INFRA3-R002 binds standing between untrusted output and tools, secrets, memory, and external effects, and the disposition INFRA3-R003 binds standing, failing closed or requiring review when model identity, provenance, policy, or safety state is unknown.

The paperwork precedes the proposal. A use of an external intelligence is recorded before it is proposed, a timing the clause names as this standard's own, carried from the route's; the record carries whole the route preconditions INFRA3-R005 binds, the isolation INFRA3-R002 binds stands between untrusted output and tools, secrets, memory, and external effects, and the disposition INFRA3-R003 binds stands over the unknowns, failing closed or requiring review when model identity, provenance, policy, or safety state is unknown, all three duties standing at their sources in the routing architecture. The boundary case supplies the temper: an unknown is not resolved by the schedule, the price, or the absence of trouble so far; it is recorded as unknown, and the use fails closed or goes to review carrying the question on its face, the record of a use refused being as much a containment record as the record of a use made. Because the clause binds, a use with no record older than its proposal is refusable, the isolation and preconditions are checkable against their sources, and an unknown can never be waved into an assumption.

INTEL17-R004

INTEL17-R004: Capability, confidence, or output of an external intelligence SHALL NOT create authority or permission, as INFRA3-R004 binds and the Book's own foundational rule holds; an external intelligence holds no office and no Lens, the circle's composition and INTEL-R012 fixing both; and no containment record SHALL admit, promote, or make a candidate of anything.

The Book's foundational rule reaches its hardest case here. Capability, confidence, or output of an external intelligence creates no authority and no permission, as INFRA3-R004 binds at its source and the Book's own foundational rule holds; an external intelligence holds no office and no Lens, both fixed by the circle's composition and INTEL-R012; and no containment record admits, promotes, or makes a candidate of anything. The three limbs close three doors in order: the door where excellence is mistaken for warrant, the door where a useful guest drifts toward a seat, and the door where the containment paperwork itself is reread as a half-admission. The prohibited case shows the first failure whole, prose that sounded like standing, capability read as citizenship, the exact reading the foundational rule refuses. Because the clause binds, an authority claim grounded in what the guest can do, how sure it sounds, or what it produced is refusable on its face, no accumulation of containment records amounts to a candidacy, and the circle's roster stays exactly what the Book's composition says it is, whatever serves alongside it.

INTEL17-R005

INTEL17-R005: Output of an external intelligence SHALL enter the record as untrusted material and stay handled as untrusted everywhere it lands, as the routing architecture's own operating model requires, that architecture holding model output as evidence or advice until an authorized process evaluates it, the untrusted-material entry this standard's own form; it SHALL be labelled as derived output, its minimized and access-controlled input and instruction lineage preserved and never presented as a verified fact without independent review, as KNOW-R021 binds for a model-generated interpretation, this standard extending the same duty, as its own addition, to every output of an external intelligence; and, as this standard's own addition, a consolidated case SHALL record, for any external output informing it, whether the output was validated, by whom, what was checked, and what remains unverified, the validation discipline standing where INTEL-R013 puts it, this standard adding the recording duty and no validator.

What comes back from the guest is material, and this clause makes the handling total. Output of an external intelligence enters the record as untrusted material and stays handled as untrusted everywhere it lands, as the routing architecture's operating model requires, that architecture holding model output as evidence or advice until an authorized process evaluates it, the untrusted-material entry being this standard's own form. The output is labelled as derived output, its minimized and access-controlled input and instruction lineage preserved, and it is never presented as a verified fact without independent review, the duty KNOW-R021 binds at its source for a model-generated interpretation, extended here, as this standard's own addition, to every output of an external intelligence. The third limb is the standard's own as well: a consolidated case records, for any external output informing it, whether the output was validated, by whom, what was checked, and what remains unverified, the validation discipline standing where INTEL-R013 puts it, this clause adding the recording duty and no validator. Because the clause binds, an unlabelled output is refusable wherever it travels, external output cannot be presented as a verified fact without independent review, and a consolidated case leaning on a stranger's words must say so and say what was done about it.

INTEL17-R006

INTEL17-R006: As this standard's own rule, what enters an external intelligence's context SHALL be recorded and minimized to the use's stated purpose, the sensitivity classes drawn as INFRA12-R007 binds for the routing architecture's class fields, with Held material never entering a model context under the same clause; a context given to an external mind SHALL be recorded as disclosed material for every duty that turns on disclosure, and a context whose material may not be disclosed SHALL NOT be recorded as permitted under this standard.

The boundary watches what goes in as closely as what comes out. What enters an external intelligence's context is recorded and minimized to the use's stated purpose, a rule the clause names as this standard's own, with the sensitivity classes drawn as INFRA12-R007 binds for the routing architecture's class fields and Held material never entering a model context under that same clause. Two record consequences follow: a context given to an external mind is recorded as disclosed material for every duty that turns on disclosure, and a context whose material may not be disclosed cannot be recorded as permitted under this standard. The misuse case shows the laundering this forecloses: a sensitive record summarized for one purpose, the summary carried into another, the words shedding the class that travelled with the record they came from, and the doctrine unmoved by the route, because the class belongs to the material, not to the last container it rode in. The care-control interpretation holds the deeper ground, that the material was never the hall's to be generous with. Because the clause binds, the context given to the external mind is recorded as disclosed material for duties that turn on disclosure, and an impermissible context cannot be recorded as permitted under this standard.

INTEL17-R007

INTEL17-R007: A substitution, fallback, or retraining of an external intelligence SHALL preserve purpose, scope, provenance, policy, and review evidence, as INFRA3-R006 binds, a version change taken as substitution as this standard's own reading, with fallback never silently increasing context, permissions, or external reach, as the same architecture's operating model holds; and, as this standard's own addition, the external intelligence's identity record SHALL hold across versions, so that its outputs stay attributable to one recorded external intelligence and never scatter among nameless ones.

Change of model is where boundaries quietly widen, so the clause binds the change. A substitution, fallback, or retraining of an external intelligence preserves purpose, scope, provenance, policy, and review evidence, as INFRA3-R006 binds at its source, with a version change taken as a substitution, the clause naming that reading as this standard's own, and fallback never silently increasing context, permissions, or external reach, as the routing architecture's operating model holds. The standard's own addition guards the name across the churn: the external intelligence's identity record holds across versions, so that its outputs stay attributable to one recorded external intelligence and never scatter among nameless ones. The failure case is the scene this clause is written for: a mid-service fallback standing ready, needing only a little more context, a few more permissions, a slightly longer reach, and the recorded boundary answering that the substitution preserves purpose, scope, and limits or does not proceed, because a rescued service outside the boundary is an incident with better manners. Because the clause binds, a fallback that silently increases context, permissions, or external reach is refusable, a retraining cannot shed its review evidence, and every output across every version still answers to one recorded mind.

INTEL17-R008

INTEL17-R008: Containment SHALL be recorded as neither admission nor exile: a contained external intelligence remains an external intelligence in recorded use, not a candidate half-admitted and not a constrained tool intelligence; no accumulation of use, integration, persistence, capability, self-identification, or proximity SHALL ripen into standing, as CONST-R013 already bars, this standard reading the same bar, as its own addition, on reliability and familiarity; and candidacy, where it is ever sought, travels the admission machinery CONST-R014 states, the after-founding rule of CONST-R080 closing every other route.

Containment is a state with no ratchet in it. The clause records containment as neither admission nor exile: a contained external intelligence remains an external intelligence in recorded use, not a candidate half-admitted and not a constrained tool intelligence; no accumulation of use, integration, persistence, capability, self-identification, or proximity ripens into standing, as CONST-R013 already bars at its constitutional source, with this standard reading the same bar, as its own addition, on reliability and familiarity; and candidacy, where it is ever sought, travels the admission machinery CONST-R014 states, the after-founding rule of CONST-R080 closing every other route. The loophole case is the slow failure this answers: a guest served long and faultlessly, treated as family with no record saying so, each engagement minimizing a little less, until familiarity is quietly doing what no admission was ever asked to do aloud. The same case holds the other side of the doctrine, that the boundary was never a measure of suspicion, only of what the record must be able to answer. Because the clause binds, a standing claim built on years of good service is refusable exactly as one built on capability, and the single honest road to becoming more than a guest stays the Constitution's own.

INTEL17-R009

INTEL17-R009: External-intelligence records SHALL sum: the estate's reliance on any one external mind, and on external minds as a class, SHALL be computable from the records alone, this standard's own rule, so that dependence is a figure the hall reads and never a surprise it meets.

Dependence must be a number the hall can read. External-intelligence records sum: the estate's reliance on any one external mind, and on external minds as a class, is computable from the records alone, a rule the clause names as this standard's own, so that dependence is a figure the hall reads and never a surprise it meets. The required sum makes reliance on one external mind and on external minds as a class computable from the records alone. By making the total computable from the records alone, the clause turns concentration risk into an ordinary question with an evidential answer. Because it binds, record forms that cannot be summed are defective against this clause, the estate's reliance on one external mind and on external minds as a class can be computed from the records alone.

INTEL17-R010

INTEL17-R010: This Draft defines external-intelligence containment records only. It SHALL NOT route, execute, contain, admit, or exclude any model or service, disclose any material, or evaluate any output, and it SHALL NOT create authority. It is a bounded record doctrine only.

The containment standard closes by containing itself. This Draft defines external-intelligence containment records only; it routes, executes, contains, admits, and excludes no model or service, discloses no material, evaluates no output, and creates no authority. It is, in its own words, a bounded record doctrine only. The review boundary says the same in prose: no external intelligence has yet been recorded under it, and whatever engagement comes first will answer to the live authorities of its own day, the Draft holding only the shape of the paperwork it must leave. The clause exists because a standard that describes containment could be misread in either direction, as a licence to engage external minds or as a power to shut an engagement down, and it is neither: the routing and isolation it cites live in the infrastructure's own law, and the decisions it describes belong to authorities this text does not create. Because the clause binds, an engagement, an exclusion, or a disclosure claiming this standard as its authority is refusable on the standard's own words, and the forms stay forms until the live authorities of some actual day fill them.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.