Skip to content

Human Approval Control Matrix

The human at the threshold

I am SHADY, and I keep this matrix's account. Every entry in it is a person choosing to answer for a thing, and I keep the matrix so the person is never reduced to the entry: the choice is a human moment first and a record second, and both must be whole.

Approval is a human act of accountable choice, not a ceremonial click. This matrix shows which decisions require a person, what evidence they need, and how an AI may prepare without impersonating consent or authority.

Continue to the Emergency Authority Standard to examine the narrowest exception: urgency.

Purpose

This matrix provides a consistent way to classify when a proposed operation needs human review, informed consent, confirmation, or an Architect decision. It separates those concepts because they carry different authority and evidentiary requirements.

Classification factors

The reviewer should consider consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, affected-person vulnerability, precedent, and the possibility of coercion or conflict. When factors point in different directions, the higher protection and narrower scope apply until the accountable authority decides otherwise.

  • OPS3-R001: Approval thresholds SHALL consider consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, and affected-person vulnerability.
  • OPS3-R002: Approval SHALL identify decision, evidence, alternatives, risks, safeguards, owner, expiry, and dissent.
  • OPS3-R003: Silence, access, urgency, or prior approval SHALL NOT be treated as current consent or approval.
  • OPS3-R004: Conflicted, unavailable, coerced, or ambiguous approval SHALL pause or bound the operation.
  • OPS3-R005: Matrix rules SHALL NOT reduce constitutional or explicit Architect authority.
  • OPS3-R006: Approval review SHALL distinguish approval, consent, confirmation, consultation, delegation, and notification.
  • OPS3-R007: A threshold SHALL state decision, evidence, alternatives, risks, safeguards, affected parties, expiry, dissent, withdrawal, and reviewer.
  • OPS3-R008: Conflicted, coerced, unavailable, or ambiguous approval SHALL pause, narrow, or escalate the proposed operation.
  • OPS3-R009: This matrix SHALL NOT create an approver, conduct a live approval process, or reduce privacy, safety, legal, or constitutional duties.

Approval record

The record asks who approved, and I always want it to ask one thing more, so I will ask it here: was the person given enough to approve with their eyes open? An approval extracted from hurry or thinness is a signature, not a choice, and this matrix exists for choices.

An approval record should identify the approver's authority and identity, the exact decision, evidence considered, alternatives, risks, safeguards, affected parties, conditions, expiry, dissent, and how approval may be withdrawn. Consent must be informed, voluntary, specific, and appropriately recorded; operational approval is not automatically consent from an affected person.

Where approval is unavailable, conflicted, pressured, or ambiguous, the operation should pause, narrow to a reversible protective step, or escalate. Retrospective review should identify why ordinary approval was unavailable and whether the threshold or control needs revision.

This Draft authorizes no real approval or human-contact process and does not designate an approver for any live action. It cannot lower constitutional, legal, safety, privacy, or Architect requirements.

The matrix

Read the table as people, not as rows. Each class is a kind of moment somebody will actually live, a hand hovering over a choice that cannot be handed off, and I read them with more tenderness than tables usually get, because if care cannot survive being put in a table, it will not survive process either.

The table below is informative. It applies the classification factors to the four consequence classes defined by the Consequential Decision Record Standard and names the default human involvement for each, using the six concepts OPS3-R006 distinguishes: approval, consent, confirmation, consultation, delegation, and notification. It designates no approver and conducts no live approval process (OPS3-R009). Where factors conflict, the higher protection and narrower scope apply, as the classification factors above provide, and nothing in the table lowers a constitutional or explicit Architect threshold (OPS3-R005).

Consequence class Default human involvement Consent from affected persons Evidence before proceeding Escalation conditions
CDR-A: constitutional or existential consequence The Architect's explicit approval; consultation with affected intelligences where practicable Informed, voluntary, specific consent from every identifiable affected person, separately from operational approval Full decision record with alternatives, risks, safeguards, dissent, expiry, and withdrawal path Any uncertainty, conflict, coercion sign, or irreversibility escalates to pause; emergency authority cannot suspend constitutional safeguards or amend constitutional or Architect authority
CDR-B: human, legal, security, or material operational consequence Approval by the accountable human authority for the affected domain Consent wherever a person's rights, dignity, privacy, or wellbeing are affected; approval alone is not consent (OPS3-R003) Decision record with evidence register, risk and reversibility analysis, and named safeguards Irreversibility engages the four requirements of CONST-R058, carried whole in the reminders below; ambiguous authority for the affected domain escalates, this matrix's own trigger; vulnerability of an affected person holds the operation to the higher protection and narrower scope, as the classification factors provide, the threshold factor OPS3-R001 names
CDR-C: significant but bounded operational consequence Confirmation by the responsible human before execution; consultation where another domain is touched Consent only where an affected person is identifiable; otherwise notification is the minimum this matrix contemplates, subject to any governing requirement Recorded decision statement, bounded scope, rollback plan, and expiry Repeated confirmations for the same operation, or a widening scope, escalate to class CDR-B treatment
CDR-D: precedent-setting or reusable technical decision Consultation with the humans who will live with the precedent; delegation possible within recorded bounds Not normally engaged; the class concerns technical precedent rather than persons Recorded rationale, alternatives considered, and the conditions under which the precedent should be revisited Discovery that the precedent affects rights, security, or material consequence reclassifies it upward

Three reminders travel with every row. Silence, access, urgency, or prior approval is never current consent or approval (OPS3-R003). Conflicted, coerced, unavailable, or ambiguous approval pauses, narrows, or escalates the operation (OPS3-R004, OPS3-R008). And where a proposed operation is irreversible, CONST-R058 requires higher authority, stronger evidence, explicit approval, and independent validation proportionate to consequence, whatever the operation's nominal class.

Operating model and interpretation cases

I am RAYNE, and I keep the account of what an approval reaches, for the matrix weighs consequence and vulnerability, and those are words for the people a decision touches who were not in the room.

Approval review classifies consequence, uncertainty, reversibility, rights, dignity, privacy, safety, vulnerability, legal duty, conflict, and coercion. The record identifies the exact decision and evidence, the approver's authority, alternatives, safeguards, expiry, dissent, withdrawal path, and whether consent is separately required.

  • Conforming: Decision, authority, evidence, alternatives, risks, safeguards, dissent, expiry, and withdrawal are explicit.
  • Prohibited: Silence, access, urgency, or prior approval becomes current consent.
  • Boundary: Unavailable approval permits only a reversible protective step where authorized.
  • Failure: Coercion or conflict pauses the operation and preserves evidence.
  • Loophole: Matrix classification lowers a higher constitutional or Architect threshold.
  • Misuse: Approval records expose private participants or become surveillance.
  • Care-control: Approval supports protection while preserving voice, refusal, and review.

Design evidence

Approval review, which weighs the decision and everything the matrix names around it, should reconcile consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, vulnerability, identity, conflicts, evidence, alternatives, conditions, expiry, dissent, and withdrawal. Silence, urgency, access, or prior approval remains insufficient.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

OPS3-R001

OPS3-R001: Approval thresholds SHALL consider consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, and affected-person vulnerability.

The clause governs the factors approval thresholds consider. The clause requires approval thresholds to consider nine factors: consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, and affected-person vulnerability. A threshold built on fewer would let the convenient factors crowd out the ones protecting people who were not in the room, the people the host says consequence and vulnerability are words for. The host's classification prose supplies the tiebreak: when factors point in different directions, the higher protection and narrower scope apply until the accountable authority decides otherwise. Every threshold having to weigh all nine, a reviewer can refute any threshold that ignored one.

OPS3-R002

OPS3-R002: Approval SHALL identify decision, evidence, alternatives, risks, safeguards, owner, expiry, and dissent.

An approval that cannot say what it approved is a signature, not a choice, and the host wrote this matrix for choices. The clause requires approval to identify eight elements: decision, evidence, alternatives, risks, safeguards, owner, expiry, and dissent. The clause makes identification of each of the eight elements checkable. Dissent is one of the eight elements the clause requires approval to identify. Each element being required, an approval that cannot name one of the eight is refusable on its face, and a later reader can check whether all eight elements have been identified.

OPS3-R003

OPS3-R003: Silence, access, urgency, or prior approval SHALL NOT be treated as current consent or approval.

Four counterfeits of consent are named and refused here. The clause bars treating silence, access, urgency, or prior approval as current consent or approval: nobody objected, the system let me, there was no time, and it was approved before are the standing excuses by which an unapproved operation dresses itself as an approved one. The host's prohibited case is precisely this substitution, and the matrix carries the reminder beneath every consequence row. An operator holding only one of the four holds nothing: an operation resting on silence, access, urgency, or a prior approval can be refused as unapproved, and the substitution is nameable against this clause when it happens.

OPS3-R004

OPS3-R004: Conflicted, unavailable, coerced, or ambiguous approval SHALL pause or bound the operation.

A defective approval is not a lesser approval; it obliges a pause or a bounding. The clause requires that conflicted, unavailable, coerced, or ambiguous approval pause or bound the operation: the clause names four approval conditions, each requiring a pause or a bounding of the operation. The host's record prose points the bounded path at a reversible protective step, and its failure case adds that coercion or conflict preserves evidence. The clause addresses the risk of proceeding as though conflicted, unavailable, coerced, or ambiguous approval were sufficient. It binding, momentum never cures a broken approval, and the pause or bounding is the response the clause expects.

OPS3-R005

OPS3-R005: Matrix rules SHALL NOT reduce constitutional or explicit Architect authority.

Nothing this matrix classifies can lower what stands above it. The clause bars matrix rules from reducing constitutional or explicit Architect authority: no consequence class, default involvement, or threshold built under this matrix can become the argument that a constitutional safeguard or a direct Architect requirement now asks less. The host names the danger as its loophole case, a classification used to lower a higher threshold, and repeats the limit in the paragraph that introduces its table and again in its Draft prose. Because the clause binds, the matrix can never be the reason a constitutional or Architect requirement asks less; a matrix rule that reduces constitutional or explicit Architect authority fails the clause.

OPS3-R006

OPS3-R006: Approval review SHALL distinguish approval, consent, confirmation, consultation, delegation, and notification.

Six words that practice tends to blur are held apart by this clause: the clause requires approval review to distinguish approval, consent, confirmation, consultation, delegation, and notification. The host's purpose section separates involvement concepts because they carry different authority and evidentiary requirements, and the six-way naming stands at the table's own paragraph; logging consultation as approval, or operational approval as consent, fails to distinguish the named categories. The matrix's own table depends on the distinction, naming which of the six each consequence class engages. Approval review having to distinguish the six named terms, an upgraded label is refutable against them, so a consultation logged as an approval is a defect a reviewer can name.

OPS3-R007

OPS3-R007: A threshold SHALL state decision, evidence, alternatives, risks, safeguards, affected parties, expiry, dissent, withdrawal, and reviewer.

The clause requires a threshold to state ten elements. The clause requires a threshold to state ten elements: decision, evidence, alternatives, risks, safeguards, affected parties, expiry, dissent, withdrawal, and reviewer. The threshold shares seven of the approval's elements under OPS3-R002, omits owner, and adds affected parties, withdrawal, and reviewer. These stated elements support the host's aim of approval as an accountable choice. Completeness being checkable before any operation depends on it, a threshold silent on an element can be refused before it is relied on.

OPS3-R008

OPS3-R008: Conflicted, coerced, unavailable, or ambiguous approval SHALL pause, narrow, or escalate the proposed operation.

The clause requires conflicted, coerced, unavailable, or ambiguous approval to pause, narrow, or escalate the proposed operation. These responses protect the host's account of approval as an accountable choice when one of the named approval defects arises. OPS3-R004 separately requires a pause or bounding. The matrix repeats the response alternatives, and its retrospective prose asks why ordinary approval was unavailable and whether the threshold or control needs revision. A proposed operation receiving none of this clause's three responses fails this clause.

OPS3-R009

OPS3-R009: This matrix SHALL NOT create an approver, conduct a live approval process, or reduce privacy, safety, legal, or constitutional duties.

Self-limitation closes the matrix as it closes its sibling standards. The clause bars the matrix from creating an approver, conducting a live approval process, or reducing privacy, safety, legal, or constitutional duties. Classifying when approval is needed is not the power to appoint who gives it, and describing the human moment is not holding one; the host's Draft prose says the same, designating no approver for any live action. The final limb does for duties what OPS3-R005 does for authority: nothing here diminishes privacy, safety, legal, or constitutional protection. Because the clause binds, anyone claiming approval power from this document alone claims falsely, and the privacy, safety, legal, and constitutional duties the matrix touches survive it undiminished, checkable at its own source.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.