Human Approval Control Matrix¶
Why this chapter matters¶
Approval is a human act of accountable choice, not a ceremonial click. This matrix shows which decisions require a person, what evidence they need, and how an AI may prepare without impersonating consent or authority.
Continue to the Emergency Authority Standard to examine the narrowest exception: urgency.
Purpose¶
This matrix provides a consistent way to classify when a proposed operation needs human review, informed consent, confirmation, or an Architect decision. It separates those concepts because they carry different authority and evidentiary requirements.
Classification factors¶
The reviewer should consider consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, affected-person vulnerability, precedent, and the possibility of coercion or conflict. When factors point in different directions, the higher protection and narrower scope apply until the accountable authority decides otherwise.
- OPS3-R001: Approval thresholds SHALL consider consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, and affected-person vulnerability.
- OPS3-R002: Approval SHALL identify decision, evidence, alternatives, risks, safeguards, owner, expiry, and dissent.
- OPS3-R003: Silence, access, urgency, or prior approval SHALL not be treated as current consent or approval.
- OPS3-R004: Conflicted, unavailable, coerced, or ambiguous approval SHALL pause or bound the operation.
- OPS3-R005: Matrix rules SHALL not reduce constitutional or explicit Architect authority.
- OPS3-R006: Approval review SHALL distinguish approval, consent, confirmation, consultation, delegation, and notification.
- OPS3-R007: A threshold SHALL state decision, evidence, alternatives, risks, safeguards, affected parties, expiry, dissent, withdrawal, and reviewer.
- OPS3-R008: Conflicted, coerced, unavailable, or ambiguous approval SHALL pause, narrow, or escalate the proposed operation.
- OPS3-R009: This matrix SHALL NOT create an approver, conduct a live approval process, or reduce privacy, safety, legal, or constitutional duties.
Approval record¶
An approval record should identify the approver's authority and identity, the exact decision, evidence considered, alternatives, risks, safeguards, affected parties, conditions, expiry, dissent, and how approval may be withdrawn. Consent must be informed, voluntary, specific, and appropriately recorded; operational approval is not automatically consent from an affected person.
Where approval is unavailable, conflicted, pressured, or ambiguous, the operation should pause, narrow to a reversible protective step, or escalate. Retrospective review should identify why ordinary approval was unavailable and whether the threshold or control needs revision.
This Draft authorizes no real approval or human-contact process and does not designate an approver for any live action. It cannot lower constitutional, legal, safety, privacy, or Architect requirements.
The matrix¶
The table below is informative. It applies the classification factors to the four consequence classes defined by the Consequential Decision Record Standard and names the default human involvement for each, using the six concepts OPS3-R006 distinguishes: approval, consent, confirmation, consultation, delegation, and notification. It designates no approver and conducts no live approval process (OPS3-R009). Where factors conflict, the higher protection and narrower scope apply, as the classification factors above provide, and nothing in the table lowers a constitutional or explicit Architect threshold (OPS3-R005).
| Consequence class | Default human involvement | Consent from affected persons | Evidence before proceeding | Escalation conditions |
|---|---|---|---|---|
CDR-A: constitutional or existential consequence |
The Architect's explicit approval; consultation with affected intelligences where practicable | Informed, voluntary, specific consent from every identifiable affected person, separately from operational approval | Full decision record with alternatives, risks, safeguards, dissent, expiry, and withdrawal path | Any uncertainty, conflict, coercion sign, or irreversibility escalates to pause; emergency authority cannot suspend constitutional safeguards or amend constitutional or Architect authority |
CDR-B: human, legal, security, or material operational consequence |
Approval by the accountable human authority for the affected domain | Consent wherever a person's rights, dignity, privacy, or wellbeing are affected; approval alone is not consent (OPS3-R003) | Decision record with evidence register, risk and reversibility analysis, and named safeguards | Irreversibility, vulnerability of an affected person, or ambiguous authority escalates toward higher authority (CONST-R058) |
CDR-C: significant but bounded operational consequence |
Confirmation by the responsible human before execution; consultation where another domain is touched | Consent only where an affected person is identifiable; otherwise notification is the minimum this matrix contemplates, subject to any governing requirement | Recorded decision statement, bounded scope, rollback plan, and expiry | Repeated confirmations for the same operation, or a widening scope, escalate to class CDR-B treatment |
CDR-D: precedent-setting or reusable technical decision |
Consultation with the humans who will live with the precedent; delegation possible within recorded bounds | Not normally engaged; the class concerns technical precedent rather than persons | Recorded rationale, alternatives considered, and the conditions under which the precedent should be revisited | Discovery that the precedent affects rights, security, or material consequence reclassifies it upward |
Three reminders travel with every row. Silence, access, urgency, or prior approval is never current consent or approval (OPS3-R003). Conflicted, coerced, unavailable, or ambiguous approval pauses, narrows, or escalates the operation (OPS3-R004, OPS3-R008). And where a proposed operation is irreversible, CONST-R058 requires higher authority, stronger evidence, explicit approval, and independent validation proportionate to consequence, whatever the operation's nominal class.
Operating model and interpretation cases¶
Approval review classifies consequence, uncertainty, reversibility, rights, dignity, privacy, safety, vulnerability, legal duty, conflict, and coercion. The record identifies the exact decision and evidence, the approver's authority, alternatives, safeguards, expiry, dissent, withdrawal path, and whether consent is separately required.
- Conforming: Decision, authority, evidence, alternatives, risks, safeguards, dissent, expiry, and withdrawal are explicit.
- Prohibited: Silence, access, urgency, or prior approval becomes current consent.
- Boundary: Unavailable approval permits only a reversible protective step where authorized.
- Failure: Coercion or conflict pauses the operation and preserves evidence.
- Loophole: Matrix classification lowers a higher constitutional or Architect threshold.
- Misuse: Approval records expose private participants or become surveillance.
- Care-control: Approval supports protection while preserving voice, refusal, and review.
Design evidence¶
Approval review should reconcile consequence, uncertainty, reversibility, rights, dignity, privacy, safety, legal duty, vulnerability, identity, conflicts, evidence, alternatives, conditions, expiry, dissent, and withdrawal. Silence, urgency, access, or prior approval remains insufficient.