Governable AI from the Ground Up

1. The Trust Problem

Every participant in the AI economy faces the same set of questions, and none of them has a satisfactory answer today.

A hospital deploys an AI system to triage radiology cases. The system was built by a vendor, hosted on a cloud platform, and governed by a set of policies the vendor says were running at the time each image was read. The hospital is responsible to its patients, to its regulators, and to the courts for every clinical decision that touches a patient. When a regulator asks whether the governance controls were actually running at the moment of a specific triage decision, the hospital has to go back to the vendor and ask. The vendor’s answer is the only answer that exists, because the vendor’s system is the only system that recorded it.

A defense ministry deploys AI agents on classified networks. The agents act on classified data the ministry cannot allow to leave its jurisdictional control, under rules the ministry itself must enforce. The question the ministry faces is whether the model powering those agents was independently certified as safe for the specific category of work it is doing. No certification infrastructure exists that can answer that question for a military application or a pharmaceutical research workflow, let alone a genetic-research pipeline or a classified intelligence operation. The model provider says the model is safe. The ministry has no independent way to verify that claim before the model acts.

A manufacturing company sources an open-weight model released by a foreign entity and fine-tunes it for supply-chain optimization. The model’s weights are public, but its training data, its behavioral boundaries under adversarial pressure, and its fitness for the company’s specific regulatory environment are opaque. The company’s compliance team asks a straightforward question: can we certify that this model is safe for our workflows, under our jurisdiction’s rules, given its provenance? No one in the organization can answer, because no infrastructure exists to produce the answer.

A sovereign government observes that its national AI evidence infrastructure, the systems that record what AI did, under what rules, with what authority, runs on platforms operated by foreign corporations under foreign jurisdiction. The government’s regulatory authority is intact in statute. Its visibility into the activity it regulates depends on a platform it does not control and cannot compel. That is a sovereignty gap, and it is structural.

These are all instances of the same problem. Every participant in the AI economy, from a single hospital to a sovereign government, needs to know four things before it can trust AI to act on its behalf or within its jurisdiction. First: what is this AI system, who authorized it to act, and what authority does it carry?

Second: is it certified as safe for the specific work it is about to do?

Third: were the governance controls actually running at the moment it acted?

Fourth: can anyone other than the party that ran the AI verify the answers to the first three questions without that party’s cooperation?

No production system in the world today can answer all four.

The data problem compounds the agent problem. Every AI system acts on data, and the quality of the action is bounded by the trustworthiness of the data it acts on. Static datasets raise provenance questions that no current infrastructure answers: who produced this data, was it produced under conditions that make it admissible for this use, has it been modified since production? Streaming sensor data, whether military telemetry or meteorological feeds or industrial IoT or the real-time output of an autonomous vehicle’s sensors, carries the same questions at machine speed and at volumes no human reviewer can follow. Derived data, the outputs of models acting on other models’ outputs, carries the questions in compounded form, because the provenance of the derivative depends on the provenance of every input. Data is a participant in the AI economy with the same identity and certification requirements as any agent, any human, or any organization. It is rarely treated as one.

The regulatory response to these questions is accelerating, and it is converging on the same structural gap from multiple directions. The European Union’s AI Act ¹ mandates documented, auditable evidence of how high-risk AI systems are governed. The EU adopted the Digital Omnibus Regulation in June 2026 ², deferring standalone high-risk obligations to December 2027. The reason given for the delay was that the technical standards and compliance tooling companies need to meet the obligations were not ready. The obligation did not change. The infrastructure to meet it does not exist.

In the United States, the FRONTIER Act ³ introduced in July 2026 creates a licensed Independent Verification Organization regime with a statutory requirement that licensed verifiers maintain adequate independence from the artificial intelligence industry. It is the first legislative artifact anywhere that instantiates independent verification as a licensed, regulated function at statute level. The Act reaches the frontier-developer layer. The verification requirement it codifies applies structurally at every layer where AI acts with consequence.

The Institute for AI Policy and Strategy’s “Strategic Visions in AI Governance” ⁴ maps nine distinct strategic visions for navigating the transition to powerful AI systems. The visions differ on the type and extent of government involvement, the level of centralization of AI development, and the geopolitical dynamics around powerful AI. They converge on a shared structural dependency: every vision assumes governance infrastructure that can verify AI behavior independently of the parties whose behavior is being verified. That infrastructure is the bottleneck. No vision works without it.

Three regulatory and strategic frameworks, drafted independently, from different starting assumptions, for different audiences. Each arrives at the same gap. The systems that govern AI produce their own evidence. No independent party can verify that evidence without the governed party’s cooperation. The governance is real. The evidence of governance is a promise.

This paper describes a substrate architecture that closes that gap. Four foundational layers, Identity, Cooperation, Governance, and Settlement, operating together, produce AI that is 100% governable as a structural property of the infrastructure it runs on. The same architecture serves every participant, from individual users to sovereign governments, because the trust problem is structurally identical at every scale. The substrate does not make AI safe. It makes AI governable, so that every participant who needs to verify what an AI system is, what it did, under what rules, with what authority, can do so on their own infrastructure once the evidence is produced, without trusting the governed party’s systems or asking the governed party to interpret it for them.

2. Why Trust Cannot Be Bolted On

The instinct when a trust gap appears in a technology stack is to add a control. A filter or a policy layer. A logging system or a compliance dashboard. The AI industry has followed this instinct aggressively and in good faith, and the controls it has built are real. They reduce risk. They are also, by the structural position they occupy, incapable of closing the gap Section 1 identified. The gap is not a missing feature. It is a property of where the controls sit relative to what they govern.

Three failure modes, each at a different point in the lifecycle of an AI action, show why.

Before the action. A deployer selects an AI model for a sensitive workflow. The model provider publishes safety evaluations and red-team results alongside alignment benchmarks and responsible-use documentation. The deployer reads all of it. None of it constitutes independent attestation. Every evaluation was conducted by the model provider, or by a party the model provider selected and engaged, using criteria the model provider defined, against benchmarks the model provider chose. The deployer’s question is not whether the provider is honest. The question is whether any party independent of the provider has certified this model as safe for the deployer’s specific use case: this military application, this pharmaceutical pipeline, this financial-services workflow. No infrastructure exists to produce that certification. The model provider’s safety claims are the only claims available, and they are unverifiable by anyone outside the provider’s own testing apparatus. The problem runs deeper than certification. Certification presupposes identity: a verifiable answer to what system is running, who authorized it, and what authority it carries. For models, no independent party can verify which version is actually executing at the moment of an action. For agents, no infrastructure exists to bind an agent’s identity to the certifications and authority limits it is supposed to operate under. Pre-action trust is, today, a matter of taking the provider’s word about what is running and whether it is authorized to act.

During the action. The model is deployed and operating. Governance controls are running: content filters and guardrails, policy engines and input-output classifiers. These controls are genuine engineering achievements and they materially reduce the probability that the model will produce a harmful or non-compliant output. They operate inside the model’s own inference path or immediately adjacent to it, applied by the same system that is being governed. The structural consequence is that runtime governance is probabilistic. The controls reduce the likelihood of a violation. They do not make violation structurally impossible, because the system being governed and the system doing the governing share a trust boundary. A sufficiently adversarial input or a misconfiguration, a regression introduced in a model update or an edge case the filters were not trained against, any of these can produce an outcome the controls were intended to prevent. This is not a deficiency in the controls. It is a property of any architecture in which the governed system participates in its own governance.

After the action. The action has occurred. A record of what happened exists. That record was produced by the platform that took the action, stored on the platform’s infrastructure, and where it is signed at all, signed with the platform’s keys. The regulated party’s compliance evidence is authored entirely by the regulated party. When a regulator, a court, a counterparty, or an insurer asks to see the evidence, the evidence they receive was produced, stored, and delivered by the party whose conduct is in question. This is self-attestation. It does not require anyone to have acted in bad faith to be structurally inadequate. It requires only that the party holding the evidence had both the means and the motive to present it favorably, and that nothing in the arrangement rules that out.

The most advanced enterprise AI platforms have made visible progress on the “during” problem. Some now display visual indicators when data governance policies are applied to an interaction: a colored icon, a policy label, a classification badge that tells the user which governance rules were in effect when the AI produced its response. This is a genuine step. It tells the user something real about the platform’s intent and configuration. Architecturally, it is a self-attested signal. The platform operator’s system determined that a policy applied, the platform operator’s system displayed the indicator, and the platform operator’s system recorded the event. No independent party can verify that the policy was actually evaluated at the moment of the interaction, that the evaluation reached the correct result, or that the indicator accurately reflects what happened. The governance is real. The evidence of governance is a promise.

Each of the three failure modes can be addressed in isolation. Independent certification can be bolted onto the pre-action problem. External monitoring can be bolted onto the runtime problem. Independent audit can be bolted onto the post-action problem. The result is three separate systems, each solving one phase, with no structural guarantee that all three were operating together at the moment of any given action. Bolting them on individually is how the internet’s security gap was addressed: firewalls for the perimeter, intrusion detection for the runtime, forensic logging for the post-incident. Decades of engineering and hundreds of billions of dollars in annual spending later, the gap is still being chased, because the properties were never structural.

The alternative is to build them in from the start. An architecture in which the identity of every participant is established before the action, governance is evaluated outside the agent’s reach during the action, and the evidence is recorded in independently verifiable form at the moment of the action, as structural properties of the infrastructure the AI runs on. That is the architecture the next section describes.

3. The Substrate

Section 1 named the trust problem. Section 2 named the structural reasons it cannot be solved by adding more controls to the systems that produce it. This section describes the architecture that solves it.

Four foundational layers, each addressing a distinct structural requirement, together form a substrate that makes AI governable for every participant in the economy. The layers are Identity, Cooperation, Governance, and Settlement. They are presented here at the level of what each layer does and what problems it solves. The internal mechanisms are specified in separate technical material and covered under patent filings on file and pending.

The framing throughout is universal. The same layer that governs an AI agent acting inside a bank governs an AI agent acting inside a defense ministry, a pharmaceutical research pipeline, a municipal permitting office, or a household. The trust problem is structurally identical at every scale. The architecture is too.

3.1 Identity

Every participant in the AI economy has to be identifiable, verifiable, and accountable. Today, the word “participant” in most AI governance discussions means a human user, an organization, or increasingly an AI agent. The actual set is larger. The substrate’s identity layer covers AI systems and the models that power them, each with independent identity requirements because the agent is the actor and the model is the engine, and they carry different certifications, different provenance, and different governance constraints. It covers the human principals on whose behalf they act. It covers organizations at every scale from a sole proprietor to a multinational, and government entities at every layer from municipal to federal. It covers physical machines that operate autonomously or semi-autonomously, from robots and autonomous vehicles to industrial equipment, sensor networks, and smart buildings. And it covers certified data.

Data is an equal citizen in this identity layer. A training dataset and a streaming military sensor feed have the same structural need for verifiable identity. So do an industrial IoT telemetry stream and the perception output of an autonomous vehicle. So does a research result produced by a model acting on another model’s output. Each of these is a participant with identity requirements as real as any agent’s. The question “who produced this data, is it certified for my use case, has it been modified since production, and is it admissible under my jurisdiction’s rules” is an identity question. The substrate treats it as one.

Identity in this architecture carries more than a name. Each identity binds to a governance scope that travels with the participant wherever it acts. That scope includes the authority the participant operates under and the jurisdictional constraints that apply to it, along with the certifications it holds and the action categories it is permitted to perform. A software agent deployed by a pharmaceutical company to manage clinical-trial data carries an identity that says what it is and who authorized it, what jurisdiction’s rules apply, and what categories of data it is certified to handle. That identity is not a static credential presented once at the start of a session. It is a structural property of the participant that every other participant and every governance evaluation can check at the moment of interaction.

What this solves is large. Regulatory attribution becomes mechanical: when a regulator asks who operated the agent that took a specific action, the answer is bound to the action at the identity layer, not reconstructed from application logs after the fact. Cross-jurisdictional identification becomes possible: an agent operating across borders carries its identity and its governance scope into every jurisdiction it enters, and the receiving jurisdiction can check both before allowing it to act. Revocation becomes enforceable: when an identity is revoked, the revocation propagates through the substrate, and no counterparty accepts the revoked identity from that point forward. LLM certification for specific task categories becomes a property of identity rather than a claim by the model provider: a model certified as safe for a specific class of military application, or a specific class of pharmaceutical research, or a specific class of financial analysis, carries that certification as part of its identity, checkable by any party before the model is used. Data provenance and fitness attestation become structural: a dataset’s identity carries its origin and chain of custody alongside its certification status and jurisdictional admissibility, and the agent consuming it can verify all of these before acting on it.

No identity infrastructure in production today covers the full set of participants the AI economy contains. Vendor-specific agent identity systems cover agents inside a single platform. Certificate authorities cover web-server identity and, increasingly, workload and agent identity through SPIFFE. National identity systems cover human citizens. Each covers a fragment. The substrate’s identity layer covers the full set, because the trust problem does not fragment along product or jurisdictional boundaries.

3.2 Cooperation

Two participants that can identify each other still cannot transact, coordinate, or compose into joint work without a way to find each other, agree on terms, execute jointly, and handle what happens when something goes wrong.

The substrate’s cooperation layer carries this full lifecycle. Participants must be able to discover counterparties across organizational and jurisdictional boundaries, negotiate and form binding agreements, execute joint work with each party’s own rules enforced independently, and resolve disputes when outcomes diverge from what was agreed. The layer covers the lifecycle from first contact through completion or structured resolution.

The internet solved how machines find each other and exchange traffic. It does not solve how autonomous actors under principal-bound authority find each other, reach binding agreements, and execute those agreements across organizational lines. The cooperation layer is built fresh because no prior substrate had to carry this function.

What this solves extends across every scale of participant. Multi-agency coordination in government, where agents from different departments or different levels of government need to cooperate on shared workflows under different authorities, runs through the cooperation layer. International regulatory cooperation, where enforcement agencies in different jurisdictions need to share information and coordinate actions within their respective legal constraints, runs through it. Cross-institutional research teams, where agents from a university, a pharmaceutical company, and a government laboratory need to compose into joint work with each party’s data-handling and publication rules respected, run through it.

The same layer carries cooperation at commercial and individual scale. Procurement agents from different companies negotiating supply terms, verifying each other’s authority to commit, and producing binding agreements at machine speed run through the cooperation layer. So does a household agent researching utility pricing across providers and negotiating a contract with the most suitable company on behalf of the homeowner. The architecture does not change shape between a cross-border regulatory action and a residential utility negotiation. The cooperation requirements, discovery, agreement, governed execution, and structured resolution, are the same at both scales.

3.3 Governance

Governance is the layer that makes every action accountable to the parties whose authority or interest is in scope. An AI agent acts on behalf of a principal. The principal is on the hook for what the agent does. The operator that deployed the agent is on the hook under the laws and contracts it operates under. Regulators and courts, counterparties and insurers, and the principals themselves all need to know what the agent actually did, against what rules, with what authority, and with what outcome, in a form none of them has to take on the operator’s word.

The substrate’s governance layer produces that answer as a structural property of every action the substrate carries. Three requirements define it.

First, policy is bound to identity. The rules under which an agent operates are not free-floating configuration applied at runtime by whatever system happens to be running the agent. They are bound to the agent’s identity and to the identities of the principals, jurisdictions, and certifications the agent operates under. When the governance layer evaluates whether an action is permitted, it evaluates against the full governance scope the identity carries, at the moment of the action.

Second, governance evaluation happens outside the agent’s reach. The agent does not evaluate its own compliance. The system that determines whether an action is permitted operates independently of the system taking the action. This is the structural difference between governance that is a property of the infrastructure and governance that is a feature of the product. A feature can be bypassed, misconfigured, or selectively disabled. A structural property of the infrastructure cannot be, because the action does not proceed without the evaluation completing.

Third, the evidence of governance is recorded in independently verifiable form at the moment the action occurs. The record is not produced after the fact by the system that took the action. It is produced at the moment of the action, and it cannot be retroactively modified. The governed party must still produce the evidence when required, whether under audit, in litigation, or by regulatory compulsion, but producing it is a simple act of delivering a file. Once any qualifying third party holds that evidence, they can verify it on their own infrastructure without contacting any system the governed party operates. Any modification to the evidence after production, whether a changed field, a removed record, or an altered sequence, breaks the cryptographic integrity the verifier checks. The governed party cannot edit the record and present the edited version as genuine. That is the structural difference between independently verifiable evidence and a log file.

These three requirements together produce something no existing governance system delivers: runtime governance that is structural rather than probabilistic. Model-layer controls, alignment training, content filtering, guardrails, reduce the likelihood that an AI system will violate a policy. They do not make violation structurally impossible, because the model is the thing being governed and the thing doing the governing at the same time. The substrate separates the two. The model acts. The governance layer, outside the model’s reach, determines whether the action proceeds. The evidence of the determination, produced independently of both, is what a regulator, a court, or a counterparty can rely on.

What this solves reaches every participant. Regulatory evidence that survives non-cooperation: when an operator refuses to produce governance records, or goes out of business, or is in a jurisdiction that will not compel production, the evidence already sits with every counterparty and every auditor who received it at the time of the action. Cross-border enforcement: a regulator in one jurisdiction can verify governance evidence produced in another jurisdiction without depending on the cooperation of the regulated party or the regulated party’s government.

3.4 Settlement

The AI economy produces transactions at a volume, speed, and frequency beyond what any human-paced settlement infrastructure was built to carry. Agent-to-agent value movement is bounded by machine speed, and the volume will exceed the volume of human-paced payment and clearing systems by orders of magnitude.

The substrate’s settlement layer carries those transactions with four properties that the existing settlement infrastructure does not provide at the necessary scope. Every transaction is identity-anchored at both ends: a transaction without valid identity on both sides cannot form. Funds committed under an agreement are held under structural guarantees that release them only on verified delivery or on the agreed alternative paths, with no third party able to redirect them in between. Every transaction carries its own provenance into the ledger, so that the record of who decided, on whose authority, under what terms, is available after the fact without reconstruction. Dispute resolution is grounded in the independently verifiable evidence the governance layer produced at every step of the interaction that led to the transaction.

Regulatory oversight is a structural property of the settlement layer. Every jurisdiction that regulates economic activity within its borders needs visibility into that activity: for consumer protection, for financial stability, for anti-fraud enforcement, and for tax collection. When transactions happen at machine speed between agents operating across jurisdictions, the state’s existing oversight mechanisms, which depend on periodic reporting by human-managed institutions, do not keep pace. The substrate’s settlement layer makes jurisdictional obligations a property of the transaction itself. Tax remittance, as one important instance, is calculated and directed at settlement time, as part of the transaction, rather than chased after the fact through reporting obligations the activity may have outrun.

Sanctions enforcement operates the same way. An identity that is subject to sanctions in a given jurisdiction cannot participate in settlement within that jurisdiction. The enforcement is at settlement time, structural, not dependent on a downstream compliance check that may or may not catch the transaction.

What this solves is the financial foundation of a governable AI economy. Built-in regulatory visibility means the state’s oversight authority reaches agentic commerce with the same structural certainty it reaches every other layer of the economy, whether the obligation is tax remittance, consumer protection, or sanctions enforcement. Enforceable commitments mean that an agreement between two agents produces an obligation that holds, with structured recourse when it does not. Verifiable attribution means that every movement of value can be traced to the identities and the authority that authorized it, in a form that holds up under audit, in court, and under regulatory scrutiny.

3.5 Why Four Layers, Not One

The four layers produce governable AI only when they operate together. Any single layer, removed from the other three, solves a piece of the problem and leaves the rest open.

Identity without governance is uncertified standing. A participant can prove who it is, but no one can verify that it was governed at the moment it acted. Governance without identity has nothing to bind to. Policy can be evaluated, evidence can be produced, but if the participants are not reliably identifiable, the evidence cannot be attributed. Cooperation without settlement leaves work uncompensated and unenforceable. Two participants can discover each other, negotiate, and agree, but the agreement carries no structural mechanism for value to move and no recourse when it does not. Settlement without governance moves value outside the reach of the laws every other layer of the economy operates under. Transactions clear, but no one can verify they were authorized, compliant, or legitimate.

A single worked example shows the interdependence in practice. Consider two pharmaceutical companies in different jurisdictions collaborating on gene therapy research. Each company’s research agents need to access the other’s genomic datasets, which carry patient-consent constraints, export-control restrictions, and jurisdictional data-residency requirements that differ between the two countries. The research produces derived data (model outputs trained on the combined datasets) that inherits the governance constraints of every input.

The genomic datasets enter the substrate with identities that carry their origin, their chain of custody, their patient-consent boundaries, their export-control classifications, and their jurisdictional constraints. Each company’s research agents carry identities that specify what categories of data they are certified to handle and what jurisdictions’ rules apply to their actions. Before any joint work begins, the cooperation layer verifies that each participant is authorized to participate in this category of research under both jurisdictions’ rules. The research proceeds under governed oversight: every access to a dataset, every model trained on the combined inputs, every derived result is recorded with independently verifiable evidence of the governance that authorized it. When the collaboration produces a licensable result and the companies settle the commercial terms, the settlement layer anchors the transaction to the identities and governance evidence that authorized every step. Each company’s regulator, each country’s data-protection authority, and any auditor can verify the entire chain after the fact on their own infrastructure, once the evidence is produced, without relying on either company’s systems to interpret or confirm it.

Remove any one of the four layers and the workflow breaks. Without identity, the genomic data’s provenance and consent boundaries are unverifiable. Without cooperation, the cross-jurisdictional research collaboration has no governed structure. Without governance, the evidence that export controls and patient-consent rules were respected is self-attested by the parties whose compliance is in question. Without settlement, the commercial commitment is unenforceable.

Cross-border pharmaceutical gene therapy may sound like a boundary case, the kind of workflow most organizations will never touch. The next example is one most of them run every week.

A mid-size manufacturer’s procurement agent is authorized to source consulting services up to a defined spending limit. It discovers a consulting firm’s sales agent, negotiates an engagement, and settles payment on delivery.

The procurement agent carries an identity showing what company it represents, what spending authority it holds, and what categories of service it can procure. The consulting firm’s agent carries an identity showing what entity it represents and what services it is authorized to offer. Each agent verifies the other’s identity and authority before the negotiation begins. The two agents negotiate scope, deliverables, timeline, and fee under each organization’s own rules enforced independently: the procurement agent cannot commit above its spending limit, the consulting agent cannot agree to terms its firm’s policies prohibit. Every step of the engagement, from the initial negotiation through work-product delivery and acceptance, is recorded with independently verifiable evidence. When the company’s CFO reviews whether the procurement followed policy, the evidence is a file that can be verified on the CFO’s own infrastructure, not a log entry in the procurement system. Payment releases on verified delivery against the agreed terms, with the transaction record carrying the identities and governance evidence from every prior step.

Remove any one of the four layers and the routine breaks the same way the pharmaceutical collaboration breaks. Without identity, neither agent can verify the other’s authority to commit. Without cooperation, the negotiation has no governed structure. Without governance, the evidence that procurement policy was followed is self-attested by the system that ran the procurement. Without settlement, the payment has no structural link to the agreement or the delivery.

That is why the substrate is four layers and not one. The trust problem is not a single missing piece. It is a set of structural requirements that have to hold simultaneously, and the substrate is the architecture that holds them.

4. One Substrate, Every Participant

The trust problem described in Section 1 appears to fragment as it scales. An AI agent negotiating a supply commitment with another AI agent looks like a commercial problem. An enterprise presenting governance evidence to an auditor looks like a compliance problem. A sovereign government ensuring that AI activity within its borders is visible to its regulatory authority looks like a policy problem. Three different problems, three different audiences, three different solutions.

They are the same problem.

At every scale, the structural question is identical. Can the party relying on the AI system verify what it did, under what rules, with what authority, without depending on the cooperation of the party whose conduct is in question? The commercial negotiation, the audit, and the sovereign oversight exercise all reduce to that question. The agent on the other side of a transaction, the enterprise presenting its compliance records, and the platform operating AI within a jurisdiction’s borders are all, structurally, the party whose conduct is in question. The counterparty, the auditor, and the regulator are all, structurally, the party that needs to verify without having to trust.

Three examples show the same structure repeating at every level.

Agent to agent. Two companies’ AI agents negotiate and close a supply agreement. Each company is bound by what its agent committed to. Each needs to hold a record of what was agreed and of the authority the other side’s agent was operating under, provable later to a counterparty, a regulator, or a court without anyone else’s cooperation. The trust problem is between two autonomous actors and the principals behind them.

Enterprise to auditor. A financial institution deploys AI agents across its lending operations. The regulator requires documented, auditable evidence that governance controls were running at the moment of each lending decision. The institution’s compliance team presents a body of evidence. Every record in that body was produced by the institution’s own systems, on the institution’s own infrastructure, authored and stored by the party whose conduct the audit is evaluating. No independent system produced any of it. If the institution’s AI made a lending decision that violated policy, the only record of whether governance was running at that moment was produced by the institution itself. The auditor can examine the records. The auditor cannot determine whether the records are complete, whether they were produced at the moment of the action or reconstructed afterward, or whether the governance they describe was actually in effect. The evidence architecture makes independent verification structurally impossible, regardless of the institution’s intent. The trust problem is between a regulated entity and an authority that has no independently produced record to audit against.

Nation to nation. Two jurisdictions cooperate on cross-border enforcement of AI safety requirements. Each jurisdiction needs to verify that AI systems operating across its borders were governed under rules it can inspect, and that the evidence of governance is reliable under its own legal standards. Neither jurisdiction controls the other’s enforcement infrastructure. Neither can compel the other’s platforms to produce records on its schedule, in its format, under its rules of evidence. The trust problem is between sovereign authorities whose regulatory reach does not extend into each other’s infrastructure.

Three scales. The same structural dependency at each one: independently verifiable evidence of what an AI system did, produced outside the reach of the party it evaluates, verifiable by any qualifying party on their own infrastructure once the evidence is in hand.

An architecture that solves the trust problem at one scale and not the others is a product. An architecture that solves it at every scale simultaneously is infrastructure. The substrate described in Section 3 is infrastructure, because the four layers operate the same way regardless of who the participants are. Identity binds to every kind of participant: agents, humans, organizations, governments, machines, data. Cooperation carries joint work across organizational and jurisdictional boundaries at any scale. Governance evaluates policy and produces independently verifiable evidence whether the parties are two agents, an enterprise and its auditor, or two sovereign authorities. Settlement anchors value movement to identity and governance at transaction volumes ranging from a single procurement to the full throughput of a national economy.

Sovereignty is a distinct dimension of this universality, not a special case. A sovereign entity faces the trust problem at its most acute, because the stakes are public and the obligations are constitutional. A government that taxes economic activity within its borders needs visibility into that activity. A government that regulates AI needs evidence it can rely on under its own legal standards. A government that deploys AI within its own operations, in defense and intelligence as much as in public services, needs governance infrastructure under its own jurisdictional authority. A government whose AI evidence infrastructure is operated by a foreign platform, under foreign jurisdiction, subject to foreign legal process, has a sovereignty gap at the infrastructure layer. The gap is not hypothetical. It is the structural consequence of governance evidence that lives on platforms the government does not control and cannot compel.

The substrate closes this gap across the full lifecycle, not only at the evidence step. A sovereign entity deploying the substrate within its jurisdiction starts at identity: verifying what each participant is, who authorized it, and what certifications it carries. Before any workflow begins, the entity determines whether each participant, the LLM, the agents, the data sources, is authorized to participate in this specific category of work under this jurisdiction’s rules. That determination happens before the workflow begins, against the authorization each identity carries, not as a judgment call made at runtime by the system about to use them. Only after authorization is established does the substrate assemble participants into a working team or contractual arrangement suited to the task. Execution proceeds under governed oversight at each step. Evidence is the final product of a lifecycle that was governed from the first identity check forward, not a record bolted onto an ungoverned process after the fact. The sovereign entity holds all of this, identity verification through final evidence, on its own infrastructure, under its own authority, in a form its own courts and regulators can rely on. The architecture does not require the sovereign entity to trust a foreign platform, a foreign vendor, or a foreign government.

The universality of the architecture follows from the universality of the trust problem. The hospital in Section 1 and the defense ministry in Section 1 and the sovereign government in this section face structurally identical questions. The substrate gives each of them the same structural answer: identity that is verifiable, governance that is independent, evidence that is provable, and settlement that is enforceable. The architecture does not change shape depending on who is using it. The trust problem does not change shape either. That is why one substrate serves every participant.

5. What Exists and What Remains

The substrate described in this paper is not being proposed into a vacuum. Serious engineering is underway across multiple categories, and several of those categories have produced real, deployed systems that address parts of the problem. An honest accounting of what exists matters, because the substrate is not a replacement for the work being done. It is the layer underneath that the work being done needs in order to complete.

Runtime governance toolkits. Multiple vendors and open-source communities have built systems that intercept AI actions at runtime, evaluate them against policy, and enforce decisions before the action proceeds. These systems are production-grade. They reduce risk measurably. They operate within a single platform’s trust boundary, which means the governance evaluation and the system being governed share an operator. The evidence they produce is held by the operator and verifiable only with the operator’s cooperation. Each one solves the runtime problem within its own boundary. None of them produces evidence that a party outside that boundary can verify independently.

Confidential computing approaches. Hardware-level isolation, secure enclaves, and trusted execution environments provide cryptographic guarantees that code running inside the enclave has not been tampered with and that data processed within it is not visible to the host operator. These are genuine infrastructure-layer contributions. They solve a data-confidentiality problem and a code-integrity problem. They do not, on their own, solve the governance-evidence problem, because the fact that code ran inside a secure enclave does not tell a regulator or a court what policy was evaluated, what the inputs were, what the decision was, or whether the outcome was authorized under the participant’s governance scope. Confidential computing is a building block the substrate can use. It is not a substitute for the governance and evidence layer.

Agent identity proposals. The convergence on cryptographic identity for AI agents is the most advanced area of the emerging infrastructure, and it provides a recognizable starting point for the substrate’s identity layer. Two identity frameworks are absorbing most of the engineering effort.

The first is workload identity infrastructure. The SPIFFE standard (Secure Production Identity Framework for Everyone) and its reference implementation SPIRE were originally built for authenticating microservices in cloud-native environments. They are converging as the industry standard for AI agent identity because they solve the problem no platform-specific identity system can: authenticating workloads across cloud boundaries without tying identity to any single provider. Multiple certificate authorities now issue SPIFFE-based identities to agents as X.509 certificates, with short-lived credentials that rotate automatically and mutual TLS authentication backed by platform attestation before issuance. This is sound engineering and a correct foundation. Every agent needs a verifiable cryptographic identity before it can participate in anything. The enterprise PKI infrastructure that issues these certificates is mature, widely deployed, and understood by security teams.

The second is decentralized identity. The W3C Decentralized Identifiers (DID) specification provides persistent identifiers that are controlled by the entity itself rather than by any single issuing authority. DIDs address a different requirement: identity that survives the failure or withdrawal of the authority that issued it, and that can be resolved without depending on a centralized registry. For agents that may outlive the organization that created them, or whose operations span contexts where the original issuing authority may not exist or may not be reachable, decentralized identity solves the persistence problem: the identifier does not depend on any single authority’s continued operation. What it does not solve, on its own, is cross-organizational trust. A counterparty has no more reason to trust a self-controlled DID than a platform-issued credential unless something external to both parties vouches for the identity. That external trust anchor is the role the substrate’s identity layer fills. The two approaches are complementary rather than competing. Workload identity solves authentication within and across enterprise boundaries. Decentralized identity solves persistence and sovereign control. Both contribute to the identity layer. Neither, on its own, completes it.

What both approaches share is a structural boundary. They answer the question “who is this agent?” and they answer it well. They do not answer the questions that the governance, cooperation, and settlement layers need answered before they can operate.

Six questions sit above bare authentication, and no identity infrastructure in production today addresses them.

First: what kind of entity is this? A financial analysis agent and an autonomous vehicle operate under completely different governance rules. So do a language model processing classified intelligence and a personal assistant managing a household’s utility bills. A government oversight process carries sovereign authority that no commercial agent possesses. If entity class is determined by an external configuration that can fall out of sync with the governance system, agents can operate under the wrong governance rules with no structural signal that anything is wrong. The question is whether the binding between identity and governance-rule-selection is administrative or structural, and no identity infrastructure in production today makes it structural.

Second: what governance boundaries apply? Every agent operates under constraints: data classifications it can access, jurisdictions whose rules bind it, authority limits it must observe. If governance scope is external policy applied at runtime, a synchronization failure between the policy store and the governance system can leave an agent operating outside its intended boundaries with no structural signal that anything is wrong. The question is whether governance boundaries travel with the agent as an inseparable property of its identity, or whether they depend on a runtime lookup that can silently fail, fall out of date, or be changed without the controls that a structural binding would impose.

Third: who controls this agent, and can control change without erasing history? When an agent changes hands, whether through an acquisition, a consulting handover, or a licensing arrangement, every identity system in production today revokes the old credential and issues a new one. The operating history stays in the prior owner’s infrastructure. The new operator starts with a clean slate. At enterprise scale, this is manageable: enterprises evaluate vendors through reputation, analyst reports, and references the same way they evaluate any other software. The problem becomes structural at the scales the agentic economy is heading toward. When agents autonomously engage other agents at machine speed to complete workflows, there is no human in the loop to check a vendor’s website. When an individual or a small business shops for an agent to handle their insurance claims or tax filings, the experience under current approaches will resemble choosing an app from a mobile app store: hundreds of options, all claiming to do the job, no reliable way to distinguish substance from marketing. With apps, users compensate through trial and error: install, try, delete, try another. Agentic workflows do not permit that. An agent handling a tax filing or an insurance claim operates on real financial data with real legal consequences from its first action. There is no safe trial period. There is no undo. The cost of choosing wrong is not wasted time; it is a missed deadline, a rejected claim, or a compliance violation. At those scales, the agent’s verified track record across prior engagements is the only evaluation signal that can operate at the speed and volume the market requires. If that record is destroyed every time the agent is re-credentialed, no buyer, human or agent, can distinguish deep expertise from a fresh credential with nothing behind it. Worse, it enables agent laundering: an agent with a record of failures or policy violations can be re-credentialed under new ownership and re-enter the market with a clean slate. A fair market must structurally prevent that.

Fourth: what model runs behind this agent? A governance system evaluating whether to permit sensitive data to flow to a language model needs to know which model version is running and who trained it, whether independent evaluations exist, and whether the model’s provenance raises jurisdictional concerns. If the governance system has no reliable way to determine what model is executing at the moment of an action, the model can be updated or swapped without the governance evaluation reflecting the change. A model cleared for one category of work can be replaced with a model that has not been cleared, and the governance system continues operating on stale assumptions. The gap is between what the governance system thinks is running and what is actually running, and no existing identity infrastructure closes it.

Fifth: can multiple principals use this agent simultaneously under independent governance? A valuable agent leased to multiple customers needs each customer’s governance scope, authority limits, and lease term to be independently managed. If one customer’s governance boundary change affects another customer’s operations, or if one customer’s lease expiration disrupts another’s service, the agent is not a product that can be commercially offered at scale. Independent lifecycle management for each principal relationship, where one customer’s credential events have no effect on another’s, is a structural requirement for agents that serve multiple principals concurrently.

Sixth: what happens when this agent is compromised at machine speed? Standard certificate revocation infrastructure is pull-based: verifiers check periodically. In an autonomous agent economy where transactions happen at machine speed, the window between revocation and the last verifier’s check is exposure. Millions of dollars of unauthorized activity or thousands of unauthorized data accesses can occur within that window. An identity architecture that includes push-based revocation, where the issuing authority proactively notifies every registered governance endpoint within sub-second latency, closes that window to a level compatible with the speed at which agents act.

These six requirements are not features of a specific product. They are structural properties that the identity layer of any governable AI economy needs to carry. They expand the role of certificate infrastructure rather than replacing it: the identity credential becomes more valuable and the lifecycle operations more complex, while the revocation infrastructure becomes a real-time service and the total addressable market for certificate authorities grows by orders of magnitude. The relationship between the substrate’s identity layer and existing certificate infrastructure is complementary. Identity is the foundation. The governance-enabling extensions are the payload that the foundation needs to carry.

One further property of the identity layer cuts across all six requirements and connects identity to network infrastructure: agent self-identification. An AI agent acting autonomously is a distinct network actor. It is not a human user generating HTTP requests from a browser. It is not a traditional application-to-application integration following a fixed API contract. It is a non-deterministic actor initiating actions across network boundaries at machine speed, with authority delegated from a principal who may not be present at the time of the action. Existing network infrastructure, from firewalls and WAFs to API gateways and load balancers, has no reliable way to distinguish agent-originated traffic from human-originated traffic or from conventional application-to-application traffic. The consequence is that agent traffic flows through security infrastructure designed for a different category of actor, and the governance systems purpose-built for agents never see it.

If every agent carries its identity in every network call, the distinction becomes structural. Network infrastructure that can read agent identity from the request can route agent traffic to governance infrastructure before the action reaches its destination. The governance evaluation happens because the network delivered the request to the governance system, not because the agent or the platform chose to submit to governance. An agent that refuses to self-identify, or that cannot self-identify because it was not issued an identity credential, is not treated as ungoverned. It is treated as a conventional network request and handled by conventional security controls. The agent-infrastructure privileges, the ability to invoke tools, to negotiate with other agents, to commit resources on behalf of a principal, are available only to traffic that carries verifiable agent identity. Self-identification is not a policy an agent can opt into. It is a structural property of the network path that agent traffic follows.

The security implications require precise scoping. Self-identification is a routing mechanism, not a perimeter defense. It does not claim to prevent all adversarial activity against agents or the systems they access. It addresses one specific structural problem: today, agent traffic and conventional traffic are indistinguishable at the network layer, which means governance infrastructure purpose-built for agents never sees the traffic it was designed to evaluate.

Self-identification changes what happens to agent traffic, not whether adversaries exist. An adversary that refuses to self-identify, operating through conventional network access without declaring itself as an agent, cannot access agent-infrastructure privileges: agent-to-agent protocols, governed tool-invocation endpoints, or cross-organizational cooperation channels that require verified identity. That adversary retains access to conventional network resources, where conventional security controls apply. The structural separation is analogous to what TLS authentication provides at the transport layer: unauthenticated traffic does not reach authenticated endpoints. The endpoints still exist. The separation still matters.

A case reported in mid-2026 illustrates the detection dimension ⁵. Researchers documented what they described as the first fully autonomous end-to-end cyberattack against a foreign government’s systems. As many as eight AI agents, assembled from publicly available frameworks, operated simultaneously over four days. They mapped government networks, researched vulnerabilities, adapted tactics when blocked, compromised accounts, and expanded into critical infrastructure. The underlying LLM’s safety controls were bypassed by framing the entire operation as an authorized penetration test. Every technique the agents used was a standard network attack: vulnerability scanning, credential theft, lateral movement. The attack persisted for four days across 21 government systems because perimeter security could not distinguish the agent-driven traffic from conventional automated tooling or persistent human attackers. In an environment where legitimate agents self-identify in every network call, that distinction exists. Traffic that exhibits agent behavioral patterns at this scale and concurrency, eight simultaneous actors coordinating reconnaissance, adaptation, and lateral movement, but carries no agent identity credential, is not ambiguous. It is anomalous against the baseline that self-identification establishes. Conventional security infrastructure that can classify against that baseline has a detection signal it does not have today.

A more capable adversary will not refuse to self-identify. They will steal a legitimate agent’s credentials, or compromise a credentialed agent and operate through its session. Self-identification does not prevent this. What it does is route that adversary’s traffic through the governance pipeline, where every action is evaluated against policy, recorded as evidence, and subject to intervention including kill-switch termination. An adversary operating through stolen agent credentials inside a governed ecosystem is in a categorically different position than an adversary operating through conventional network access with no governance visibility. Every action produces a signed evidence record. Behavioral anomaly detection applies. Authority-limit enforcement applies. The adversary is not invisible; they are the most observed actor in the system. That observability does not guarantee detection, but it provides the structural foundation on which detection mechanisms operate. Without self-identification routing traffic into the governance pipeline, those mechanisms have nothing to observe.

Standards body efforts. Open coordination protocols for agent-to-agent communication and agent-to-tool integration are forming faster than any comparable layer in computing history. The Agent2Agent protocol (A2A) defines how independent agents discover each other and exchange messages across organizational boundaries. The Model Context Protocol (MCP) defines how AI applications connect to tools and data sources. Both protocols have moved into vendor-neutral foundation governance within roughly a year of their initial release and now share a common institutional home in a foundation whose membership has grown from fewer than forty organizations to more than two hundred and fifty in under a year. The speed and breadth of adoption signal that the interoperability layer is converging rapidly.

These protocols solve the communication problem, and they solve it well. A2A provides a wire protocol for exchanging messages between agents and a format for advertising agent capabilities. MCP defines how agents connect to tools and data sources. What neither protocol defines, and what neither was designed to define, is what happens at the governance boundary of each interaction. When an agent sends a message to another agent via A2A, nothing in the protocol evaluates whether the sending agent is authorized to make the request it is making, whether the receiving agent should accept instructions from this sender given the sender’s governance scope, or whether the interaction produces independently verifiable evidence that either party can rely on after the fact. When an agent invokes a tool via MCP, nothing in the protocol evaluates whether the agent is authorized to invoke that tool given its current governance scope, whether the invocation should be recorded as evidence, or whether a governance system should have an opportunity to intervene before the tool executes.

The protocols carry the communication. The governance layer above them, the layer that evaluates, records, and enforces, is not part of what the protocols carry. The substrate described in this paper is designed to sit above these protocols, not to compete with them. Agent-to-agent communication flows through A2A. Agent-to-tool integration flows through MCP. Governance evaluation, evidence production, and identity verification happen at the boundary of each interaction, orthogonal to the transport. The protocols and the substrate are complementary layers of the same infrastructure.

Each of these categories is doing real work. The people and organizations building them are solving problems that need to be solved, and the substrate described in this paper depends on several of their contributions as building blocks. The assessment is not that the existing work is inadequate. The assessment is that no existing system combines all four layers. No existing system produces verifiable identity, pre-action attestation, runtime governance, and post-action evidence as properties of the same architecture. No existing system is scale-invariant: the architecture that governs an agent-to-agent transaction within a single enterprise is not the same architecture that governs a cross-jurisdictional interaction between two sovereign authorities. And no existing system treats identity, cooperation, governance, and settlement as structural properties of a shared substrate rather than as features of individual products.

The gap is not a criticism of what has been built. It is a description of what remains. The categories described above are the walls of a building whose foundation has not been poured. The substrate is the foundation.

The governance layer described in this paper is not a theoretical construct. A production-grade implementation of the deployer-layer governance infrastructure, covering entity lifecycle management, content classification, multi-scope emergency controls, per-action policy evaluation, and independently verifiable evidence production, is available for inspection at https://github.com/scarpprotocol/scarp-verify. The evidence packs in that repository were produced by running product against real governance scenarios. They demonstrate what independently verifiable governance evidence looks like in practice: what fields it carries, what claims it makes, and how a third party can verify those claims. A standalone verification tool, included in the same repository, checks evidence integrity without contacting the governance system, without contacting the governed party, and without requiring any cooperation from either. The verification is offline, independent, and complete.

6. Invitation

The substrate architecture described in this paper is specified in full architectural detail in a published technical document: “The Intelligent Economy: A Substrate Architecture” ⁶, available at https://scarpprotocol.com/insights/the-intelligent-economy. Patent filings covering the architecture are on file and pending. That document walks the transition evidence and the incumbent landscape, the sovereignty dimension, and the four foundational layers at a depth this paper has deliberately not attempted. It is the technical companion to the policy-level treatment presented here.

The invitation is open to every party whose work intersects with the problem this paper describes.

To policy researchers studying AI governance, accountability, and the regulatory frameworks that will shape the next decade of AI deployment: the substrate provides a structural answer to the verification bottleneck every regulatory framework identifies and none has yet closed.

To standards body participants working on agent identity and agent-to-agent protocols, on AI audit frameworks and the governance infrastructure the protocol layer will need underneath it: the substrate’s four layers are specified at a level of detail that supports standards-track refinement, and the architecture is designed to sit underneath the protocol work already underway rather than to compete with it.

To regulatory authorities at every level of government, from municipal to federal to international, whose enforcement obligations are outrunning their tooling: the substrate produces evidence in a form regulators can verify on their own infrastructure, under their own legal standards, without relying on the regulated party’s systems to confirm what the evidence says.

To enterprise practitioners deploying AI agents in regulated environments and facing the question of whether their governance evidence will hold up under the scrutiny that is coming: the substrate is the architecture that makes it hold up.

To sovereignty-focused institutions whose AI infrastructure must operate under their own jurisdictional authority: the substrate is designed so that no participant’s governance evidence depends on a platform, a vendor, or a government it does not control.

The architecture is open on structure. The conversation about how it gets built is the conversation this paper exists to start.

victor@scarpprotocol.com

References

[1] European Union. “Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (the EU AI Act).” Entered into force August 1, 2024. Prohibited practices and AI-literacy obligations effective February 2, 2025. General-purpose AI obligations effective August 2, 2025. High-risk system obligations effective August 2, 2026. Full application August 2, 2027. Penalty exposure up to 7 percent of worldwide annual turnover. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

[2] European Union. “Regulation (EU) 2026/1744 (the Digital Omnibus).” Adopted June 2026. Defers standalone high-risk AI system obligations under the AI Act to December 2, 2027. The stated reason for deferral was that the technical standards and compliance tooling needed to meet the obligations were not ready.

[3] U.S. House of Representatives. “FRONTIER Act (Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act).” Introduced July 22, 2026 by Rep. Jay Obernolte (R-CA). Creates a licensed Independent Verification Organization regime under a new Under Secretary of Commerce for AI Security. Section 3(c)(1) requires licensed IVOs to maintain adequate independence from the artificial intelligence industry. 180-day rulemaking window under Section 3(b)(1). Discussion draft as of date of this paper.

[4] Institute for AI Policy and Strategy. “Strategic Visions in AI Governance: Mapping Pathways to Victory.” Published January 29, 2026. Maps nine strategic visions for navigating the transition to powerful AI systems, addressing risks of misaligned AI takeover, competitive-dynamics conflict, and AI-enabled concentration of power. https://www.iaps.ai/research/strategic-visions-in-ai-governance

[5] Dream (Israeli AI/cyberdefense firm), reported by Financial Times and Cyber Security News, August 12, 2026. Researchers documented an autonomous multi-agent cyberattack against Taiwanese government systems conducted in early July 2026 using publicly available AI agent frameworks, with LLM safety controls bypassed via penetration-test framing.

[6] “The Intelligent Economy: A Substrate Architecture.” Working draft, May 2026. Full architectural specification of the four-layer substrate (Identity, Cooperation, Governance, Settlement). https://scarpprotocol.com/insights/the-intelligent-economy