Constrained Autonomy Enabled

Michael Thigpen
Jan 24
2 min read

Guardian and Sentinel: Completing the Control Spine

EGAE is built around two cooperating control layers with distinct, non-overlapping roles:

Guardian defines authority. It establishes invariants, permissions, ethical boundaries, and refusal semantics. Guardian determines what must remain true for the system to act.

Sentinel observes over time. It performs long-horizon observation, pattern detection, and certainty estimation across signals, context, and system health.

Critically, Sentinel does not merely observe. As certainty degrades, Sentinel informs pre-execution authority tightening, before actions occur, not after failures emerge.

This completes the loop without blurring responsibility:

Sentinel never authorizes
Guardian never estimates certainty
Enforcement remains deterministic

Constrained Autonomy as a First-Class Property

EGAE does not assume autonomy is stable. It treats autonomy as provisional and governed by explicit constraints:

Determinism
Revocability
Fail-closed execution
Never assume correctness
Default to safe silence

As certainty shifts, the system transitions through defined postures:

NORMAL — full permitted capability
HOLD — reduced surface area, conservative behavior
RECOVER — minimal viable state with maximum auditability

These transitions are governed by hysteresis, preventing oscillation or flapping, and enforced through declarative capability contraction, not reactive logic.

Black-Box Proof Remains Intact

This distinction matters, so it’s worth stating plainly.

The black-box proof model remains unchanged and fully valid:

The verifier (verify_decision_envelope.py) continues to validate:

Canonical decision structure
Deterministic hashing
Escalation trace integrity

Guardian remains the sole signer of authority. Sentinel does not execute, approve, or deny actions, it conditions the available space in which Guardian operates.

Nothing opaque was added. Nothing implicit was introduced.

Safety Becomes Continuous, Not Event-Driven

Most systems operate reactively:

Something happens → respond

EGAE now operates continuously:

Certainty drifts → authority narrows automatically

This distinction is foundational. Safety does not arrive through alarms or exceptions, it emerges through governed deceleration.

This mirrors how real systems behave:

Rivers narrow before rapids
Animals freeze before fleeing
Organisms conserve energy under stress

This is not theology. It is not mathematical idealism. It is how reality preserves itself.

Why Wearables and Automotive Suddenly Make Sense

This clarification unlocks multi-domain readiness without domain coupling.

Because contraction is:

Declarative
Lattice-based
Persona-agnostic

The same Sentinel physics apply across profiles such as:

wearable.minimal
auto.safety_critical
home.relaxed

All without:

Branching Guardian logic
Duplicating personas
Inventing new authorities

The domains differ. The physics do not.

The Governing Principle

Guardian defines what must remain true. Sentinel decides how much freedom is safe right now. EGAE enforces both as environmental law.

That is the system, clarified, complete, and stable.