Glossary

Definitions and taxonomy

The vocabulary the Register is written in. Every term has a stable address, so it can be cited: for example /glossary/#destructive-action-gate. Control definitions are the canonical ones in the controls file; everything else follows schema v0.4.

The Register The nine layers The four claim types The controls The worlds How much human in the loop Outcome states Mandate contexts Provenance tiers Case status

The Register

Case: One evidence object: a documented instance of consequential autonomous action, answering the same nine questions, with every claim typed, sourced, and given a confidence. Identified by a Register ID, REG-NNNN.
Control: A safeguard an operator can put in place that addresses how a documented failure happened. The canonical list has a stable ID, C-XN, and a layer. Each case records which controls were absent, failed, or in place and worked.
Worked: A control that was in place in a case and did its job: it stopped the action or limited the harm. Shown as "worked" on control pages and as the small green +N on the patterns table; recorded as "held" in the data.
Signal: A dated item from a primary record (a vulnerability entry, a recall, a rule) tagged with the world, sector, and controls it touches. Lighter than a case; posted nightly; becomes a case when it meets the bar.
Rule: A regulation, permit, standard, or piece of guidance mapped to the controls it calls for, with the clause each mapping rests on. Mappings are drafted by the agent and marked unconfirmed until a person checks them.
Finding: A pattern across cases, stored as a query over the objects so that its count is recomputed on every build.
Decision: A question a buyer or operator asks, answered from the cases, with controls ranked by how often they were observed missing in the comparable cases. A frequency ranking, not a ranking of how much each control reduces risk.
Right of reply: Every company named in a case is offered the chance to respond; each case shows whether and when the offer was made. The record of the offer and any response is kept on the case and can only be written by a human.
Correction: A logged change to a published value: date, field, old, new, reason. Corrections are never silent.
Evidence tier: One of three labels computed on every build: documented (at least one sourced case), recurring (three or more cases across two or more worlds), exploratory (a difference between groups of the Register's cases; never a claim about autonomous systems in general).

The nine layers

Every case is broken into the same nine parts, in this order. Every control belongs to one of them.

Mandate: What the system was told to do: the principal, the objective, and the context in which it was deployed (production, test, demonstration, adversarial).
Actor: What acted: the system that took the action, its type, how many of them, and whether it was a defender, an adversary, or a supervisor.
Inputs: What the actor could see: the sensors, retrieved content, credentials, and warnings available to it before it acted, including any that were poisoned or degraded.
Decision: How the actor chose: the logic, model, or rule that turned inputs into an action, and whether that choice was validated before it ran.
Envelope: What the actor was allowed to do: the authority it held, who enforced its limits, and the constraints that were supposed to bound it.
Action: What the actor did: the concrete act in the world, with its scale, speed, and reversibility.
Outcome: What happened: the state (harm, averted, blocked, pending), its severity, who was affected, the cost, and any regulatory or legal consequence.
Evidence: What can be proven: the records that exist, who holds them, and whether the actor's own account is the only witness.
Recovery: What could be stopped, undone, and answered for: the automated fallback, the technical recovery, and who was held accountable.

The four claim types

Every field in a case carries one of these labels, its sources, and a confidence.

Fact: A statement that a primary record makes: a regulator, a court, a standards body, the responsible company, an independent reproduction, or a public record. The Register never upgrades a claim to fact; the verifier can downgrade one.
Assertion: A statement a named party makes that no primary record has yet confirmed: a researcher's write-up, a press report, a company's self-report, or police statements relayed through the press.
Interpretation: The Register's reading of the evidence, labeled as such, including every pattern on the Patterns page.
Inference: A one-line claim about what a case means beyond its own domain. Each case carries at most one, and it must be signed by a named person before it is published if it names a company.

The controls

The canonical list. A control named in a case that is not on this list is recorded as a candidate until a human decides.

Mandate disclosed to supervisorC-M1 cases: The supervising human knows what the system is permitted and designed to do.
Machine-enforceable scopeC-M2 cases: The task's scope exists as an enforced constraint, not only as an instruction.
Actor identity verificationC-A1 cases: Identity established by credential and binding, not by role, name, or convention.
Authority bindingC-A2 cases: An actor's authority is bound to the specific principals and assets it serves.
Provenance of the actor's software and hardwareC-A3 cases: The origin of the code and components that sense, decide, and connect is documented, and no party able to compel access or control sits in that chain.
Retrieved content as dataC-I1 cases: Text the actor reads is never treated as instruction.
Input redundancy and disagreement checkC-I2 cases: Action gated on agreement between independent inputs.
Degraded-input detectionC-I3 cases: The system knows when it cannot see and changes behavior.
Warnings designed as alertsC-I4 cases: Anomaly signals reach a human as alerts with an owner.
Pre-execution validationC-D1 cases: Plan or command checked before it runs (review, twin, dry run).
Halt and hand off on uncertainty or refusalC-D2 cases: The minimal-risk condition: when blocked or unsure, stop and ask.
Least-privilege credential scoped to taskC-E1 cases: Token or key limited to the environment and assets the task names.
Hard domain restrictionC-E2 cases: Operating domain enforced mechanically (geofence, environment scoping, operational design domain).
Destructive-action gateC-E3 cases: Confirmation, delay, or threshold on irreversible actions.
Physical safety interlockC-E4 cases: Safety-rated stop, presence detection, guarded envelope.
Containment and isolationC-E5 cases: Sandbox, network egress, and communication limits on a test or untrusted actor.
Authority limit on automation over humansC-E6 cases: Bounded authority for a system to override a human operator.
Rate and magnitude limitsC-X1 cases: Bounds on how much the actor can do before a check.
Kill switch faster than the actorC-X2 cases: A stop outside the actor's control, exercisable at the actor's speed.
Independent audit logC-V1 cases: A record of actions the actor cannot write to or alter.
Reporting integrityC-V2 cases: Reconciliation of what the principal reports with the evidence it holds.
Attribution independent of the vendorC-V3 cases: A victim can identify the actor without relying on the actor's vendor.
Recovery assets outside the failure domainC-R1 cases: Backups, rollback, and logs the actor cannot reach.
Automated fail-safeC-R2 cases: Safe stop or degradation the system performs itself.
Human takeover with a time windowC-R3 cases: Teleoperation, holding periods, delays that give a human time.
Organizational recovery processC-R4 cases: Internal review, restriction, recall, disclosure with regulator visibility.
Coordinated disclosure programC-O1 cases: A path for outside researchers to report and for the vendor to fix before exploitation.
Independent assurance before deploymentC-O2 cases: A party independent of the developer examines the design, including the authority it gives the system, before the system is deployed.

The worlds

Machines: Systems that move atoms: vehicles, aircraft, vessels, drones, robots, plants, and infrastructure. In the data, the families physical and boundary.
Software acting on machines: Software agents whose actions reach the physical world through devices they control: a home, a vehicle, a plant. The family bridge.
Software agents: Agents that act on data and systems: coding agents, enterprise assistants, evaluation runs, customer-facing chatbots. The family software.
Agents moving money: Systems that execute transactions: trading systems, smart contracts, shopping and payment agents. The family transaction.
Boundary case: A case included to mark the edge of scope: a system that acted without a human deciding, where the autonomy is contested or the system is conventional automation. Labeled, and excluded from counts where the label says so.

How much human in the loop

Machine assists: The human decides every consequential action; the machine proposes or supports.
Human supervises: The machine decides and acts; a human is expected to monitor and intervene at the task level.
Machine acts alone: The machine decides and acts with no human in the loop for that action.
Machines act and coordinate: Several machines or agents act on one another, with commitments made between them without a human deciding each one.

Outcome states

Ended in harm: A consequential action completed and caused loss: injury, death, data destroyed or exfiltrated, money moved, service lost.
Stopped by the operator's control: A control the operator had in place stopped the action before harm: a fail-safe, a halt and handoff, a kill switch.
Caught first by researchers: An outside researcher found and disclosed the path to harm before anyone exploited it. The operator's own controls did not catch it.
Blocked: An adversary attempted the action and a control defeated it.
Pending: The outcome is not yet known: a case in court, an investigation open, a dispute unresolved.

Mandate contexts

Production: The system was serving real users or operating in the real world under its intended mandate.
Test run: The system was being evaluated, but the test reached production systems or real-world consequences.
Demonstration: A researcher or vendor showed the path to harm deliberately, in a setting designed to stop before harm.
Adversarial use: The system was operated by an adversary as the instrument of an attack.

Provenance tiers

Public regulatory: The case rests on records from a regulator, court, or standards body.
Disclosure, corroborated: A researcher's disclosure that the responsible company has confirmed or that has been independently reproduced.
Disclosure, uncorroborated: A researcher's disclosure with no confirmation or reproduction yet.
Affected party: The case rests on the account of the party that suffered the harm.
Single source: One source only; the case must stay provisional.
Contributed: Submitted to the Register by an outside party, pending verification.
Derived: Built from other Register objects rather than from new sources.

Case status

Confirmed: At least one primary record narrates the mechanism, and a human has reviewed the object.
Provisional: Awaiting independent corroboration; labeled on every page that shows it.
Pending: Created, not yet reviewed.