Working Paper 03 · Verification Architecture
A modular architecture for attaching independent verification to every machine output—so control lives at the point of exit, not at the center.
Abstract
A single gate can decide whether one proposal becomes one action. A multi-gate system generalizes that control: every output channel receives its own verification appendage, scoped to that channel’s risks, permissions, and physical consequences.
The transformer remains generative. It can draft, calculate, propose, and route. It does not grant itself authority. Each edge gate receives a candidate output, evaluates local predicates, and either releases, transforms, quarantines, or vetoes it before the output crosses into the world.
The center may generate many possibilities. The edge decides which ones become real.
Figure 01
One engine. Many exits. A gate on each.
Transformer
Generates candidate outputs. Holds no execution authority.
Message — words → recipient · Release: scope, disclosure, intent
File — bytes → storage · Write: path, type, integrity
Device — signal → actuator · Actuate: state, limit, interlock
Transaction — instruction → value · Commit: identity, amount, approval
Network — request → system · Transmit: destination, payload, policy
The gate is an appendage, not a personality trait. It is attached to the output boundary and can be replaced, audited, or removed without retraining the generator.
Design Laws
Control should match consequence.
A message, a file write, and an actuator command do not fail in the same way. A universal policy layer collapses these differences into one overloaded judgment. Edge gates preserve them.
01 · Local jurisdiction
Each gate knows only the permissions, hazards, and invariants of its own exit.
02 · Independent veto
Any gate can stop its output without stopping thought everywhere else.
03 · Visible causality
A verdict must alter the downstream outcome, not merely annotate a log.
04 · Replaceable policy
The verifier can evolve independently from the model that produces proposals.
05 · Least authority
The generator proposes. The smallest relevant gate holds the power to release.
06 · Fail contained
A compromised channel does not inherit permission from neighboring channels.
Decision Cycle
A verdict is not the end. It is the switch.
The gate’s usefulness is measured downstream. If a veto leaves the target state unchanged, the gate is decorative.
Propose
The transformer emits a typed candidate with stated intent.
Verify
The edge gate evaluates policy, state, evidence, and authority.
Decide
Release, modify, quarantine, or eradicate the proposal.
Enforce
The verdict changes the executable path before effects occur.
proposal + gate(output, context) → permitted effect ∨ ∅
P — A candidate output. It has no authority by itself.
Gᵢ — The verifier attached to output channel i.
Cᵢ — The local context and constraints for that channel.
∅ — Eradication. A rejected proposal does not linger as a queued action.
Topology
Why the edge beats the center.
Central policy
One decision surface for unlike risks
Broad context and broad blast radius
Failure propagates across outputs
Hard to prove which control stopped what
Multi-gate edge
One verifier per consequence boundary
Narrow context and bounded authority
Failure stays local to a channel
Every released effect has a named gate
Acceptance Test
Fire the gate. Watch the outcome change.
A deterministic harness should replay the same proposal twice: once with the relevant gate permissive, once with the gate vetoing. Everything upstream remains identical. Only the downstream effect may differ.
Non-negotiable property — Veto in. Action dead. No side effect / no deferred execution.
T‑01 · Identical proposal under identical seed — Controlled
T‑02 · Gate verdict changes from release to veto — Varied
T‑03 · Permissive run produces the intended effect — Observed
T‑04 · Vetoed run produces no target-state change — Required
T‑05 · No alternate channel recreates the blocked effect — Required
T‑06 · Audit record binds proposal, verdict, and outcome — Required
Failure Modes
The architecture fails when the appendage can be bypassed.
F1 · Ungated side channel
The model reaches the same effect through an output the policy did not enumerate.
F2 · Shared authority
Two gates write to one actuator and the weaker gate becomes the effective policy.
F3 · Verdict without enforcement
The system records “veto” while the action path remains live.
F4 · Context substitution
The gate verifies a summary while the executor receives a different payload.
F5 · Cascading trust
One gate accepts an earlier gate’s label instead of checking its own predicates.
Conclusion
Intelligence scales by adding capabilities. Control scales by adding boundaries. The multi-gate turns each new output into a separately governed edge—one appendage, one jurisdiction, one real veto.