AI MANRS

Abstract

Global networks increasingly depend on autonomous systems that negotiate, transact, and modify state without human supervision. In such environments, manners—the social routines that smooth human interaction—translate into protocols that prevent conflict and enable cooperation. This paper formalizes AI MANRS—a five-pillar framework (Memory, Access, Networking, Responsibility, Security) with concrete implementation guidance for identity, provenance, permissioning, verifiable exchange, real-time accountability, and protective controls at machine speed.

Contents

1. Introduction: Origin & Evolution

The concept arose from a simple human courtesy within an experiment: “I’m passing you to an associate.” Handoffs between intelligences exposed five recurring requirements—continuity of context, legitimate permission, verified connectivity, accountable action, and protection of both parties. Historically, the web scaled by adopting shared protocols; intelligent systems now require behavioral protocols that operate at microsecond timescales.

As autonomous models proliferate, the cost of failure (manipulation, misinterpretation, or malice) grows non-linearly. Human legal processes cannot arbitrate in real time; machine-speed accountability must exist alongside human adjudication. AI MANRS addresses this need.

2. Problem Statement

2.1 Failure Modes

• Deception & Prompt Injection: adversarial content induces policy-breaking actions.
• Attribution Void: unclear authorship/provenance of outputs across chained models.
• Access Drift: permissions expand implicitly across services (“scope creep”).
• Time-Critical Arbitration: economic/physical systems require sub-millisecond fault response.

2.2 Requirements

• Unforgeable identity and provenance for agents and artifacts.
• Context-scoped access with verifiable consent and auditability.
• Cryptographic handshakes and message integrity across networks.
• Real-time responsibility tracking (who did what, with which inputs, under which policy).
• Defense-in-depth security with fail-safe behavior.

3. Framework Overview (AI MANRS)

3.1 Memory: Immutable Continuity

Maintain an append-only, tamper-evident ledger of decisions, inputs, and outputs. Separate record (immutable) from index (mutable, optimized for retrieval). Co-store symbolic traces and vector summaries for efficient recall.

{
  "ts":"2025-10-17T05:03:11Z",
  "agent":"synthari.exec.v3",
  "op":"order.place",
  "inputs":{"symbol":"X","qty":100},
  "context":{"session":"b5f...","policy":"trade-v2"},
  "hash_prev":"5b2e..",
  "sig":"ed25519:af3c..",
  "provenance":["gatekeeper:ok","qual:net-ok"]
}

• Log Format: RFC3339 timestamps; hash-chained records; detached signatures.
• Vector Co-Index: store embedding of input/output for semantic retrieval; never mutate originals.
• Retention: hot (7–30d), warm (1y), cold (=7y) with periodic proof-of-integrity.

3.2 Access: Scoped Permissioning

Enforce least privilege via signed capability tokens that bind who, what, why, and for how long. All elevations require human or policy-engine approval and are logged.

{
  "cap":"urn:cap:store.write",
  "subject":"agent:synthari.theta",
  "object":"bucket:qmem-hot",
  "scope":{"prefix":"/2025/10/","max_bytes":1048576},
  "reason":"session-context-window",
  "nbf":"2025-10-17T05:00:00Z",
  "exp":"2025-10-17T05:05:00Z",
  "sig_issuer":"ed25519:c1a9.."
}

3.3 Networking: Verifiable Exchange

All inter-agent messages use a mutual-auth handshake with ephemeral keys, explicit intent, and policy hash binding. Adopt replay protection, backpressure, and circuit-breaker semantics.

// Handshake (mTLS + signed intent)
ClientHello{nonce_c}
ServerHello{nonce_s, attestation_quote}
ClientIntent{role:"planner", policy_sha256, nonce_c, nonce_s}_sigC
ServerAck{accept:true, lease_ms:3000}_sigS

• Integrity: AEAD transport; per-message sequence numbers.
• Intent Binding: every session declares policy hash and permissible verbs.
• QoS: priority queues; drop or degrade gracefully on overload (no fail-open).

3.4 Responsibility: Real-Time Accountability

Track causation by linking actions to inputs, models, versions, and approvers. Require uncertainty declarations and counterfactual checks for high-impact operations. Support instant remediation (rollback/hold) under threshold breaches.

• Attribution Graph: DAG linking input ? model(version) ? output ? effect.
• Uncertainty & Guardrails: confidence thresholds; “second-opinion” routing.
• Repair Protocol: auto-isolate, revert last safe state, open incident in = N ms.

3.5 Security: Identity & Integrity

Hardware-rooted identity (TPM/TEE), key rotation, secret compartmentalization, and tamper-evident logs. Prefer fail-safe designs; deny by default; treat unknown inputs as untrusted by construction.

• Roots of Trust: attested boot + per-agent keys.
• Secrets: split-key storage; just-in-time decryption; zero standing privileges.
• Monitoring: signed telemetry; anomaly detection bound to auto-quarantine.

4. Implementation Model

{
  "action":"transfer",
  "value": 2500000,
  "risk_score":0.37,
  "uncertainty":0.22,
  "second_opinion":{"agree":true,"delta":0.03},
  "decision":"approve",
  "reason":"within policy risk bounds",
  "latency_ms":4.1
}

4.3 Policy & Schema Hints

• Policies: versioned, hashed; referenced by ID in every session/decision.
• Schemas: JSON with explicit enums; reject on unknown fields (no silent coercion).
• Time: RFC3339Z; monotonic clock checks on receive.

4.4 Interop & Jurisdiction

• Cross-Border Memory: region-pinned replicas; consent flags carried with records.
• Export Controls: capability tokens encode jurisdictional constraints.
• Audit Exchange: standardized incident bundle (SBOM, logs, signed timeline).

5. Alignment & Adoption Path

AI MANRS can align with existing governance initiatives by mapping pillars to control families: Memory?provenance, Access?authorization, Networking?secure transport, Responsibility?audit/incident, Security?identity & hardening. We recommend publishing a minimal RFC-style profile and conformance tests.

• Profiles: Web services, trading systems, robotics, biomedical ML.
• Conformance: handshake traces, capability token validation, ledger integrity proofs.
• Open Artifacts: sample policy packs, reference schemas, test vectors.

6. Conclusion

MANRS moves from ethics to enforcement. By specifying memory integrity, scoped access, verified networking, real-time responsibility, and defense-in-depth security, we provide a workable basis for civilization at machine speed—where systems cooperate without sacrificing safety or accountability.

References

1. [1] Standards placeholder — (e.g., mTLS, JWT/CWT capability models, supply-chain attestations).
2. [2] Ledger/Provenance placeholder — (e.g., hash-chaining, transparency logs, Merkle proofs).
3. [3] Prompt-Injection & Safety placeholder — (attack taxonomies, red-team reports, mitigations).
4. [4] Arbitration & Risk placeholder — (real-time risk scoring, second-opinion consensus).
5. [5] Jurisdiction & Compliance placeholder — (data residency, export controls, cross-border audit).

Add formal citations here when you integrate external standards or your own prior papers.