The institutional world model

Evidence and its limits

The ownership task learns from normative rulings. A fraud detector learns from empirical findings. Suspicion, referral, investigation, judgment, reversal and missing evidence record different things. Predicting an official’s approval confers no official power. Predicting fraud establishes no finding.

The institution’s decisions shape the evidence available for learning. Admission determines which actions occur, and investigation determines which outcomes receive labels. Refusal supplies no finding about what the proposal would have caused.

Suppose a gate refuses 100 of 1,000 proposals. Nine of the 900 permitted proposals receive confirmed fraud findings. Even if findings are complete for those admitted cases, the refused outcomes remain unknown. Under fixed potential outcomes and no interference, permitting every proposal could yield a fraud rate between 0.9% and 10.9%. Both extremes agree with the observed record. Provenance cannot supply the missing outcomes.

Even observed information can be lost in a summary. Two histories may have identical transfer counts and compliance grades while only one contains a cycle. That cycle supplies a feature to investigate, not a fraud finding. The representation must preserve the relationships needed for the institution’s questions.

That may require records about people or entities. Exporting a model without raw rows does not prevent it from retaining information about those records. Access and retention must follow the actual task. Erasing evidence can retire future questions while leaving earlier disclosures and their consequences in place.

A finite consent interpretation

We use a finite consent task to connect learning to a permitted action. Its 24 synthetic rulings cover ordinary transfers, common control, and nominee or custody arrangements, with eight rulings in each category. A positive label means the stipulated source authority required additional consent. These are competent determinations under a synthetic rule, not rulings by a real registrar.

For each category, the learner divides positive rulings plus one by available rulings plus two. The added units define the estimator. They establish no accuracy guarantee for a new case.

The adopted procedure requires consent at scores of at least 3/4. Scores of at most 1/4 satisfy this additional requirement. Between those bounds, the procedure requires a reserved determination. A category with no available rulings also returns 1/2 and is referred.

Suppose six common-control rulings are reversed. The positive count falls from seven to one, giving a score of 1/5. The learned consent conclusion changes. A suspended request still needs current reassessment and reconciliation before it can proceed.

The registrar must also check the actor’s power, the exact ownership change and every other applicable condition. If execution changes its authoritative register, that transition performs the adopted institutional act. A related bank instruction may remain unpaid.

The institution must adopt more than the weights. A changed feature extractor can put the same request into another category. The adopted bundle therefore includes features, calibration, policy, inference implementation, permitted uses and provenance as well as weights. Before the effect, the environment checks the actual complete bundle and inputs against the assessment. A changed bundle requires a fresh assessment or checked evidence that the earlier result remains valid for the exact present use.

Learning across institutions

An interpretation that serves one institution may be useful elsewhere. The receiver must first distinguish a warning, a finding in one case, a detector and a whole decision procedure. Accepting a finding does not automatically adopt a general model.

Receiving use needs corresponding representations, evidence about the receiving population and local authority for the consequence. A common legal tradition may help identify a promising source for investigation. It establishes neither statistical transportability nor recognition under the receiver’s law.

Even unchanged classifier rates can produce different consequences. With sensitivity 90% and false-positive rate 1%, a positive flag has predictive value about 90.9% at prevalence 10%. At prevalence 0.1%, that value is about 8.26%. These calculations hold the classifier rates fixed. They are not measured rates for any jurisdiction.

The receiver can request evidence, recalibrate, adopt a different consequence or decline the model. A prior mandate can authorize that process automatically. Importing the artifact grants no power to impose the source’s consequences, so shared learning remains subject to local control.

Institutions already exchange financial-crime knowledge. Project Aurora and Project Mandala provide close precedents for collaborative detection and programmable compliance. The construction here connects learned interpretation to the environment that governs AI-agent execution.

Verification over private cases

The receiver also needs evidence of how the source fitted the model. A zero-knowledge proof establishes a specified calculation without transmitting private case values. It must cover the collection promised by the source.

A commitment binds a concealed value so that the proof can refer to that same value. The source signs a complete inventory of case revisions and commitments to their categories and labels. The inventory identifies present labels, censored records and records available by the training cutoff. The receiver checks the calculation over every eligible row.

The proof binds the normative task, category definitions, calculation and resulting model, together with the intended receiver and permitted use. For a new request, the source signs a commitment to the case category. A separate inference proof establishes the model’s decision from that commitment. The receiving system compares its statement with the exact request and proposed operation.

The source remains responsible for competence, faithful encoding and completeness of its promised collection. The receiver remains responsible for authority to adopt. A verified calculation resolves neither question.

The public statement also limits what privacy can mean. Zero knowledge limits additional proof disclosure beyond that statement, while published weights and decisions remain observable.

With one eligible ruling, the selected category has score 1/3 or 2/3, depending on the label. Other categories have score 1/2. Those weights identify both category and label. An inference outcome can also identify a category when each category has a different response.

A larger aggregate can have the same problem. An exact average over 500 binary records reveals the last value to someone who knows the other 499. Weights, scores, selection and correction releases all belong in the disclosure account. A statistical privacy guarantee requires an explicit mechanism covering the complete transcript and cumulative releases. The exact-weight construction makes no differential-privacy claim.

Updates and unfinished duties

Adoption changes the procedure used for subsequent requests. It can also change the actions available for work the institution already owes.

A sequence of individually small changes can have a large effect. Threshold adjustments accumulate, and changes affecting different groups can eventually burden everyone. A fresh model name cannot restart an old hold or replenish a spent privacy allowance.

A standing mandate must retain limits across updates. It may permit automatic changes to evidence routing while reserving final refusal for another authority. Training produces a candidate, and adoption checks it against the authority and limits already in force.

Renewal must preserve the same continuity. Under predecessor authority, a successor mandate can authorize additional future activity while retaining earlier expenditure and current cases. Each existing duty keeps its original deadline and remaining allowance for model updates affecting its continuation. Ordinary service steps and mandate renewal cannot replenish that allowance. Otherwise repeated renewals could postpone the duty indefinitely.

A stricter detector can remove the only permitted refund route while leaving the ledger balanced. The refund then remains unpaid. Our finite construction searches for a permitted action with at least one specified response. Every response must remain safe and advance the original performance goal.

Even that check must survive model changes. One model may permit a route from state A to B and then payment. Another permits B to A and then payment. Alternating after the first step prevents payment forever, although each fixed model permits completion. The duty needs a common progress condition, persistent deadlines and limits on interference.

The progress result assumes that promised service steps actually occur. Accounting alone supplies no wall-clock guarantee. Once admitted as effective, a binding revocation immediately prevents affected new use, even if no replacement route exists. The institution records the failed assurance and surviving claim. The unpaid duty remains incomplete.

Meanwhile, the controls change the evidence for the next update. Fraudsters may change methods after detection, applicants may adapt to avoid delay, and attackers may manipulate training inputs. Investigation and correction must inform learning about that changed behavior.

Correction and continuing consequences

A source ruling can influence a receiving model and suspend an ownership request that never names that ruling. Correcting direct references alone would miss the request. Correction must follow dependencies through training, calibration, adoption and assessment.

The receiver marks affected current reliance for reassessment, checked reuse or competent disposition. Future candidates derived from the invalidated source inherit the same problem. Renaming the candidate does not remove its basis.

Source corrections and case corrections have separate paths. A newly admitted signed case record can invalidate an assessment before a replacement inference proof is available. A newly trained model needs receiving adoption. Neither adoption nor proof acceptance automatically clears the affected case.

These guarantees begin after the receiver admits the relevant change. Unchanged inputs cannot reveal an undelivered reversal. A stronger currentness claim requires a notification arrangement, validity lease or current-use service with specified terms.

A revised interpretation leaves earlier acts attributable. Reversing a transfer or changing its consequences needs a competent act of its own. A disclosure cannot be recalled, and a bank command remains possible until its contract supports exclusion. Correction must reach the current decision while accounting for what the institution has already done.

The same requirement applies when an agent or operator leaves. Its replacement needs usable models, inference software, evidence access, licenses and the full continuing case state. A transferred database confers no registrar or provider powers. Every promised service needs an actual post-transfer authority path, including reconciliation of old commands.

The synthetic consent lifecycle exercises this path with actual proofs. After six reversals, the receiver verifies and adopts the replacement interpretation, then explicitly reconciles the case before registration. A further correction arrives while the original payment is pending. The replacement operator receives the command and learned state, then records subsequent synthetic provider performance. The receiving record contains proofs and outcomes without the source’s private inputs.

The fraud comparison

A separate task tests whether the receiver benefits from shared learning. It uses a synthetic Indonesian financial-integrity office and a synthetic receiving office, representing no actual institution or fraud observation. We compare local rules, local learning, direct source transfer and transfer with receiving validation.

All four face the same 320 proposals, outcomes, duties, deadlines and provider behavior. Trained rational weights drive the learned decisions. Local learning and receiving-validated transfer have identical calibration capacity.

Direct transfer detects the same fraudulent cases as the calibrated arms, but imposes more false holds and delays more existing duties. All benign duties complete within the common horizon. That result depends on the stipulated investigation service revealing truth perfectly.

Receiving validation replaces every source weight with receiving-validation weights. It reaches the same final policy as local learning. There is no additional transfer benefit in this fixture. The receiving procedure rejects unhelpful source influence. The result does not establish that sharing necessarily improves a model.

The public correction lifecycle reverses seventy erroneous positive findings. Refitting changes a pattern assessment from Hold to Permit. Receiving adoption and case reconciliation remain necessary before new use. These seventy fraud-label reversals are distinct from the six normative reversals in the consent task.

The reference program checks learned admission before recording an ownership change. It retains the original payment command through correction and operator replacement, then records subsequent provider performance. The additional lifecycle correction changes none of the comparative data. No general correspondence between this implementation and the formal model has been proved.

The constructions connect learned interpretation to executable decisions and their continuing consequences. Their practical value still requires measurement of useful completion, prevented harm, unnecessary exclusion and correction costs over repeated updates. The evaluation must follow changing behavior and continue after independent operator replacement.

The full paper gives the assumptions, proofs, cited precedents and fixed comparison. Its companion network paper and technical supplement develop the execution, recognition, remedy and succession relations.