Assets that Carry Their Own Rules, Compose Across Jurisdictions, and Act Autonomously

Author: Raeez Lorgat

Abstract. Standard valuation theory reduces every tradeable instrument to a probability-weighted discounted future cash flow: a claim. An intelligent asset combines that claim with its full lifecycle program. Its state carries the rules, proofs, and programs that govern its actions and movement between jurisdictions, with machine-checkable evidence for each step.

An intelligent asset has six parts: a genesis record, a claim program encoding the instrument’s contingent terms, a family of lifecycle programs, a portfolio of sovereign-signed attestations, an append-only receipt chain, and a persistent store. A lifecycle program can move the claim only through the authority gates the claim declares. The genesis record fixes an invariant set and a single amendment gate outside the amendable surface. No chain of runtime-admitted amendments can rewrite either, so an asset cannot rewrite its own mandate. A typed compliance function admits actions under three structural guarantees: a failing required-domain verdict is final and cannot be offset by another domain’s evidence, unattested domains block, and a domain change flags exactly its dependents for re-evaluation. The claim program and verdict also determine who may hold the asset, which carried evidence a receiving jurisdiction may rely on, and what the asset is worth. Matching, settlement, risk reservation, dispute, and recovery over these quantities remain an open specification.

The Smart Asset Virtual Machine is deterministic: it admits an action only on a passing pre-flight verdict and appends a receipt to every execution. Delegated artificial-intelligence programs may propose actions but cannot approve them. Their authority is the overlap between compliance-passing and delegated actions, subject to monetary caps and delegation revocable at any moment. Human judgment enters at declared decision points under signed authorization. A supervisory halt order outranks every private delegation.

The taxonomy spans twelve classes, from payments operators, investment funds, sukuk, and intellectual-property indices through treasuries, physical infrastructure, consented data, stewarded natural systems, trade receivables, and commodities in transit. An asset’s attested compliance history reduces the compliance-verification component of due diligence to replay of the attested chain. Where a shortage of capital limits a trade corridor, this lower verification cost lets volume grow. Eight worked lifecycles illustrate the construction under a stated trust model and explicit open problems. Evaluator correctness is a scoped trust assumption, legal force depends on external instruments, coalition formation remains political, and scenario numbers are declared parameters.

1. What Is Broken

A three-person cross-border payments company operates in the United States, the United Kingdom, Singapore, the United Arab Emirates, and Nigeria. Compliance consumes a large fraction of its revenue: outside counsel in five jurisdictions, one full-time hire, a licensing stack, and the same know-your-customer question answered five times. Adding a sixth jurisdiction would cost half again as much, so the company stops expanding and leaves customers it could serve unreached.

A stewardship trust holds one hundred thousand hectares of the Amazon rainforest and issues carbon-biodiversity credits under a voluntary-market methodology. Three national environmental agencies, representatives of an indigenous council recognized under national constitutions, and a scientific advisory board establish it by compact. Every sale must address additionality (would the forest have stood without this project), permanence (will it stand for the next hundred years), and leakage (does protecting this tract displace clearing elsewhere). The trust spends two years registering one vintage.

A Saudi electronics-components exporter ships to a Shenzhen-based manufacturer and receives payment forty-five to sixty days later. The letter-of-credit cycle requires know-your-customer checks on the buyer and continuous screening against U.S. Office of Foreign Assets Control, European Union, and United Nations sanctions lists. Export-control classification, bank-intermediated foreign-exchange hedging, and manual customs and bill-of-lading reconciliation add further work. Pension funds, insurers, and sovereign wealth vehicles hold trillions of dollars in short-duration credit but cannot buy the receivable. The paper is unrated, verifying its compliance chain requires manual re-execution, and per-receivable due-diligence cost exceeds the financing spread. Bilateral trade between the Arabian peninsula and China is on the order of four hundred billion dollars a year. Some growth that exporters could ship and buyers could absorb exceeds the receivables-financing cycle’s capacity. Section 18.2 leaves the size of this capital-gated fraction to corridor-level analysis.

The company, the trust, and the receivable face the same problem: each action must satisfy rules administered across institutional boundaries.

Different authorities enforce these rules under different frameworks and in different jurisdictions. The rules carry legal force, and violating them is criminal, yet they do not travel with the institutional object. Each cross-jurisdictional action rebuilds the compliance context the last jurisdiction established. Adding a jurisdiction multiplies existing obligations, while attestations remain confined to the institutions that produced them. Parties reconstruct the composition of rules manually for each transaction.

Determining what may be done, by whom, under which rules, and in which jurisdictions still takes manual work measured in months. Large institutions spend on the order of ten to twenty per cent of operating cost on compliance departments. Smaller or less established structures face exclusions: the three-person company cannot reach its fifth market, the exporter’s financing cycle caps volume despite demand, and the stewardship structure cannot connect an indigenous council’s consent to a corporate buyer’s climate report.

Policy changes have increased these costs. Sanctions fragmentation since 2022 has produced cascading secondary-sanctions designations. For many affected cross-border flows, reconciling compliance costs more than the flows’ economic value. De-risking has halved some small jurisdictions’ correspondent-banking base within a decade and reduced or removed much of the developing world’s correspondent access to dollar and euro systems. The BIS Committee on Payments and Market Infrastructures’ correspondent-banking review and the Financial Stability Board’s data reports document this contraction. Asymmetric adoption of the OECD’s Pillar-2 framework and Schrems-II-class data-transfer volatility further raise cross-border operating costs, making such operation uneconomic for firms unable to absorb them.

An object that addresses these costs must carry its rules in its own state and make their mechanical fragment evaluable in microseconds. Named evaluators must attest it under named rule sets. Its rules must compose algebraically across jurisdictions, with defined behavior at edge cases. Programs must operate under scoped, revocable delegations, while sovereigns retain an operational control surface. The primitive must also state its limits.

The intelligent asset defined here supplies these properties under the assumptions and limitations stated below.

2. What Changes

An intelligent asset may be a fund, a bond, a treasury pool, a physical facility, a consented corpus, or a stewardship trust. It carries six things throughout its lifecycle: its creation record, the claim program encoding its terms, the programs operating within an envelope authorized at founding, sovereign attestations establishing current compliance state, an append-only history of actions to or by it, and a store that persists between executions.

Before an action, a compliance function evaluates it against every required regulatory domain using attestations from every jurisdiction in whose territory the object operates. When applicability disagrees across jurisdictions, the composition algebra returns a structured obstruction and preserves the disagreement. A passing verdict lets the action execute, its effects settle, and a new receipt join the history. A failing verdict halts the action and records the cause.

Compiled compliance gates compute deterministically from the attestation portfolio and the action’s required domains. Rule evaluators compiled from the companion rule language Lex produce verdicts with explicit provenance and typed discretion holes where mechanical computation must stop. Delegated proposal programs operate under signed principal delegations. Each delegation specifies tools, resources, limits, and which discretion holes the program may attempt to fill or must escalate to principals. These programs have read-only access to the compliance tensor and submit proposed actions to the compliance gate for admission or refusal. Their rationales join the receipt chain, which supplies the audit record.

Ownership changes extend the receipt chain. A sovereign revocation returns the cells downstream of the attestation to pending and triggers the propagation graph to recompute the re-evaluation set. The object then freezes or degrades its capabilities until fresh attestations arrive. When it adds or retires a harbor, a bilaterally-agreed corridor specifies which attestations carry through under mutual recognition and which require fresh evaluation. The transition is atomic under the fail-stop and finality-certificate assumptions in the companion protocol papers. Outside those assumptions, it returns a typed obstruction or enters a bounded-blocking compensation path.

The same algebra binds autonomy to compliance state for a bond, a data center, or a rainforest. Cross-jurisdictional compliance becomes proof verification plus fresh evaluation of the domains a corridor names. This change makes previously uneconomic instruments economic and lets institutional forms retain their structure across borders.

The legal force of attestations still requires political adoption. Legal regimes may reference the infrastructure, but the architecture alone creates no legal force. Section 17 collects the preconditions stated throughout the paper.

Intelligent assets connect issuance and governance to clearing and settlement. The issuance and governance layer is the sovereign jurisdiction network described in the companion paper of that name. It hosts the multi-harbored institution issuing the asset, evaluates the entity’s compliance state, and supplies the corridor parameters (R, \mu, \gamma) of Definition 4.5 for carried evidence. The clearing and settlement layer consumes the composed admissibility envelope, corridor parameters, claim program, and lifecycle programs as typed inputs. It also needs the admissible holder set, reliance class, and clearing price constructed in Definitions 4.6 to 4.8. Matching, settlement, risk reservation, dispute, and recovery over them remain the open specification of §17.4. This paper defines the typed object class connecting the layers. The sovereign-jurisdiction-network paper defines the substrate on which it operates.

3. Eight Worked Lifecycles

Eight lifecycles show what the formal object must support, from genesis to a consequential event. Three develop the situations in §1. The others extend the construction to funds, treasuries, data centers, consented corpora, and cargo. Every cost, headcount, timeline, spread, and other number in these lifecycles is a declared scenario parameter, not an empirical claim. A live deployment would have to measure each one. The formalism that follows defines the primitives used here.

4. The Object

An intelligent asset is a typed record whose fields supply the interfaces used by the other fields and the runtime. Throughout this section and §15, it is a programmatic contingent claim. Its claim program encodes the instrument’s contingent claim under the probability-weighted discounted-cash-flow reduction. A coupled lifecycle program family specifies the typed transitions its runtime may execute. Compliance, attestation, and receipt mechanisms make the claim and its lifecycle clearable across jurisdictions.

Definition 4.1 (Intelligent asset). An intelligent asset is a six-tuple

A = (g, \Phi, \Lambda, \pi, \sigma, s)

whose fields are:

• Genesis document g \in \mathrm{Genesis}, the immutable record of creation, content-addressed by digest h_g. The genesis names the asset class (its placement in the contingent-claim taxonomy of §15), the institutional-identity pointer (to a multi-harbored institution whose harbor set is time-varying and lives outside g), the authoring principal (a public-key identifier or a threshold-signature scheme over multiple keys), the initial digests of \Phi and \Lambda, the initial storage schema, and the initial attestation-portfolio specification. Amendments to the harbor set, the program set, and, under specified governance rules, the authoring principal itself, are not edits to g; they are signed amendment records appended to \sigma and resolved dynamically when the asset is read. Two further genesis fields bound that amendable surface from outside it: an invariant set \mathcal{I} of decidable predicates on the amendable record, the triple of claim program, program family, and authoring principal that amendment records leave resolved, and an amendment gate \theta_\ast, the single authority gate (Definition 4.9) wrapping every amendment-kind transition. Neither \mathcal{I} nor \theta_\ast lies in the range of any amendment record, and both are fixed by h_g: “immutability of g” is the immutability of \mathcal{I} and \theta_\ast, while time-varying state is the province of the other fields and the institutional pointer. The construction, and the invariance it buys, close this section (Proposition 4.1).

• Claim program \Phi \in \mathrm{ClaimProgram}, the term-level encoding of the instrument’s contingent claim under the probability-weighted discounted-cash-flow reduction. \mathrm{ClaimProgram} is the contract-combinator grammar of Peyton Jones and Eber (2003), descending from their 2000 paper with Seward, with terms c ::= \mathbf{zero} \mid \mathbf{one}(k) \mid \mathbf{give}(c) \mid \mathbf{and}(c_1, c_2) \mid \mathbf{or}(c_1, c_2) \mid \mathbf{cond}(o, c_1, c_2) \mid \mathbf{scale}(o, c) \mid \mathbf{when}(o, c) \mid \mathbf{anytime}(o, c) \mid \mathbf{until}(o, c), extended with the two constructors this architecture requires, \mathbf{gate}(\theta, c) and \mathbf{hole}(\eta, c), where k ranges over currencies, o over observables the asset’s oracle surface signs, \theta over the authority gates of Definition 4.9, and \eta over the typed discretion holes of Definition 11.1. The denotation \mathcal{V}(c) is the value process the combinator semantics assigns under a model for the observables. On the two added constructors it reads the asset’s own state: \mathcal{V}(\mathbf{gate}(\theta, c)) is \mathcal{V}(c) on the branch where \theta admits the transition attempted there (Definition 4.9: a passing §6 verdict on that action over \theta’s domain scope, together with a PCAuth under \theta’s process type) and the zero process otherwise, and \mathcal{V}(\mathbf{hole}(\eta, c)) is \mathcal{V}(c) on the branch where \sigma carries a PCAuth valid for \eta under Definition 11.2 and the zero process otherwise. So \Phi specifies when cash flows, in what amount, to which counterparty, under what authority gates, on default what happens, on dispute what happens, and on amendment what happens, and a lifecycle transition can be attempted at a lifecycle state only where \Phi’s gate and hole constructors leave a live branch there, which makes the coupling stated below a computation on \Phi’s denotation rather than a stipulation about \Lambda; Definition 9.3 then decides admission on the domains the handle requires. \Phi is the financial reading of the asset: the admissible holder set, the reliance class, and the clearing price are read off \mathcal{V}(\Phi) and the compliance function in Definitions 4.6 to 4.8. Concrete instances of \Phi correspond to claim classes in §15: a BondClaim \Phi encodes coupon schedule + face + covenants + default waterfall; a SukukClaim \Phi encodes Ijara/Murabaha/Musharaka/Mudaraba structure under Sharia certification; a ParametricInsuranceClaim \Phi encodes trigger event + payout schedule + reinsurer reserve; a RwaClaim \Phi encodes off-chain custody binding + receivable schedule. \Phi is content-addressed by digest h_\Phi recorded in g.

• Lifecycle program family \Lambda, a finite set of typed program handles authorized by the genesis document. Each handle is a quadruple (h_p, \tau_\mathrm{in}, \tau_\mathrm{out}, D_\mathrm{req}) where h_p is the content-digest of the program artifact, \tau_\mathrm{in} and \tau_\mathrm{out} are input and output type signatures, and D_\mathrm{req} \subseteq \mathcal{D} is the statically declared set of compliance domains the program’s invocation requires. Each \lambda_i \in \Lambda admits a typed state transition in \Phi’s lifecycle (issuance, attestation, transfer, partial settlement, dispute, recovery, revocation, amendment, termination); the typed authority gates and discretion holes of \Phi govern which \lambda_i is admissible at each lifecycle state. Artifacts include Level-1 compiled compliance gates, Op-bytecode programs compiled from Lex rules (under the companion Op paper’s admissible-compilation theorem), and Level-2 delegated proposal-program configurations (see §10). Additions to \Lambda are signed amendments recorded in \sigma.

• Attestation portfolio \pi \subseteq \mathrm{Att}, the set of currently valid sovereign attestations. The runtime maintains \pi under the invariant: for every \alpha \in \pi, the attestation’s validity window includes the current time and the attestation has not been revoked. Expired or revoked attestations are removed eagerly.

• Receipt chain \sigma = (r_0, r_1, \ldots, r_n), a hash-linked sequence of execution receipts. r_0 is the genesis receipt; every r_{i+1} carries the digest of r_i in its parent field. Appends are serialized per asset by a compare-and-swap against the current chain head. On integrity failure (parent-digest mismatch, signature invalid), the runtime transitions the asset to a fault state and emits a runtime-signed fault receipt.

• Persistent store s, a typed key-value map under a schema declared in g, surviving between program executions.

The pair (\Phi, \Lambda) couples the financial program \Phi to the operational programs \Lambda through \Phi’s typed authority gates and discretion holes. Without \Lambda, the asset is a record with signed metadata. With \Lambda, it observes external events, applies the compliance gate, and acts within its authorized lifecycle envelope. Actions outside that envelope require a signed amendment, which is not autonomous. The coupling between \Phi and \Lambda bounds a single transition: \Lambda may transition \Phi only through the typed-discretion-hole and authority-gate structure \Phi declares. Mandate invariance must hold over every chain of transitions, including amendments admitted by \Lambda. The one-step coupling alone cannot establish it. Proposition 4.1 proves the chain invariant from the invariant set and amendment gate fixed in g.

The terminal transition. Completion needs an explicit record. Otherwise, a matured bond, fully settled receivable, or dissolved company becomes permanently Pending as attestations expire. Its unsigned final record, which a court may need, cannot distinguish completion from abandonment. Termination is therefore a separate lifecycle kind, admitted only through a declared authority gate in \Phi and never inferred from attestation decay. A well-formed terminal transition discharges four obligations. Extinguishment: \Phi’s outstanding obligations are settled, discharged, or assigned to a named successor claim, with residual value carried by a named assignee. Lawful exit: each harbor’s required final filings and deregistrations are completed. For an institution, this retires the last harbor, a transition §12’s corridor grammar cannot express because exit-prepare presumes a receiving jurisdiction. Record custody: a named custodian retains \sigma for a specified term and keeps it verifiable after runtime termination through Definition 4.4’s re-anchoring construction. The terminal receipt: a signed terminal digest over the chain head closes \sigma. Any later append is invalid by construction and detectable as forgery. A chain without this receipt has no recorded end. The receipt records sovereign dissolution or deregistration acts but does not constitute them (§17.1).

Definition 4.2 (Jurisdiction). A jurisdiction J = (E_J, L_J, K_J) consists of an evaluator function E_J that maps an asset state and a proposed action to a cell value on a named domain, a content-addressed lawpack L_J of type \mathrm{Lawpack} that E_J consults, and a signing key K_J under an epoch-rotation schedule. Because E_J takes the proposed action as an argument, a passing cell is in general a verdict about a class of actions rather than a standing fact about the asset. When E_J returns a passing cell on an action’s required domains, J emits an attestation recording the cell together with the scope of action parameters over which the evaluation holds (Definition 4.4). An attestation that omitted that scope would serialize an action-specific verdict as a standing one.

Definition 4.3 (Compliance domain). \mathcal{D} is a finite, evaluation-time-fixed set of regulatory domains. Every proposed action is indexed by a required subset D_\mathrm{req} \subseteq \mathcal{D}. The reference deployment instantiates \mathcal{D} with exactly twenty-three domains: anti-money-laundering, know-your-customer, sanctions, tax, securities, corporate governance, custody, data privacy, licensing, banking, payments, clearing, settlement, digital assets, employment, immigration, intellectual property, consumer protection, arbitration, trade, insurance, anti-bribery, and Sharia compliance. Asset methodologies may define subdomains, oracle fields, and methodology-specific labels inside those domains; adding a new top-level domain is a coordinated schema-evolution event across participating jurisdictions.

Definition 4.4 (Attestation). An attestation \alpha = (J, d, v, P_\alpha, t_\mathrm{issue}, t_\mathrm{expire}, \epsilon, A_\mathrm{bind}, s_J) records that jurisdiction J evaluated domain d and assigned cell value v for asset A_\mathrm{bind} over the action scope P_\alpha, valid from t_\mathrm{issue} to t_\mathrm{expire} under cryptographic epoch \epsilon, signed by K_J with signature s_J over every preceding field.

The scope predicate P_\alpha is a decidable predicate on an action’s declared parameters, counterparty class, amount band, instrument type, and corridor, recording the conditions under which E_J reached the verdict v. Setting P_\alpha = \top, the identically-true predicate, marks a genuinely standing determination, one that holds for every action on A_\mathrm{bind} in domain d within the validity window; any narrower scope binds the verdict to the actions it was reached for. The asset-binding field A_\mathrm{bind} is the digest h_g of the intended asset’s genesis document: an attestation issued for one asset is not valid for another. Because amendments append to \sigma without changing h_g, the binding identifies the asset, not the asset’s current program state. In the companion Sovereign Jurisdiction Network paper’s terms, an attestation is a W3C Verifiable Credential under the eIDAS profile with these fields. The signing key is a composite under a specified combiner: an Ed25519 signature and an ML-DSA-65 post-quantum signature, verifying iff both component signatures verify.

Epoch policy and scheme retirement. The epoch \epsilon indexes a per-jurisdiction, append-only table of acceptable signature schemes and their policy periods. Scheme retirement adds a row. An attestation verifies under the policy in force when it was signed, independently of the policy at verification time. A jurisdiction with live attestations must have a nonempty table: a missing epoch makes an attestation unverifiable in a way indistinguishable from forgery.

Re-anchoring preserves an append-only archive through signature-scheme retirement. A broken scheme makes historical records signed under it unverifiable, while re-signing those records would violate append-only history. Instead, append a fresh witness over the old record’s digest, signed under the new scheme. The historical entry and original signature stay intact, and a verifier who no longer trusts the old scheme can follow the witness to one it trusts. Each generation anchors the previous one, allowing the archive to outlive any scheme without rewriting a byte. This cannot repair a signature forged before the witness was added. Bridging must therefore occur while the retiring scheme is still sound, as a scheduled operation rather than an emergency response.

Definition 4.5 (Corridor). A corridor C(J_1, J_2) = (R, \mu, \gamma, P_\mathrm{commit}) between jurisdictions specifies a destination-side re-evaluation set R \subseteq \mathcal{D}, a partial domain-recognition map \mu, grade-recognition maps \gamma, and a commitment protocol P_\mathrm{commit} that stages, finalizes, and compensates cross-zone operations: the companion Op paper’s signed commitment protocol operated under the companion Sovereign Jurisdiction Network paper’s finality-certificate obligations. Corridors are asymmetric in general; \mu and \gamma may be defined under a mutual-recognition agreement or under a regional body’s standing authorization.

Axiom 4.1 (Recognition floor). For every corridor, \gamma maps no cell that is non-passing under §6 to a passing one: a NonCompliant or Pending cell on the sending side is NonCompliant or Pending on the receiving side. Sanctions lies in R of every corridor formed without an explicit shared-authority instrument over sanctions lists; this is the general-purpose corridor rule under which §3.1 re-evaluates Sanctions locally, and where such an instrument exists the first clause still binds.

The claim program also determines who may hold the asset, which carried evidence a receiving jurisdiction may rely on, and what the asset is worth. These quantities complete the object specification. They are read from \mathcal{V}(\Phi) and the compliance function of §6. Fix an asset A at time t, issued by an institution with harbor set H. Let \mathcal{N} be the candidate counterparties, each an institution with its own harbor set and attestation portfolio.

Definition 4.6 (Admissible holder set). The admissible holder set \mathrm{Hold}_t(A) is the set of e \in \mathcal{N} such that the transfer action a_e moving A to e has a passing verdict at t: every domain in D_\mathrm{req}(a_e) is passing in A’s action-scoped tensor T_{a_e}, every domain in D_\mathrm{req}(a_e) is passing in e’s, and the corridor joining e’s harbors to H admits the transfer under Definition 4.5 without obstruction. It is the image of \Phi’s transfer transition under that filter: computed, not declared, and moving whenever either side’s tensor moves. A sanctions transition in one harbor removes counterparties from \mathrm{Hold}_t(A) before any manual review, which is the formal content of the flag narrated in §3.8: a cargo that has crossed a designated party’s custody clears no further downstream transfer until re-evaluated.

Definition 4.7 (Reliance class). For a receiving jurisdiction J_2 and a corridor C(J_1, J_2) = (R, \mu, \gamma, P_\mathrm{commit}), the reliance class \mathrm{Rel}_t(A, J_2) is the image under \gamma of the attestations A carries at t on the domains \mu maps, together with the domains of R marked as requiring fresh evaluation on the receiving side. It records what a party in J_2 may rely on without re-executing the evaluation, and at what grade, and what it may not. Domains outside both \mu and R carry no reliance: by the fail-closed discipline of §6 they stand at Pending in J_2.

Definition 4.8 (Clearing price). Let Q be a pricing measure on the observables \Phi names and let D be a discount process, both supplied by the model under which the holder population prices. The clearing price \mathrm{Price}_t(A) is the value process \mathcal{V}(\Phi) at t under (Q, D): the Q-expectation of the discounted future cash flows, conditional on the information available at t, taken on the branches \Phi’s gate and hole constructors leave live at t. The holder set enters the price twice: a branch whose continuation requires a transition the §6 verdict refuses, a transfer to a counterparty outside \mathrm{Hold}_t(A) among them, is a branch some gate constructor zeroes; and Q prices over the population \mathrm{Hold}_t(A), the only counterparties who can lawfully take the other side of a trade. The channel by which a shrinking holder set moves the price through Q is the liquidity question the companion Pricing the Compliance Tensor takes up.

Definition 4.8 specifies valuation without asserting an existence theorem. Uniqueness of Q, completeness of the market over \mathrm{Hold}_t(A), and attainment of a price in trade remain questions about the holder population. The companion Pricing the Compliance Tensor studies the conditioning’s order structure. The construction fixes the direction of dependence: a tensor transition can shrink \mathrm{Hold}_t(A) and zero a branch of \mathcal{V}(\Phi), both computable from signed state. A price movement does neither. Compliance state therefore enters valuation as an input.

Matching, settlement, risk reservation, dispute, and recovery over these three objects belong to the clearing layer. Its construction remains open (§17.4).

The genesis record and claim-program grammar require one further definition: the authority gate admitting consequential transitions, including amendments.

Definition 4.9 (Authority gate). An authority gate is a triple \theta = (D_\theta, \pi_\theta, \tau_\mathrm{proc}): a domain scope D_\theta \subseteq \mathcal{D}, an identity predicate \pi_\theta on authorized signers, and a process type \tau_\mathrm{proc} in the sense of Definition 11.1. The gate admits a proposed transition a at time t iff the verdict of §6 on a over D_\theta is passing in the action-scoped tensor T_a, and \sigma carries a PCAuth for the gate, an authorization site in the sense of Definition 11.2, whose signer satisfies \pi_\theta and whose process-provenance record is consistent with \tau_\mathrm{proc}. A gate is stricter than the compliance gate of Definition 9.3, which independently requires the action’s own D_\mathrm{req}(a), in exactly two ways: it may require domains beyond the action’s own, and it always requires a signature. A passing verdict alone admits nothing through a gate.

The genesis bullet of Definition 4.1 can now be discharged. The amendment rule fixed by g is: a transition of amendment kind, one whose successor state resolves a new amendable record (\Phi', \Lambda', p') of claim program, program family, and authoring principal, is admitted only when \theta_\ast admits it under Definition 4.9 and every predicate in \mathcal{I} holds on (\Phi', \Lambda', p'). Both conjuncts are mechanical: \theta_\ast’s admission is a §6 verdict plus a signature check, and \mathcal{I} is a set of decidable predicates. The rule is keyed to h_g, neither \mathcal{I} nor \theta_\ast lies in the range of any amendment record, and \pi_{\theta_\ast} names principal keys, never the runtime’s receipt-signing key.

Proposition 4.1 (Mandate invariance). Let A have genesis g with invariant set \mathcal{I} and amendment gate \theta_\ast, and let the genesis record (\Phi_0, \Lambda_0, p_0) satisfy \mathcal{I}. Then every amendable record (\Phi_n, \Lambda_n, p_n) reachable from genesis by runtime-admitted transitions satisfies \mathcal{I}; the rule under which amendments are admitted is the same at every n; and no admitted chain of transitions installs an authoring principal without a signature satisfying \pi_{\theta_\ast}, which no program handle in any \Lambda_i can produce.

Proof. Induction on the length of the admitted chain. The base case is the hypothesis on (\Phi_0, \Lambda_0, p_0). For the step, assume (\Phi_i, \Lambda_i, p_i) satisfies \mathcal{I} and consider the next admitted transition. If it is not of amendment kind, it leaves the amendable record fixed, since only amendment records resolve a new (\Phi, \Lambda, p) (Definition 4.1). If it is of amendment kind, the amendment rule admits it only if (\Phi_{i+1}, \Lambda_{i+1}, p_{i+1}) satisfies \mathcal{I}, which is the inductive claim. The rule itself is invariant along the chain: it is keyed to h_g, amendments append to \sigma and do not edit g (Definition 4.1), and \mathcal{I} and \theta_\ast lie outside the range of every amendment record, so no admitted transition reaches a state governed by a different rule. For the last clause, an amendment installing p_{i+1} \neq p_i requires a PCAuth whose signature satisfies \pi_{\theta_\ast}. Program handles are content digests with type signatures (Definition 4.1); they hold no signing keys, and the runtime signs receipts under its own key, which \pi_{\theta_\ast} does not name. A chain of admitted transitions can extend \Lambda, but each extension passes the same amendment rule and equips \Lambda only with handles, never with a key satisfying \pi_{\theta_\ast}. So the witness for principal succession is produced outside the asset’s own program family at every link of the chain. \square

The proposition bounds admission independently of key custody. A compromised principal key (Assumption 5.2) can authorize any amendment the rule admits, but none that violates \mathcal{I}. It cannot replace \mathcal{I} or \theta_\ast, since no amendment reaches them. Compromise thus affects only what the invariant set leaves amendable. Quorum, timing, and veto discipline above \theta_\ast remain governance choices (§17.4), while the invariant holds for every such choice.

5. Adversary and Trust Model

Assumption 5.1 (Cryptographic). The adversary is computationally bounded and cannot forge signatures under the composite scheme, find hash collisions, or compromise current-epoch private keys of sovereign evaluators.

Assumption 5.2 (Adversary powers). The adversary may delay messages within bounded asynchrony \Delta (in the sense of a partial-synchrony model); compromise a bounded subset of oracle feeds; propose malformed actions; cause a single evaluator to equivocate, presenting conflicting attestations for the same jurisdiction, domain, and asset to different observers; attempt to replay expired or revoked attestations; inject adversarial content into a delegated proposal program’s context via controlled oracle channels; influence the authoring of a lawpack prior to its content-addressing; compromise an authoring principal’s key post-genesis; and equivocate as a hosted-execution provider against pinned runtime-identity attestations.

Definition 5.3 (Scoped trust). Accepting an attestation signed by J under lawpack version L for domain d and asset A means: trusting that J’s designated evaluator correctly decided d under L for A within the validity window. No statement about J’s correctness outside this scope is implied. Scoped trust is a definition of acceptance in this architecture, not an assumption about the world.

Under this model, the paper establishes seven guarantees: attestation unforgeability (5.1), historical receipt integrity (chain structure), NonCompliant non-overridability on required domains (Remark 6.1), and passing-preflight admission (§9 Proposition 9.1). It also establishes amendment-chain invariance (§4 Proposition 4.1), cross-asset PCAuth replay prevention (Definition 11.2 binding), and a fresh-signature requirement for re-authorizing suspended delegation (§10 monotonic-suspension). These guarantees do not establish evaluator correctness, since scoped trust defines acceptance rather than guaranteeing correct evaluation. Resistance to evaluator collusion, model-provider silent substitution without verifiable weights commitments, and lawpack corruption at authoring remain outside them (§17). So does elimination of race conditions in non-monotone channels beyond the specified invariants.

6. The Compliance Function

The compliance function is a typed object on the asset’s state: a static composition of cell values, and a dynamic propagation on a labeled directed acyclic graph of domains (§7). The static algebra is the composition algebra of the companion Multi-Harbored Institution paper, imported here in the form the runtime uses.

Each compliance domain carries a cell with two axes. Applicability takes Applicable, NotApplicable, or Exempt; compliance applies only when Applicable and takes NonCompliant < Pending < Compliant. On cells whose applicability agrees, composition is the meet: the strictest verdict binds, and NonCompliant absorbs. When applicability disagrees across jurisdictions, composition is an n-ary reduction, not a lattice meet: it returns the meet of the Applicable grades with the non-applicable inputs retained as provenance flags, or a named obstruction when no input is Applicable and the inputs mix NotApplicable with Exempt. Obstructions are absorbing under further reduction and are surfaced, never coerced.

Remark 6.1 (Non-overridability). A required domain that is NonCompliant in any harbor cannot be outvoted by other domains’ or other harbors’ evidence: NonCompliant absorbs under the meet, and by Axiom 4.1 no corridor carries it into a receiving harbor as passing. The floor is structural: a fact of the meet and of the recognition maps, holding in every harbor set.

The runtime applies a fail-closed write discipline to compliance state. At instantiation, each domain stands at (Applicable, Pending) unless a genesis attestation declares it out of scope. A cell write requires a valid attestation binding the asset, domain, value, action scope, validity window, cryptographic epoch, and signature (Definition 4.4). Expiry removes the attestation from standing state, returns cells justified only by it to Pending, and enqueues propagation (§7). A domain without a valid attestation therefore remains Pending and blocks any operation that requires it.

Fix a proposed action a. The action-scoped tensor T_a assigns to each pair (J, d) the meet of the cell values of those \alpha \in \pi issued by J on domain d for which P_\alpha(a) holds, and (Applicable, Pending) when no such attestation is held. Several attestations by one jurisdiction on one domain under different scopes therefore coexist in \pi without T_a ceasing to be a function of (J, d), and where two scopes both cover a the strictest applicable verdict binds, under the same meet that composes across harbors. Standing determinations (P_\alpha = \top) enter every action’s tensor; narrower ones enter only the actions whose parameters they were issued against, so a verdict reached for one counterparty class and one amount band is never silently reused for another.

Write T for the state each T_a is read off: the assignment sending a pair (J, d) to the scoped cells \pi currently holds there, every cell carried with the predicate P_\alpha it was issued under. Issuance, expiry, revocation, and the propagation of §7 move T; a preflight (Definition 8.1) obtains T_a from T by selecting the scopes the action satisfies and taking the meet. T is the asset’s standing evidence; only T_a is a verdict about an action.

A cell is passing for an operation if it is Applicable-and-Compliant, NotApplicable, or Exempt. The verdict on an action a over a required domain set composes the cells of T_a domain-by-domain and is passing iff every cell is passing and no obstruction occurred. For an asset owned by an institution with harbor set H = \{J_1, \ldots, J_n\}, the verdict is a two-step reduction: compose across harbors per domain, then verdict across domains.

On the in-scope fragment, the residual is Heyting implication. Because meet is restrictive, meeting a cell with current state cannot improve compliance. Remediation instead identifies the attestations, proof refreshes, or discretion-hole fills that must replace stale or failing cells through authorized state transitions.

7. The Propagation Graph

The dynamic half of the compliance function records the causal dependencies among compliance domains.

Definition 7.1 (Propagation graph). A propagation graph is a triple G = (\mathcal{D}, E, \lambda) with \mathcal{D} a finite domain set, E \subseteq \mathcal{D} \times \mathcal{D} a set of directed edges, and \lambda a labeling assigning to each edge the cell-transitions that trigger target-side re-evaluation. An edge (u, v) \in E_J records that J’s evaluator for v reads the value of u composed across harbors under §6, not J’s own cell at u alone, so a transition of u in any harbor moves an input of the cell (J, v), and E_J holds an edge for every source J’s evaluator for v reads: E_J is that evaluator’s read relation. Each per-harbor graph G_J is required to be acyclic. The institutional graph G_H is the labeled edge union across harbors after a validation pass that rejects harbor sets whose edge-union cycles; the composed-source reading is what lets the union carry a dependency from one harbor into another and makes a cycle in the union a cycle in fact. When a cycle is detected, the corridor-formation protocol requires negotiation or strongly-connected-component quotienting.

Proposition 7.1 (Propagation closure). Fix a finite DAG G_H and let domain d transition in at least one harbor. Let \mathrm{reach}(d) = \{d' : d \preceq d' \text{ in } G_H\}, and let the re-evaluation set be the set of cells (J, d') with (u, d') \in E_J for some u \in \mathrm{reach}(d): in each harbor, the targets of that harbor’s own edges whose source lies in \mathrm{reach}(d). Re-evaluating exactly this set, in rounds that follow a topological order of G_H, yields a tensor in which every cell’s justification reads the post-transition composed value of every source its rule names, and touches no cell outside \mathrm{reach}(d). Reach is computable in time O(|\mathcal{D}| + |E_H|) and the re-evaluation set in one further pass over the per-harbor edge lists. Re-evaluation terminates in at most |\mathcal{D}| closure rounds; each round’s operational cost is the evaluator-response latency for the touched cells.

Proof. Re-evaluate the cells of the re-evaluation set one topological level of G_H per round: every domain at the same longest-path distance from d, in all harbors, in one round. A source in \mathrm{reach}(d) of a domain at distance k lies at a distance below k, since any path from d to the source extends along the edge into the domain, so every cell is re-evaluated after every source its rule reads has settled. Let (J, x) be any cell and u any source its rule reads, so (u, x) \in E_J by the edge-label semantics of Definition 7.1. If the composed value of u is unchanged, the justification of (J, x) stands. If it changed, then either u = d or some cell (J', u) was re-evaluated in this pass, which happens only when (w, u) \in E_{J'} for some w \in \mathrm{reach}(d); in both cases u \in \mathrm{reach}(d), since E_{J'} \subseteq E_H. Then (u, x) \in E_J with u \in \mathrm{reach}(d) places (J, x) in the re-evaluation set, and it was re-evaluated after u settled. The harbor J is selected by its own edge into x, whether or not it carries any edge at d: with G_{J_1} = \{d \to e\} and G_{J_2} = \{e \to f\}, the cell (J_2, f) reads the composed value of e that (J_1, e) moves, and it is re-evaluated because (e, f) \in E_{J_2} with e \in \mathrm{reach}(d). Conversely a cell (J, x) with x \notin \mathrm{reach}(d) has no source in \mathrm{reach}(d), since an edge (u, x) \in E_J \subseteq E_H with u \in \mathrm{reach}(d) would place x in \mathrm{reach}(d); it is untouched. Reachability on G_H is linear, and the re-evaluation set is one pass over the per-harbor edge lists testing membership of each source in \mathrm{reach}(d). A pass by level has exactly as many rounds as the longest directed path from d has edges, which in a DAG on \mathcal{D} is at most |\mathcal{D}| - 1, so at most |\mathcal{D}| rounds. \square

The complexity bound concerns the domain graph. Evaluator-response times dominate operational cost: reaching 15 domains across 4 harbors requires at most 60 calls, each with legal-process latency from minutes to days. Liveness under bounded evaluator latency requires timeouts. After a configurable timeout, unanswered cells return to Pending and the asset remains frozen or obstructed until the evaluator responds.

Concurrent transitions are serialized per-asset by the receipt-chain append lock; cross-asset transitions have their own ordering through P_\mathrm{commit} of Definition 4.5, the companion Op paper’s signed commitment protocol operated under the companion Sovereign Jurisdiction Network paper’s finality-certificate obligations.

8. Preflight and Postflight

The compliance gate operates at two moments bracketing every execution.

Definition 8.1 (Preflight snapshot). At the preflight instant for action a, the runtime produces a preflight snapshot: a content-addressed record capturing T_a over D_\mathrm{req}(a), the chain head, the relevant delegation state, and a monotonic logical clock value. Admission is atomic in the snapshot: either the snapshot is consumed to admit a, or a is rejected. Because T_a is assembled from the attestations whose scope predicate a satisfies, the snapshot records the scope under which admission was granted, not only the domains it cleared.

Discipline 8.1 (Monotone observation). Within a single execution, the runtime observes the tensor at the preflight snapshot and does not re-consult the live tensor during execution. Changes between preflight and postflight update the live tensor without retroactively altering the snapshot.

Discipline 8.2 (Postflight attribution). Every transition of the standing state T carries its provenance: the attestation, expiry, revocation, or receipt event that caused it (§6, §7). At the postflight instant the runtime re-reads the verdict on the live tensor. A non-passing domain is attributed to a when the transition that moved it lies in the propagation reach (Proposition 7.1) of an effect recorded in a’s own receipt, and is external otherwise. The response is fixed: an external failure leaves a’s effects standing and freezes the asset; a failure attributed to a appends a compensating receipt reverting a’s effects. Both responses append; neither rewrites history.

Proposition 8.1 (Preflight-postflight safety). If the preflight verdict is passing and a’s effects are deterministic in the snapshot, then a executes exactly once; the attribution of any postflight failure is decidable from \sigma, the attestation log, and G; and \sigma records which of Discipline 8.2’s two responses ran.

Proof. Admission consumes the preflight snapshot atomically (Definition 8.1), so a is admitted at most once, and a passing admitted a with snapshot-deterministic effects runs to a unique successor state; the receipt append is a compare-and-swap on the chain head (Definition 4.1) that commits exactly one receipt or transitions the asset to a fault state with no partial append. Attribution is a reachability question on G from the transitions a’s receipt records, decidable in O(|\mathcal{D}| + |E_H|) by Proposition 7.1 over the provenance the write discipline of §6 retains. The response receipts are appends under the same chain discipline, so the case that ran is legible from \sigma. \square

A frozen asset permits only re-evaluation programs: Level-1 gates that clear obstructions without Level-2 state changes. This lets it receive fresh attestations while other execution remains blocked.

9. The Smart Asset Virtual Machine

The Smart Asset Virtual Machine (SAVM) specializes the companion Op paper’s evaluator to asset-resident programs. Level-1 compliance gates are Op bytecode compiled from Lex rules under that paper’s admissible-compilation theorem. Level-2 programs are Op programs authored by principals or generated by delegated tooling under amendment governance. The machine is deterministic under the conditions in Definition 9.2.

Definition 9.1 (SAVM state). A SAVM state is \Sigma = (A, T, H, B, G), where A is the asset record, T is the standing evidence state of §6 over the current \pi projected through the current harbor set, from which every preflight reads the action-scoped tensor T_a the gate decides on, H is the harbor set resolved from the institutional pointer in g, B is the budget triple (gas, external calls, wall-clock) and G is the propagation graph for H. The asset record carries \Phi, and the machine consults it: the set of \lambda_i \in \Lambda the machine may attempt at a given lifecycle state is the set whose transition kind lies on a branch that \Phi’s gate and hole constructors leave live at that state, read under T and \sigma. Definition 9.3 then decides the attempt.

Definition 9.2 (SAVM transition). An invocation of program p with input x at state \Sigma computes

\mathrm{Step}_p : (\Sigma, x) \mapsto (\Sigma', r, y)

where \Sigma' is the successor state, r is the execution receipt, and y is the output. \mathrm{Step}_p is deterministic conditional on (i) the oracle-attestation vector supplied as preconditions to the call and (ii) the wall-clock deadline enforcement that may halt execution when the deadline is exceeded. The paper’s claim is therefore “deterministic in the oracle-attestation vector up to deadline-termination”; replay of a receipt requires preserving both the oracle vector and the termination boundary.

Definition 9.3 (Compliance-gated invocation). Let a be the action an invocation of p on input x proposes. Gated invocation admits the step only when, for every d \in D_\mathrm{req}(p), the composed cell of the preflight action-scoped tensor T_a at d is passing; otherwise it emits a reject receipt with no state change. An attestation whose scope predicate a fails contributes nothing to that verdict, so a determination reached for a different counterparty or a different amount band cannot admit a.

Proposition 9.1 (Gate witness). If gated invocation produces a non-\bot output, the preflight verdict was passing and the execution is recorded in \sigma with a chain-integrity receipt.

Proof. By Definitions 9.3 and 4.1: the only path to a non-\bot output runs through the passing branch; the receipt-chain append is a compare-and-swap against the chain head that either commits or triggers the runtime’s fault handling. \square

The witness establishes passing admission and a recorded execution. It is not an end-to-end safety theorem and does not establish verdict correctness, delegated-output scope containment, or freshness of T at preflight. Section 10 specifies scope containment, and §11 supplies the uniqueness discipline for principal-carried authorization (Axiom 11.1, Proposition 11.1). Section 17 distinguishes verdict validity from correctness.

The budget triple bounds deterministic computation through gas, external-service invocation through call limits, and evaluator-response and real-time operations through wall-clock limits. Execution terminates when the first budget is exhausted.

10. Delegated Proposal Programs as Bound Programs

Delegated proposal programs are bound programs under the Level-2 class. Their integration requires specific additions to the handle type, the authorization model, the execution broker, and the receipt discipline.

11. Typed Discretion Holes and Principal-Carried Authorization

A compliance rule is rarely algorithmic in its entirety. A typed discretion hole is the formal object carrying the escalation to a human or a collective principal.

Definition 11.1 (Discretion hole). A typed discretion hole \eta = (\tau_q, \tau_a, \pi_\mathrm{req}, \tau_\mathrm{proc}) is a query type, an answer type, an identity-predicate on authorized signers, and a process type specifying the governance procedure, single-signer, quorum-signed, deliberation-windowed, ongoing-withdrawable, or a specified conjunction thereof. The process type is essential: the architecture distinguishes discretion holes filled by a licensed officer’s single-signature (e.g., a tax-election signature) from those filled under a structured consent process (e.g., Institutional Review Board approval, indigenous-council free-prior-informed consent, or a board vote with named quorum). A single cryptographic signature at a moment captures a stamp; the process type captures the deliberative protocol that makes the stamp legitimate under the relevant governance regime.

Definition 11.2 (Principal-carried authorization). A PCAuth is a tuple (k, \eta, a, t, A_\mathrm{bind}, \Pi, s_k) where k is the signing principal’s identifier (which may itself be a threshold-signature expression over multiple keys under the process type), \eta the authorization site, a discretion hole of Definition 11.1 or an authority gate of Definition 4.9 (a gate \theta authorizes as a site whose query is the proposed transition, whose answer type is approval, and whose identity predicate and process type are \pi_\theta and \tau_\mathrm{proc}), a : \tau_a(\eta) the answer, t the validity timestamp, A_\mathrm{bind} the asset digest, \Pi the process-provenance record (deliberation-window boundaries, consultation records, witness signatures where the process type requires them), and s_k the signature over (\eta, a, t, A_\mathrm{bind}, \Pi). Validity at time t_\mathrm{now} requires: the site’s identity predicate holds of k, s_k verifies, t_\mathrm{now} lies within the validity window, and \Pi is consistent with \eta’s process type.

Axiom 11.1 (At-most-once resumption). A discretion-hole encounter suspends the invocation that reached it. The runtime resumes a suspended invocation at most once; resumption consumes the encounter, and a second resumption of the same encounter is refused at admission.

Proposition 11.1 (PCAuth uniqueness per encounter). A discretion-hole encounter admits at most one PCAuth, and the resumption it authorizes is a distinct receipt in \sigma.

Proof. A PCAuth is checked and consumed only at resumption, where Definition 11.2’s validity conditions are evaluated. By Axiom 11.1 the encounter resumes at most once, so at most one PCAuth is consumed for it, and the resumption receipt records which. \square

The A_\mathrm{bind} field forecloses cross-asset PCAuth replay: a signed hole-fill for asset A is not a valid fill for asset B. The process-provenance record \Pi makes the procedural requirements of complex consent frameworks first-class: FPIC under Convention 169 of the International Labour Organization and the United Nations Declaration on the Rights of Indigenous Peoples, Institutional Review Board review under national research-ethics regulations, quorum-voting records for board actions, and Nagoya-Protocol benefit-sharing arrangements all have a place on the receipt chain and a formal check on the SAVM’s admission path.

12. Corridors, Composition, and Harbor Transitions

When an asset lawfully adds a harbor J_2 or retires a harbor J_1, the corridor specifies which evidence travels. Domains in R require fresh evaluation. Domains mapped by \mu and accepted by \gamma carry under mutual recognition, while domains outside both default to Pending. The transition follows P_\mathrm{commit} of Definition 4.5: the companion Op paper’s signed commitment protocol under the Sovereign Jurisdiction Network paper’s finality-certificate obligations. A sending jurisdiction emits exit-prepare when an existing harbor retires. The receiving jurisdiction emits entry-prepare, evaluates R, and produces fresh attestations. Finality evidence places a corridor-finality receipt in both chains. On failure, the signed terminal state determines compensation, obstruction, or abort.

Across mixed-axis cells, composition is partial: obstructions halt the reduction and are reported. Route coherence of corridors is an explicit check over the re-evaluation masks, domain-recognition maps, grade-recognition maps, pack-version windows, and legal-instrument clauses. The working examples of §3 assume only those corridor behaviors for which the relevant route-coherence checks pass.

The corridor protocol interoperates with existing multilateral mechanisms at the level of attestation recognition:

• Treaty composition: Multilateral Instrument treaty look-ups are evaluator inputs for tax domains; an attestation’s image under the grade-recognition map \gamma on a mapped tax cell carries through only when the relevant bilateral treaty recognizes the corresponding tax fact.
• Information exchange: Common Reporting Standard and Foreign Account Tax Compliance Act reports are attestation-projection operations on the receipt chain’s financial-account view; an intelligent-asset treasury operating under these regimes produces compliant reports as a receipt-chain projection rather than as a separate pipeline.
• BEPS Pillar-2: Global Anti-Base-Erosion top-up tax is handled by a tax-fiber workflow rather than ordinary compliance meet. The country-by-country-reporting cell, the Qualified Domestic Minimum Top-Up Tax cell, and the Income Inclusion Rule cell supply signed inputs; GloBE interactions, safe-harbor elections, treaty positions, and top-up-tax allocation remain a formal tax-composition obligation. The Transitional Country-by-Country Reporting Safe Harbor election is a discretion-hole fill by the group tax head.
• Paris Agreement Article 6: corresponding-adjustment attestations for internationally-transferred mitigation outcomes are attestations signed by the host jurisdiction’s designated national authority; they are first-class objects in the receipt chain, not derived.
• EU eIDAS: attestations follow the W3C Verifiable Credential profile specified in the companion Sovereign Jurisdiction Network paper; eIDAS cross-border recognition under Regulation (EU) 2024/1183 (eIDAS 2.0) flows to these credentials.

Reducing harbor-transition compliance cost to proof verification and corridor-required re-evaluation lets entities respond faster to regulatory-quality signals. Cheaper exit intensifies existing competition, whether for quality or laxity. Under Remark 6.1 and Axiom 4.1, a failing Sanctions cell remains binding across harbors and corridors. The direction of competition depends on politics (§17).

13. The Supervisor’s Control Surface

Sovereigns exercise operational authority through supervisory primitives that take precedence over every principal delegation.

Definition 13.1 (Supervisory order). A supervisory order \omega = (K_\mathrm{sup}, \kappa, \tau, \Psi, s_\mathrm{sup}) is an order of kind \kappa (among: halt, unhalt, freeze-class, impose-requirement, reclassify-asset, mandate-disclosure, require-attestation-from) with parameters \Psi, addressed to a set of assets \tau in harbors under the supervisor’s authority K_\mathrm{sup}, signed by s_\mathrm{sup}.

Axiom 13.1 (Supervisor seniority). Supervisory orders are monotone over principal delegations: an authoring-principal delegation cannot override a supervisory halt. A supervisory unhalt can lift a supervisory halt; no principal authorization can.

Definition 13.2 (Late-binding requirement). When a supervisor requires compliance with a requirement not present at an asset’s genesis (an emergency regulation, a new sanctions list, a newly enforced right), the late-binding-requirement primitive: (1) attaches the requirement to one or more of the fixed twenty-three compliance domains, (2) injects initial tensor cells at (Applicable, Pending) for every affected asset inside those domains, (3) triggers propagation from the injected cells to downstream requirements, and (4) enforces the fail-closed default until sovereign evaluators issue attestations. Adding a new top-level domain to \mathcal{D} is a network schema-evolution event, not a per-asset supervisor order.

Definition 13.3 (Liability map). Every bound program’s execution receipt carries a liability tag identifying the responsible parties for each failure mode: the authoring principal (for program-authorship decisions), the evaluator (for attestation correctness within scoped trust), the oracle signer (for feed content), the hosted-execution provider (for proposal outputs within provider-attested-binding scope), and the corridor operator (for cross-zone commitment integrity). The failure modes, with their detection, loss bounds, and remedies, are enumerated in §17.5.

The supervisor can read the harbor’s full asset set. Each read carries its signature and enters an audit log separate from the asset’s receipt chain, so holders can verify access to their asset. Plaintext proposal rationales require a specific disclosure order.

14. Participant-as-Principal and Structured Consent

Scientific corpora, platform cooperatives, patient registries, and common-pool stewardships depend on many individual participants’ consent. The authoring-principal model alone cannot represent that consent. A participant-as-principal extension supplies it.

Definition 14.1 (Participant-principal tree). The authoring principal of a participant-governed asset is a Merkle-rooted participant-principal tree \mathcal{P}: each leaf is a participant’s public-key identifier and their individual consent record; the root is a commitment. Operations requiring participant authorization are composed under an operation-specific threshold function: some operations require a simple majority of affected leaves, some require every affected leaf’s signature, some delegate to an elected committee under the participant assembly’s own procedure.

Definition 14.2 (Consent as a structured cell). Consent is a first-class typed cell with fields: tiers (broad vs specific-to-study), purposes (research, commercial, statistical-training, internal-QA), geographic scopes (Applicable, NotApplicable, Exempt per destination harbor), temporal decay (validity window), withdrawal right (revocable, partially revocable, irrevocable on aggregation), and process-provenance (how the consent was obtained, in what language, with what information). A single cell like “data-privacy: Compliant” does not express this; the architecture widens the cell schema for object classes where consent structure is load-bearing.

Withdrawal propagation. A participant or authorized delegate signs withdrawal as an oracle attestation. It propagates over the regulatory-domain graph to flag cells for re-evaluation and over the derivative-use graph to mark dependent datasets, trained-model-weights, published aggregates, and downstream licensees. The derivative-use graph may contain cycles, so fixed-point termination is not guaranteed. Propagation is best-effort within a named scope: active uses immediately, trained models at the next licensing cycle, and aggregates on public release. Where aggregation is irrevocable, that limit is explicit. Once data enters a statistical aggregate above an unlinkable threshold, withdrawal removes direct identifiability but leaves the participant’s marginal influence.

Institutional Review Board review is a process-typed discretion hole. The board’s approval is a PCAuth under a quorum-signed, deliberation-windowed process type. Protocol amendments are appended as additional PCAuths; the receipt chain carries the sequence.

Free, prior, and informed consent is a process-typed discretion hole whose deliberation window follows the community’s own governance. The community determines the deliberation’s form. The architecture records its outcome, witness signatures, and withdrawal rights as state. The community’s constitution also governs signing-key custody, including non-digital fallback paths. Every credit-issuance event evaluates the pre-committed benefit-sharing formula through composition on the receipt chain.

Nagoya-Protocol benefit-sharing for genetic resources originating in biodiversity-rich jurisdictions is a distinct evaluator surface with its own methodology fields and its own attestation composition onto the participating jurisdictions’ canonical-domain tensors.

15. An Object Taxonomy

Twelve object classes distinguish what an asset observes, which domains its actions require, how it settles and fails, and which programs it carries. Classes I, XI, and XII receive full descriptions because they govern the payments, receivables, and cargo lifecycles of §3.

• Class I. Cross-border financial operator. Payments, remittance, working-capital provisioning across jurisdictions. It observes identity-verification feeds, sanctions lists, and transaction-monitoring feeds; its actions require AML, Sanctions, ConsumerProtection, Payments, Banking, and Tax, with foreign-exchange reporting a methodology field inside the Payments/Banking/Tax domains; it settles continuously; it carries compiled AML/sanctions gates plus a delegated proposal program for novel onboarding.
• Class II. Collective investment vehicle. Fund, structured product, revenue-linked note. Observes portfolio marks, revenue attestations, and index feeds; requires securities, tax, custody, and sanctions; settles continuously with distribution events.
• Class III. Contingent-rights instrument. Options on regulatory conditions, exercise on attested outcomes; requires IP, licensing, and trade.
• Class IV. Islamic-finance instrument (sukuk). Sharia-certified structured cash flows; the required domains must include Sharia.
• Class V. IP index instrument. Weighted index of IP-backed cash flows; requires IP and Trade, with withholding-tax treatment recorded as Tax-domain methodology fields.
• Class VI. Experiential claim. Right to a named service at a specified time and identity; requires consumer protection and data privacy; retail exposure flags for supervisory review.
• Class VII. Multi-jurisdictional treasury / in-house bank. Cross-harbor working-capital operations under BEPS Pillar-2, CRS, FATCA, and treaty regimes. Adjacent to incumbent enterprise-resource-planning and treasury systems via typed watcher-attestations and journal-entry projections.
• Class VIII. Physical infrastructure asset. Data center, port, transmission line, generation facility. Sensor-fusion oracle under Byzantine quorum; split between physical-jurisdiction harbor (land) and operating-entity harbor; export-control domain for workload-bearing facilities; grid-interconnect harbor for energy-market participation.
• Class IX. Consent-governed scientific or cultural corpus. Genomic database, music catalog, research dataset. Participant-as-principal (§14); structured-consent cells; IRB-integrated discretion holes; withdrawal propagation on the derivative-use graph; Nagoya-Protocol benefit-sharing for applicable genetic resources.
• Class X. Natural-system steward. Rainforest, fishery, aquifer, coral reef, mangrove belt. Multi-sovereign compact including recognized indigenous-council harbor under the council’s own governance; FPIC as process-typed discretion hole; buffer-pool-backed permanence across the methodology’s asset pool; leakage accounting through adjacent-tract monitoring; Article-6 corresponding-adjustment attestations for cross-border credit flows.
• Class XI. Trade-finance receivable and receivables pool. Origination-time-wrapped bilateral trade instruments and their aggregated pools. The class observes shipment and bill-of-lading attestations, customs attestations, sanctions and export-control feeds, counterparty identity-verification attestations, and bank-signed letter-of-credit chains. Its actions require AML, Sanctions, Trade, Payments, Banking, Tax, and KYC; export-control, foreign-exchange reporting, customs, and counterparty-identity are methodology fields inside those domains. Settlement is finality-on-shipment-confirmation at origination and tranched-with-continuous-distribution at the pool layer. The class carries compiled Level-1 gates for the seven required domains plus Level-2 pool-management programs for concentration-limit enforcement, expected-loss computation under the methodology, and investor-tranche settlement via Op signed commitment. Pool tranching, senior / junior / first-loss waterfalls, over-collateralization, concentration limits per obligor and per corridor, dilution protection for investor entries and exits, capacity caps, is expressed through Level-2 programs composed over the pool’s receipt chain; credit-event semantics are explicit: a receivable in default transitions to a NonCompliant compliance state under the pool methodology’s domain, subordination is enforced at distribution-computation time, and recovery flows append to the pool’s receipt chain as attested proceeds. The class is structurally distinct from Class II (collective investment) in its origination-time attestation discipline and from Class III (contingent-rights instrument) in its settlement pattern; it is the specific instantiation on which §3.7 and §18.2 turn.
• Class XII. Physical commodity in transit. A cargo, oil, metals, grain, LNG, petrochemicals, as an intelligent asset whose state carries origin, quality, custody-chain, shipping, insurance, and dispute-resolution documentation. The class observes independent-surveyor feeds (SGS, Bureau Veritas, Intertek), bill-of-lading chains and their electronic equivalents under eUCP version 2.1 or Bolero, customs attestations at load and discharge, flag-state registry, port authorities, marine-insurance-binder attestations from Lloyd’s syndicates, voyage-tracking from AIS, and sanctions and export-control feeds. Its actions require Sanctions, Trade, KYC, Custody, Insurance, and Arbitration; export-control, origin declaration, cargo quality, counterparty know-your-customer, and chain-of-custody integrity are methodology fields inside those domains. Settlement is structured against delivery milestones (load, in-transit, discharge, final-acceptance) with settlement conditioned on each milestone’s attestation; paired hedges (forward freight agreements, futures, options) compose under Op’s multi-asset signed commitment. On failure the class freezes on sanctions or chain-of-custody transition, compensates where the hedge’s reconciliation closes independently, and reverts on pre-discharge failure; it carries Level-1 gates for the six required domains plus Level-2 monitoring and dispute-resolution programs. The class operates under a chain-of-custody propagation graph orthogonal to the regulatory-domain graph of §7; transitions in either graph can flag the other for re-evaluation, and secondary-sanctions propagation runs through the custody graph rather than only through the domain graph. Arbitration-forum selection is a process-typed discretion hole under the admissible forum set (GAFTA, FOSFA, LMAA, LME, LCIA, ICC, SIAC, English High Court, New York Supreme Court). Class XII is structurally distinct from Class XI’s purely-financial receivables.

Classes can overlap. A hyperscale data center with consented telemetry for environmental claims is Class VIII and Class IX at different layers. A trade-receivables pool financing a Belt-and-Road infrastructure project combines Class VIII and Class XI. A cargo paired with a forward-freight derivative composes Class XII with Class III. The taxonomy supplies a vocabulary for these combinations rather than a disjoint partition.

16. Prior Art

The construction combines work on institutions, financial contracts, verified execution, and legal authority. Each tradition supplies a different part of the object.

Institutional economics. Douglass North’s Institutions, Institutional Change and Economic Performance (1990) establishes that institutions reduce transaction costs and that institutional change compounds over generations. Intelligent assets apply this thesis to instruments. Their algebra targets cross-jurisdictional transaction costs, while receipts make institutional change auditable at shorter intervals than North’s empirical record. Oliver Williamson’s transaction-cost economics studies cross-organization coordination friction. The architecture gives his hierarchies-vs-markets distinction a computational form. Elinor Ostrom’s Governing the Commons (1990) identifies eight design principles for common-pool-resource institutions. Seven have formal counterparts here: boundaries in harbor sets, congruent rules in composed tensors, monitoring in oracles and propagation graphs, graduated sanctions in lattice ordering and obstruction semantics, conflict resolution in discretion-hole escalation, recognition to organize in principal delegation, and nested enterprises in multi-harbor composition. The eighth, collective-choice arenas, remains institutional and external to the architecture.

Hirschman’s exit-voice framework. Exit, Voice, and Loyalty (1970) explains organizational decline and recovery through these three responses. Cheap cross-jurisdictional exit strengthens the exit channel. Amendment governance, discretion-hole fills, and participant-principal trees support voice. Loyalty is the rate of exit discounted by institutional attachment. The architecture lowers exit’s price while leaving that attachment unchanged. Tiebout’s model of local-jurisdiction choice (1956) supplies the corresponding price model: mobile constituents sort by rule quality, and cheaper exit sharpens that sorting.

Smart contracts and their verification. Lessig’s Code and Other Laws of Cyberspace and the verification literature (KEVM; F* translation of Solidity; Sergey and Hobor on concurrent interactions) study code-as-law and isolated-code safety. An intelligent asset additionally requires execution to pass a composed compliance verdict. Necula’s proof-carrying code is the closest precedent: an artifact carries proof of a property required by its consumer. The receipt chain descends from Haber and Stornetta’s hash-linked time-stamping. Move’s linear resources, Cairo’s ZK-provable execution, and Vyper’s verification work extend this tradition. Typed discretion holes and PCAuth are adjacent formalizations to Move’s resource types.

Financial-contract description languages. The term structure of \Phi comes from Peyton Jones, Eber, and Seward’s contract combinators (ICFP 2000), using Peyton Jones and Eber’s revised grammar (2003). Their compositional algebra contains zero, one, give, and, or, cond, scale, when, anytime, and until. Its denotation is a value process under a model for the observables. Section 4’s \mathrm{ClaimProgram} adds two constructors to that algebra, whose commercial descendants include LexiFi’s contract-description language and pricing systems. The lifecycle kinds ranged over by \lambda_i \in \Lambda are issuance, attestation, transfer, partial settlement, dispute, recovery, revocation, amendment, and termination. Where they overlap with the ISDA Common Domain Model, issuance maps to contract formation, transfer to transfer, amendment to terms change, and termination to termination. Attestation, revocation, dispute, and recovery carry the sovereign layer and have no Common Domain Model counterpart. FpML supplies the industrial product representation. This architecture adds two features absent from those predecessors. A lifecycle transition depends on jurisdiction-indexed attestation state: the term and observables still govern admissible transitions, with the action-scoped tensor of §6 as an additional condition. An external sovereign signature decides admissibility independently of the contract parties and the term’s own semantics, making the term portable across jurisdictions. The contribution at the claim layer is this gating of the inherited algebra.

Programmable securities. ERC-1400, ERC-1404, and ERC-3643 (T-REX) impose transfer restrictions through on-chain compliance modules. Zetzsche, Arner, and Buckley; Cong and He; and Harvey, Ramachandran, and Santoro’s DeFi work describe the product layer above these standards. Central Bank Digital Currency experiments (mBridge, Project Agora, Project Helvetia) prototype multi-jurisdictional programmable money. Tokenized real-world-asset platforms (Centrifuge, Ondo, RealT) implement particular asset classes. Intelligent assets define a primitive below these systems, composing sovereign attestations directly in place of per-token compliance modules.

Delegated automation. Capability-security systems, proof-carrying code, workflow engines, and typed effect systems supply the conceptual frame for scoped delegated programs. The architecture treats every such program as a proposer whose outputs enter the same admission filter as any other caller.

Environmental governance. The Integrity Council for the Voluntary Carbon Market’s Core Carbon Principles and the Voluntary Carbon Markets Integrity Initiative’s Claims Code of Practice set integrity frameworks for contemporary voluntary carbon markets. Article 6 of the Paris Agreement (6.2 ITMOs, 6.4 centralized mechanism) governs international mitigation-outcome transfers and corresponding adjustments to nationally-determined contributions. The UNFCCC REDD+ framework specifies institutions for project-scale and jurisdictional-scale forest carbon. The Nagoya Protocol on Access and Benefit-Sharing governs benefit flows for genetic resources. Class X operates within these frameworks and depends on their governance.

Legal theory. H. L. A. Hart’s Concept of Law distinguishes primary and secondary rules and identifies the open texture that requires judicial interpretation. Typed discretion holes formalize this boundary for execution. Dworkin’s Taking Rights Seriously and Law’s Empire, on principles versus rules and constructive interpretation, inform §17’s limits and lie outside the admissible fragment. Luhmann’s systems theory of law and Teubner’s reflexive law frame interaction with legal sub-systems. Kelsen’s pure theory of law supplies the rule-hierarchy precedent for lawpack versioning.

High-risk automated systems regulation. Regulation (EU) 2024/1689 classifies automated systems deployed in financial decisioning and critical infrastructure as high-risk. Its obligations include human oversight (Article 14), transparency (Article 13), risk management, and incident reporting. Delegated programs operate within these obligations. Scope gates and forensic indexes support technical transparency and human oversight, while receipt-chain rationales and delegation revocation support incident reporting. Singapore’s Monetary Authority Veritas framework addresses the same requirements through fairness, ethics, accountability, and transparency.

Prior-period compliance frameworks. Financial Action Task Force Recommendation 16 (travel rule), the Basel Accords, and EU investment-services and banking passporting supply parts of the regulatory framework. e-Estonia X-Road and Cosmos Inter-Blockchain Communication supply adjacent technical constructions. Schrems II and the transatlantic Privacy Shield and Data Privacy Framework address related data-transfer questions. Each addresses part of the problem. The intelligent-asset construction composes across these regimes algebraically, beyond operation within any single one.

17. Limitations and Open Problems

Four kinds of limits govern the construction: admissibility preconditions, permanent features, political preconditions, and engineering tradeoffs. The object requires external bindings for legal force. Other limits concern what cryptography and formal methods can certify even after those bindings exist.

18. Implications at Scale

The construction and its limits now permit a larger-scale question: under which adoption conditions do the lifecycles of §3 change investment, trade, and consent? The following mechanisms are conditional on their named preconditions and are not forecasts.

19. Conclusion

An intelligent asset combines its founding record, claim program, lifecycle programs, sovereign-attested compliance state, append-only history, and persistent store. The lifecycle programs let it observe, plan, and act. Its compliance function combines attestations by pointwise meet where applicability agrees and by named-obstruction reduction elsewhere, while a labeled DAG propagates changes. The claim program extends contract combinators with authority gates and typed discretion holes. Its denotation under the composed verdict determines admissible holders, reliance, and clearing price. The invariant set and amendment gate fixed at genesis constrain every admitted amendment chain. SAVM executes the compliance-gated state transitions. Principal-carried authorization supplies procedurally structured human judgments at discretion holes, supervisory orders take precedence over private delegation, and participant-principal trees extend consent to populations.

The same record supports financial instruments, multi-jurisdictional treasuries, physical infrastructure, consent-governed scientific corpora, and stewarded natural systems. Class-specific fields supply the differing consent structures, custody graphs, and settlement milestones.

The construction makes compliance an asset property, composes it algebraically across jurisdictions, and preserves a cryptographically auditable history. Its guarantees concern provenance, forensic observability, and bounded delegated action. Evaluator correctness and collusion prevention still depend on institutions, legal force on external recognition, coalition formation on politics, and substantive judgment on principals. Typed decision points and supervisory authority preserve the boundary between machine computation and procedurally structured human judgment. Shared consent infrastructure can support populations beyond the reach of bilateral relationships under the stated acceptance conditions.

Section 3’s lifecycles motivate the construction in §§4-14. Section 17 states the limits governing both that construction and its implications.

Appendix A: Glossary

Appendix B: Prerequisites and Companion Reading

The paper draws on six background areas. Readers who are not specialists may consult the following orientations.

• Lattice theory and order theory. Birkhoff, Lattice Theory; Davey and Priestley, Introduction to Lattices and Order. The compliance axis is a three-element chain; applicability is a three-element antichain; the product structure is the subject of §6.
• Type theory and programming-language semantics. Pierce, Types and Programming Languages. Typed discretion holes, content-addressing, and the SAVM’s determinism claims all use standard PL machinery.
• Capability security and macaroon-style delegation. The delegation model uses macaroon/biscuit-style capability chains; Birgisson et al., “Macaroons” (NDSS 2014) is the foundational paper.
• Distributed systems asynchrony and commit protocols. Dwork, Lynch, and Stockmeyer, “Consensus in the Presence of Partial Synchrony” (JACM 1988) for the bounded-asynchrony model; Gray and Lamport, “Consensus on Transaction Commit” (TODS 2006) for the transaction-commit background against which the signed commitment protocol’s finality-certificate discipline is specified.
• Sovereign regulatory concepts. BEPS Pillar-2 (OECD GloBE rules); Paris Agreement Article 6; FATF Recommendations; eIDAS Regulation; Regulation (EU) 2024/1689; the ICVCM Core Carbon Principles; the Nagoya Protocol; ILO Convention 169.
• Companion papers in this programme. Programmable Institutions (Paper 0) establishes the thesis; The Multi-Harbored Institution (Paper 1) defines the institutional object; Lex (Paper 2) specifies the rule language and the typed discretion-hole calculus; Op (Paper 3) specifies the typed bytecode and the signed commitment protocol; The Sovereign Jurisdiction Network (Paper 4) specifies the decentralized-kernel construction and the cross-zone finality obligations; Compounding Intelligence (companion) specifies the world-model compounding architecture that intelligent-asset observations contribute to; Pricing the Compliance Tensor (companion) constructs the map from a composed compliance constraint surface to a price and states the mixed-axis price obligation Definition 4.8 leaves open.

References.

1. North, D. C. (1990). Institutions, Institutional Change and Economic Performance. Cambridge University Press.
2. Williamson, O. E. (1985). The Economic Institutions of Capitalism. Free Press.
3. Ostrom, E. (1990). Governing the Commons: The Evolution of Institutions for Collective Action. Cambridge University Press.
4. Hirschman, A. O. (1970). Exit, Voice, and Loyalty. Harvard University Press.
5. Tiebout, C. M. (1956). A pure theory of local expenditures. Journal of Political Economy, 64(5):416-424.
6. Hart, H. L. A. (1961). The Concept of Law. Oxford University Press.
7. Dworkin, R. (1977). Taking Rights Seriously. Harvard University Press.
8. Dworkin, R. (1986). Law’s Empire. Harvard University Press.
9. Kelsen, H. (1967). Pure Theory of Law, 2nd ed., trans. M. Knight. University of California Press.
10. Luhmann, N. (2004). Law as a Social System. Oxford University Press.
11. Teubner, G. (1983). Substantive and reflexive elements in modern law. Law & Society Review, 17(2):239-285.
12. Birkhoff, G. (1967). Lattice Theory, 3rd ed. American Mathematical Society.
13. Davey, B. A. & Priestley, H. A. (2002). Introduction to Lattices and Order, 2nd ed. Cambridge University Press.
14. Pierce, B. C. (2002). Types and Programming Languages. MIT Press.
15. Necula, G. C. (1997). Proof-carrying code. POPL, pp. 106-119.
16. Haber, S. & Stornetta, W. S. (1991). How to time-stamp a digital document. Journal of Cryptology, 3(2):99-111.
17. Merkle, R. C. (1980). Protocols for public key cryptosystems. IEEE Symposium on Security and Privacy, pp. 122-134.
18. Birgisson, A., Politz, J. G., Erlingsson, Ú., Taly, A., Vrable, M. & Lentczner, M. (2014). Macaroons: Cookies with contextual caveats for decentralized authorization in the cloud. NDSS.
19. Dwork, C., Lynch, N. & Stockmeyer, L. (1988). Consensus in the presence of partial synchrony. Journal of the ACM, 35(2):288-323.
20. Gray, J. & Lamport, L. (2006). Consensus on transaction commit. ACM Transactions on Database Systems, 31(1):133-160.
21. Lessig, L. (1999). Code and Other Laws of Cyberspace. Basic Books.
22. Hildenbrandt, E. et al. (2018). KEVM: A complete formal semantics of the Ethereum Virtual Machine. IEEE CSF, pp. 204-217.
23. Bhargavan, K. et al. (2016). Formal verification of smart contracts. ACM PLAS, pp. 91-96.
24. Sergey, I. & Hobor, A. (2017). A concurrent perspective on smart contracts. Financial Cryptography and Data Security Workshops, LNCS 10323, pp. 478-493.
25. Peyton Jones, S., Eber, J.-M. & Seward, J. (2000). Composing contracts: an adventure in financial engineering. ICFP, pp. 280-292.
26. Peyton Jones, S. & Eber, J.-M. (2003). How to write a financial contract. In Gibbons, J. & de Moor, O. (eds.), The Fun of Programming. Palgrave Macmillan.
27. International Swaps and Derivatives Association (2019). ISDA Common Domain Model, version 2.0.
28. International Swaps and Derivatives Association. FpML: Financial products Markup Language, version 5.
29. ERC-3643 (2023). T-REX: Token for Regulated EXchanges. Ethereum Improvement Proposal.
30. Zetzsche, D. A., Arner, D. W. & Buckley, R. P. (2020). Decentralized Finance. Journal of Financial Regulation, 6(2):172-203.
31. Cong, L. W. & He, Z. (2019). Blockchain disruption and smart contracts. Review of Financial Studies, 32(5):1754-1797.
32. Harvey, C. R., Ramachandran, A. & Santoro, J. (2021). DeFi and the Future of Finance. Wiley.
33. Committee on Payments and Market Infrastructures (2016). Correspondent Banking. Bank for International Settlements.
34. Financial Stability Board (2017). FSB Correspondent Banking Data Report.
35. Organization for Economic Cooperation and Development (2021). Tax Challenges Arising from the Digitalisation of the Economy: Global Anti-Base Erosion Model Rules (Pillar Two).
36. UNFCCC (2015). Paris Agreement, Article 6. United Nations Framework Convention on Climate Change.
37. Integrity Council for the Voluntary Carbon Market (2023). Core Carbon Principles and Assessment Framework.
38. Voluntary Carbon Markets Integrity Initiative (2023). Claims Code of Practice.
39. International Labour Organization (1989). Convention 169: Indigenous and Tribal Peoples Convention.
40. United Nations (2007). Declaration on the Rights of Indigenous Peoples.
41. Secretariat of the Convention on Biological Diversity (2011). Nagoya Protocol on Access to Genetic Resources and the Fair and Equitable Sharing of Benefits Arising from their Utilization.
42. European Parliament and Council (2024). Regulation (EU) 2024/1689.
43. Court of Justice of the European Union (2020). Case C-311/18, Schrems II.