1. Jurisdictional singularity and the missing composition object

Every corporation is jurisdictionally singular. It is incorporated in one place and regulated primarily by that place. Multi-jurisdictional operation is the daily reality of every multinational. But it is achieved through parallel legal structures, not through composition.

A corporation incorporated in Singapore that wants to do business in the United States does not extend its Singaporean compliance state into the US. It registers as a foreign entity in the relevant states, obtains an EIN from the IRS, engages US counsel, establishes US banking relationships, and submits to US regulatory jurisdiction. The compliance work it did in Singapore is invisible to the US system. There is no mechanism by which the Accounting and Corporate Regulatory Authority of Singapore and the Delaware Division of Corporations share compliance evaluations, let alone compose them.

The result is that multi-jurisdictional operation requires maintaining N independent compliance regimes, where N is the number of jurisdictions in which the entity operates. Each regime is evaluated from scratch. Each produces its own compliance artifacts. The entity’s compliance officers maintain parallel workstreams that never formally interact. If the entity is compliant in all but one of the twenty-three regulatory domains in Singapore and needs to demonstrate compliance in those same domains in the ADGM, it must produce fresh evidence for all twenty-three domains from the ADGM’s perspective. The passing evaluations from Singapore are legally irrelevant: a point the ADGM’s registrar cannot act on.

This is a structural property of how institutional compliance has worked for centuries. Each jurisdiction is sovereign. Each evaluates independently. There is no shared compliance vocabulary, no common evaluation framework, no portable compliance artifact. The European Union’s passporting regime and the FATF’s mutual evaluation methodology are the closest approximations, and even they fall far short of point-by-point composition across jurisdictions. EU passporting allows a firm authorized in one member state to operate in others under its home authorization, but the home state’s evaluation is accepted wholesale. There is no composition of two states’ requirements into a combined constraint surface. FATF mutual evaluations assess countries’ compliance frameworks, not individual entities. Neither produces a formal object representing the composed compliance state of an entity operating across jurisdictions.

Adjacent systems, from BEPS and the Legal Entity Identifier to regulatory sandboxes and Estonia’s e-Residency, each address a piece of the problem; Section 8 takes them one by one. None addresses the structural problem: the absence of a formal object representing an entity’s composed compliance state across jurisdictions, and the absence of an algebraic operation for composing heterogeneous jurisdictional requirements.

The cost of this structural property is large and largely unmeasured. It manifests as institutional friction: the months spent duplicating local registration work, the duplicate compliance programs, the local counsel retained in each jurisdiction, the inability to change operating posture without a process that resembles dissolution and re-incorporation more than it resembles a change of address. McKinsey’s Global Banking Annual Review series has reported that compliance and control costs for large banks have risen to between 5% and 10% of revenue. For multi-jurisdictional entities, a substantial portion of that cost is pure redundancy: re-proving things already proved elsewhere, to a system that cannot accept the prior proof.

Three developments make the object buildable now. First, the raw legal material exists: Mutual Recognition Agreements, FATF mutual evaluations, and the IOSCO and IAIS multilateral memoranda are bilateral recognition already negotiated, waiting to be formalized (Section 4). Second, writing jurisdictional rules as executable programs is demonstrated practice: Catala compiles French statute, and L4 encodes Singapore regulation (Section 7). Third, delegated programs can now operate an entity continuously, so a composed constraint surface has an operator that reads it at machine speed (Section 6).

Jurisdictional singularity is treated as a fact of nature rather than as a design limitation of existing institutional infrastructure. The contribution of this paper is to define the object and to prove that its composition rule is uniquely determined.

2. The multi-harbored entity

Definition (Harbor). A harbor is a jurisdiction in which an entity holds active registration and is subject to that jurisdiction’s compliance evaluation. The term is chosen to evoke a port where a vessel is registered and to which it can return: a jurisdiction that claims the entity as its own, evaluates it under its own rules, and provides it with the legal infrastructure to operate. An entity’s harbor set is the set of jurisdictions in which it is simultaneously harbored. A single-harbored entity is the status quo: a corporation incorporated in one jurisdiction. A multi-harbored entity is the new object this paper introduces.

The harbor metaphor is precise in one respect and deliberately imprecise in another. It is precise in that a harbor, like a port of registration, confers both rights (the right to operate under that jurisdiction’s legal framework) and obligations (the obligation to comply with that jurisdiction’s rules). It is deliberately imprecise about the physical: a harbor does not require physical presence in the jurisdiction, though some jurisdictions may require it as a condition of registration. The harbor is a legal and computational relationship.

Definition (Multi-harbored entity). A multi-harbored entity is a legal entity E (an LLC, corporation, foundation, or any other recognized form) with:

1. a single governance and beneficial-ownership identity;
2. a harbor set H(E) = \{J_1, \ldots, J_n\} of jurisdiction-specific registrations, recognitions, or continuations bound to that identity;
3. for each harbor J_k, a twenty-three-domain compliance state vector T_k(E) evaluated under J_k’s rules;
4. a compliance passport whose proof terms bind those harbor-specific evaluations to the same legal-operational identity; and
5. a legal-effect condition: each harbor recognizes the composed passport state for the operation classes named in its governing instruments.

Its composed state on the Applicable fragment is

T^{\mathrm{App}}(E) = T^{\mathrm{App}}_1(E) \wedge T^{\mathrm{App}}_2(E) \wedge \cdots \wedge T^{\mathrm{App}}_n(E),

where \wedge is pointwise meet across domains.

Standing hypothesis (co-satisfiability). The composed vector summarizes what E may do jointly across its harbors: in each domain d, the grade T^{\mathrm{App}}(E)(d) reports the operating power that survives once every harbor’s requirement in d is honored. The pointwise meet is a sound summary of that joint action set exactly when the set is non-empty, that is, when the harbors’ requirements in d admit at least one common course of action. We assume co-satisfiability throughout: for every domain and every harbor set considered, some action satisfies all participating harbors at once. The hypothesis is not vacuous, and Section 4 gives the concrete case in which it fails. Where it fails, the harbors’ requirements in d are not ordered by strictness at all and there is no strictest requirement to report; the composed grade is NonCompliant, which is correct and fail-closed, but it then means that every action in d is barred rather than that a particular one is. We call such a harbor set infeasible in d, and we treat the condition as a typed obstruction, InfeasibleHarborSet, naming the conflicting sovereign authorities, rather than as a compliance verdict about the entity. Section 6 states where the obstruction is raised.

The object is not a parent-subsidiary stack, not a holding-company tree, and not a mere branch network. Existing corporate law already supplies those forms. The multi-harbored entity is a new construction: one legal-operational identity carried by several harbor acts of recognition, with equivalence maintained by the compliance passport and by the corridor relations between harbors. The local legal act in each harbor remains ordinary law: incorporation, domestication, continuation, branch recognition, or licensed registration under that harbor’s own rules. The novelty lies in treating those acts as coordinates of a single composed object rather than as unrelated files in unrelated registries.

The harbor set as a claim portfolio. A second reading of the definition makes the same object visible as a portfolio. Each harbor J_k confers on E a jurisdictional contingent claim: a typed, time-indexed right to operate in each domain d \in \mathcal{D} at the grade T_k(E)(d) \in V_d, contingent on the harbor remaining in good standing under J_k’s rules and on the corridor partners’ continued recognition of J_k. The harbor set H(E) = \{J_1,\ldots,J_n\} is the portfolio of those claims. Composition by pointwise meet on the Applicable fragment is the portfolio’s binding constraint surface: in each domain d, the operating power E may exercise across the portfolio is the lowest grade any harbor’s claim grants in d. Operations purely local to a single harbor exercise that harbor’s individual claim alone; cross-harbor operations exercise the composed claim surface.

The portfolio reading is the same algebra: each harbor grants a typed claim, and the meet is the binding constraint across them. It is also the bridge to the pricing interface developed in Section 9. Every tradeable instrument the entity issues (equity, debt, sukuk, parametric insurance, structured derivatives, intellectual-property royalties, real-world-asset receivables, event-contingent contracts) is a financial claim against the entity (or against assets the entity controls); the entity’s operating power to issue, hold, transfer, and settle that financial claim derives from the jurisdictional claim portfolio above. The compliance state vector is therefore both an admissibility filter on entity action and a typed input to the price of every instrument the entity originates, because the meet determines the holder set and the holder set determines liquidity. Section 9 develops this consequence; the body of the paper develops the algebraic, corridor, and passport machinery on which it depends.

The algebraic structure, stated precisely. Fix a finite domain set \mathcal{D} with |\mathcal{D}| = 23. For each domain d \in \mathcal{D}, let the applicable compliance grades form a finite distributive lattice D_d; in the typical case this is the three-chain

\text{NonCompliant} < \text{Pending} < \text{Compliant},

while domains such as Sharia may use a richer finite-distributive factor because instrument structure matters internally to the domain. A jurisdictional evaluation also records whether the domain is Applicable, NotApplicable, or Exempt. The load-bearing meet claim in this paper concerns the Applicable fragment

\mathcal{L}^{\mathrm{App}} = \prod_{d \in \mathcal{D}} D_d,

not the full mixed-axis type. On \mathcal{L}^{\mathrm{App}}, composition is pointwise meet. On the full state space, composition returns the meet where every jurisdiction marks the domain Applicable, and an explicit record of the disagreement where they do not.

We call the domain-indexed record of grades the entity’s compliance state vector, and we write it T(E). The companion papers write the same object as the compliance tensor; we use that word only when citing them.

We use two elementary propositions about the composition operation across jurisdictions. They are stated here because they are load-bearing for the rest of this construction.

Proposition (Locality). Let \mathcal{D} be a finite domain set, and let each Applicable coordinate d take values in the lattice D_d fixed above. Any binary operation \circ : \prod_d D_d \times \prod_d D_d \to \prod_d D_d that is idempotent, monotone with respect to the componentwise partial order, and domain-local (for each d \in \mathcal{D}, the value (a \circ b)(d) depends only on (a(d), b(d))), is the pointwise application of an idempotent, monotone operation \circ_d on D_d for each d \in \mathcal{D}.

Proof. Domain-locality defines \circ_d(x,y) by choosing any state vectors a,b with a(d)=x and b(d)=y and setting \circ_d(x,y)=(a\circ b)(d). Domain-locality makes this definition independent of all other coordinates. The idempotence and monotonicity laws for \circ_d follow by applying the corresponding law for \circ and projecting to coordinate d; for monotonicity, choose the witnessing vectors to agree outside coordinate d. Therefore (a\circ b)(d)=\circ_d(a(d),b(d)) for every d. \square

Proposition (Restrictiveness forces meet). Let D_d be one of the coordinate lattices fixed above, so that every pair a,b \in D_d has a greatest lower bound a \wedge b. Any idempotent, monotone binary operation \star on D_d satisfying the restrictiveness axiom a \star b \leq a and a \star b \leq b for all a,b is the meet operation.

Proof. Let m = a \wedge b. Restrictiveness gives a \star b \leq a and a \star b \leq b, so a \star b \leq m by the greatest-lower-bound property of m. Since m \leq a and m \leq b, monotonicity and idempotence give m = m \star m \leq a \star b. Therefore a \star b = m = a \wedge b. \square

Corollary (Order-independence). On the Applicable fragment, any composition operation satisfying the hypotheses of the two propositions is associative and commutative, and the composed vector of a harbor set \{J_1, \ldots, J_n\}, T^{\mathrm{App}}(E) = T^{\mathrm{App}}_1(E) \wedge \cdots \wedge T^{\mathrm{App}}_n(E), is well-defined without a bracketing or an ordering of the harbors.

Proof. By the two propositions the operation is the pointwise meet, and the meet of a lattice is associative and commutative. \square

Together these pin down the composition on the Applicable fragment. Locality is the non-trivial structural axiom: it says that composition on V^\mathcal{D} factors through each coordinate, i.e., that two jurisdictions’ disagreement in the Payments domain cannot influence the composed verdict in the Employment domain. Without locality, the composed verdict in one domain could depend on other domains, as it does under lexicographic minimum, priority projection, or weighted aggregation over a fixed coordinate ordering, each of which produces different composed verdicts. We take locality as an axiom because sovereign regulation is domain-local: Singapore’s Payments-domain ruling does not alter Delaware’s Employment-domain ruling. Restrictiveness is the familiar “most-restrictive-wins” policy, and it forces minimum as opposed to maximum (which is also idempotent, monotone, and domain-local, and would give the join instead of the meet). Restrictiveness is also strictly stronger than the requirement that a single violation blocks. On the three-chain above, define a \star' b = \text{NonCompliant} if either argument is NonCompliant, and a \star' b = \max(a,b) otherwise. This operation is idempotent, monotone, and domain-local, and it blocks on any violation, yet \text{Pending} \star' \text{Compliant} = \text{Compliant}, so it is not the meet. Restrictiveness is the axiom that excludes it, and the legal argument for the full axiom, and not only for its blocking part, is given below. Applied to an idempotent, monotone operation, the two axioms select the pointwise meet uniquely on the Applicable fragment. Idempotence is load-bearing: the constant-NonCompliant rule is domain-local, restrictive, and monotone, yet composes two Compliant verdicts to NonCompliant, so without idempotence the axioms admit operations other than the meet.

The distinction between Applicable, NotApplicable, and Exempt is structural. NotApplicable and Exempt are distinct applicability states rather than intermediate points on a five-element chain inserted between Pending and Compliant: NotApplicable affirms that the domain does not govern the entity in that jurisdiction at all, and Exempt affirms that the entity holds a signed policy artifact removing the domain from scope. Neither collapses into a grade, and the mixed-axis dichotomy matters precisely because collapsing them into a single total order destroys information the audit trail must preserve. For the institutional paper the consequence is simple: whenever we invoke meet, residual, or product-lattice structure without qualification, the scope is the Applicable fragment unless stated otherwise.

Legal reality forces the meet, and the argument has two halves. The first half is sanctions law, which settles the blocking behavior at the bottom of the order. A NonCompliant verdict in any jurisdiction means the entity is in violation of that jurisdiction’s law. No other jurisdiction’s clearance creates a defense. The Office of Foreign Assets Control (OFAC) sanctions carry extraterritorial reach: a transaction blocked by OFAC cannot become unblocked by composition with a permissive jurisdiction. The jurisdictional grant is IEEPA Section 1702(a)(1), reaching any person or property subject to United States jurisdiction, with the operative extraterritorial scope set by the individual program regulations and enforced under Section 1705; the point is that this is statute, not a modeling decision. The same principle applies to every sovereign sanctions regime: the UN Security Council, the European Union, the UK’s Office of Financial Sanctions Implementation (OFSI), Singapore’s Monetary Authority. Each of these is an independent sovereign determination that composition cannot override. This establishes that a single violation blocks, regardless of how many jurisdictions say proceed. It does not by itself establish restrictiveness, because the operation \star' above blocks on any violation and still returns the more permissive of two intermediate grades.

The second half settles the intermediate grades, and it follows from what a cross-harbor operation is. Such an operation touches every harbor in H(E), so each harbor’s law applies to it. The authority to perform it in harbor J_k is whatever J_k’s own grade in the relevant domain confers, and a grade strictly below Compliant is J_k’s statement that it has not authorized the operation there: Pending means the evaluation is unfinished, not that the operation may proceed while it finishes. A composed grade above J_k’s grade would therefore assert an authority in J_k that J_k has not given, which is the defect the first half rules out at the bottom of the order and which is no more available in the middle of it. Hence a \star b \leq a and a \star b \leq b for the composition governing cross-harbor operations, which is exactly the restrictiveness axiom. Both halves are propositions of law rather than modeling preferences, and with locality they force the meet by the two propositions above. The scope of the second half is cross-harbor operations; purely local operations are governed by their own harbor’s vector, as this section states below, and no composition is applied to them.

The domain set \mathcal{D} is pragmatic, not principled. The current working taxonomy contains twenty-three domains: anti-money laundering, know-your-customer, sanctions, tax, securities, corporate governance, custody, data privacy, licensing, banking, payments, clearing, settlement, digital assets, employment, immigration, intellectual property, consumer protection, arbitration, trade, insurance, anti-bribery, and Sharia compliance. Sharia is load-bearing because global sukuk issuance runs at roughly $200B a year (IIFM, Sukuk Report, annual series), and because the relevant evaluation is per instrument, not per chain or venue. AAOIFI and mainstream Islamic-finance practice evaluate the structure of the instrument: a sukuk issued by a multi-harbored entity can be Sharia-compliant while another instrument issued by the same entity is not, and the coexistence of both instruments on one venue does not contaminate the sukuk. What matters for the algebra is that the set is finite, fixed at evaluation time, and shared across the participating jurisdictions via the corridor agreements described in Section 4. Composition is then a deterministic operation over a known structure; adding a domain at a future date is a schema-evolution event that every participating kernel absorbs through the corridor renegotiation protocol.

Domain boundary disputes. Two jurisdictions may classify the same regulatory concern under different domains. Pakistan may classify cryptocurrency regulation under “Digital Assets” while Singapore classifies aspects of it under “Securities” and “Payments.” This is the current state of global regulation. The compliance state vector handles this through redundancy: if a regulatory concern touches multiple domains, it appears in each relevant domain’s evaluation. When Pakistan evaluates an entity’s cryptocurrency operations under “Digital Assets” and Singapore evaluates the same operations under “Securities,” the meet across both jurisdictions produces a composed state vector where the entity must satisfy both classifications. The cost is over-compliance: the entity may satisfy requirements in a domain where only one jurisdiction places them. The taxonomy does not resolve the boundary dispute. It ensures that the dispute cannot create a gap through which an entity escapes evaluation.

Local versus composed operations. Which state vector governs an operation depends on the operation’s scope. An operation that is purely local to a single harbor (hiring an employee in Singapore, where the employment contract, payroll, and regulatory filing all occur within Singapore) operates under Singapore’s state vector T_{\text{SG}}(E) alone. An operation that touches assets or state in multiple harbors (paying that Singapore employee from a bank account in the ADGM, or issuing equity that is registered in Delaware to a shareholder resident in Singapore) operates under the composed state, whose Applicable fragment is T^{\mathrm{App}}(E) = T^{\mathrm{App}}_1(E) \wedge \cdots \wedge T^{\mathrm{App}}_n(E).

This distinction is necessary because without it, the multi-harbored entity collapses. If the composed state vector governed all operations everywhere, then adding a harbor with stricter requirements in a domain would retroactively tighten constraints on purely local operations in other harbors. A Singapore entity that adds a harbor in a jurisdiction with onerous employment regulations would find its Singapore hiring constrained by rules that have no legal nexus to Singapore employment.

But the distinction also creates a risk: an entity could structure operations to avoid cross-harbor composition, routing each operation through whichever single harbor has the most permissive rules for that operation’s domain. Hire in the jurisdiction with the weakest employment law. Bank in the jurisdiction with the lightest AML regime. Issue securities in the jurisdiction with the most permissive disclosure requirements. Each operation is “purely local” to the permissive harbor.

The defense against this structuring is the compliance passport. The passport records every operation the entity has undergone, in every harbor, with the harbor in which it was evaluated. Any jurisdiction can inspect the passport and observe the pattern: an entity that routes employment operations exclusively through its most permissive harbor, banking operations exclusively through another, and securities operations through a third is engaging in regulatory arbitrage through operational structuring. The pattern is visible because the passport is comprehensive. A jurisdiction that detects structuring can respond: flag the entity for review, require re-evaluation of structured operations under the local harbor’s rules, or, in the limit, revoke the entity’s harbor registration.

This is the passport-visibility property: the composed state vector governs cross-harbor operations by algebraic necessity, the local state vector governs purely local operations by legal nexus, and the compliance passport makes structuring visible so that jurisdictions can enforce their own rules against it. Compile-time compositional safety belongs to the Lex/Op layer; the passport property is forensic and regulatory. The system makes structuring observable and therefore punishable. This mirrors how tax authorities handle transfer pricing: disclosure is required, and authorities reserve the right to re-characterize related-party transactions that lack economic substance.

What the multi-harbored entity enables. Consider a technology company that incorporates in Delaware (best corporate law precedent, well-understood governance framework), hires engineering talent in Singapore (deep technical talent pool), and opens its primary banking relationship in the ADGM (strong fintech infrastructure, USD-denominated accounts with global connectivity). Under the current model, this requires three separate compliance programs, three sets of local counsel, and no formal relationship between the three compliance evaluations. Under the multi-harbored model:

• The entity’s compliance state is a single vector: the pointwise meet of the Applicable-fragment coordinates produced by Delaware, Singapore, and ADGM across the twenty-three-domain taxonomy.
• Each jurisdiction evaluates the entity under its own rules, producing its own compliance state vector.
• The composed state vector tells the entity precisely where it stands: which domains are clear, which require attention, and which jurisdiction’s requirement is the binding constraint in each domain.
• Operations purely within a single harbor operate under that harbor’s state vector. Cross-harbor operations operate under the composed state vector.
• Tax-domain cells record per-jurisdiction tax status and accepted tax facts. Liability allocation, treaty relief, transfer pricing, and top-up-tax interaction are not computed by meet; they are the open tax-interaction obligation stated in Section 10.
• Regulatory filings are routed to each jurisdiction’s system based on the entity’s harbor set.
• The entire compliance state is carried as a cryptographic artifact, the compliance passport, which any of the three jurisdictions can verify without querying the others online, by checking proof-term digests, signatures, rule-archive references, and hash-linked history, and which makes the entity’s full operational history inspectable subject to the corridor’s disclosure rules.

None of this requires the three jurisdictions to agree on a common compliance framework. Each jurisdiction applies its own rules. The algebra composes the results. The composition is purely mechanical on the Applicable fragment: the meet of three state vectors, computed pointwise, domain by domain.

Application layer: programmable securities. The entity-level state vector is not the end of the construction. A multi-harbored issuer can originate instruments whose compliance state is computed per instrument from the issuer state vector, the instrument’s own rule set, and the investor’s access rights. This is the application-layer payoff that conventional multinational structuring does not provide. A Sharia-compliant sukuk can carry Sharia = Compliant and clear for sharia-constrained investors, while a conventional structured-credit tranche issued by the same entity can carry a different envelope and be gated differently. The two instruments may coexist under one issuer and one trading venue because the relevant compliance object is the instrument envelope, not a chain-wide label.

The same primitive supports cross-jurisdictional sukuk, sovereign parametric insurance, and structured credit with event-contingent tranches. As an instrument’s envelope deepens it can pass through three deployment tiers: utility objects, instruments tradable under qualified-investor or exempt regimes, and fully cleared, fully enveloped securities. This paper treats the static per-instrument envelope; the dynamics by which an envelope deepens over time are deferred to Intelligent Assets.

What this primitive buys beyond existing multinational structuring. Multinational groups already achieve cross-border presence through parents, subsidiaries, and distribution agreements. What they do not achieve is composition. The multi-harbored entity buys one legal-operational identity, one evidence graph, one remediation-planning surface, and one corridor protocol instead of a stack of bilateral legal handoffs. It makes the binding jurisdictional constraint legible at machine time, preserves proof of why that constraint binds, and lets per-instrument issuance inherit a machine-checkable compliance envelope rather than a patchwork of counsel memos and manual transfer restrictions.

3. Multi-harbored securities and contingent claims

A security issued by a multi-harbored legal entity is, in a precise sense, itself multi-harbored. The issuer’s harbor set, compliance state vector, and compliance passport are facts about the issuer. But the instrument the issuer originates inherits those facts and, in addition, carries its own compliance envelope: a per-instrument compliance state evaluated against the issuer state vector, the instrument’s own rule set, and the access conditions of each harbor.

A second framing of the same object is load-bearing for Section 9. Standard valuation theory reduces every tradeable instrument S to a probability-weighted discounted future cash flow: S is determined, up to numeraire, by the joint distribution of timing and amount of the cash flows it pays, discounted to today. Equity, debt, sukuk, structured derivatives, real-world-asset receivables, parametric insurance, intellectual-property royalties, and event-contingent contracts are all instances; derivatives are claims constructed from claims. We refer to the union as the contingent-claim taxonomy. A multi-harbored security is a contingent claim issued by a multi-harbored entity, whose compliance envelope is composed across the instrument’s harbor set, a subset of the issuer’s, on the Applicable fragment of the twenty-three-domain state vector. The composition is the algebraic content of this section; the consequence for pricing is treated in Section 9.

Definition (Multi-harbored security). Let E be a multi-harbored legal entity with harbor set H(E) and per-harbor state vectors T_J(E) for J \in H(E). A multi-harbored security is a financial instrument S issued by E together with an instrument harbor set H(S) = \{J_1, \ldots, J_m\} \subseteq H(E), the harbors in which S is registered, listed, or otherwise recognized, with H(S) = H(E) as the default, and:

1. a per-instrument compliance envelope C(S) = (C_{J_1}(S), \ldots, C_{J_m}(S)), where C_{J_k}(S) is the instrument’s compliance state evaluated under J_k’s rules for the instrument class;
2. an access-condition map A(S) : H(S) \to \text{AccessClass}, specifying the investor class authorized to hold S in each harbor of H(S);
3. a proof that each C_{J_k}(S) is consistent with the issuer’s harbor-J_k state vector T_{J_k}(E); and
4. a composed envelope C^{\mathrm{App}}(S) = C^{\mathrm{App}}_{J_1}(S) \wedge \cdots \wedge C^{\mathrm{App}}_{J_m}(S) on the Applicable fragment, by the same pointwise meet that governs the issuer state vector.

The key point is the direction of inheritance. The issuer being multi-harbored is necessary but not sufficient for the instrument to be multi-harbored. A conventional bond issued by a Delaware-Singapore-ADGM entity is not automatically a multi-harbored security unless its compliance envelope is evaluated per harbor and the per-harbor envelopes are composed and carried. What multi-harboring the entity buys is that the infrastructure for per-harbor instrument evaluation already exists: the issuer has corridor relationships, a compliance passport, and a composed state vector. Originating a multi-harbored instrument on that infrastructure is an incremental step.

Commercial consequence. Consider three instruments issued by the same multi-harbored entity:

• A sukuk structured under AAOIFI standards, targeting Sharia-constrained investors in the ADGM and Kuala Lumpur. Its envelope carries Sharia = Compliant and is cleared only for investors whose access class permits Sharia instruments.
• A conventional senior secured note, targeting institutional investors in Delaware and Singapore. Its envelope carries standard AML/KYC/Securities verdicts per harbor and is gated for qualified institutional buyers.
• A parametric insurance-linked security with event-contingent payouts, where each harbor’s rules for insurance domain and settlement apply independently.

Under current infrastructure, the same issuer cannot originate all three simultaneously without building a different compliance structure for each instrument, running each through separate legal opinions in each jurisdiction, and maintaining separate transfer restrictions per jurisdiction per instrument. The multi-harbored entity collapses that to one issuer, one compliance infrastructure, and per-instrument envelopes derived mechanically from the issuer state vector plus the instrument’s own rule set. The sukuk and the conventional note coexist under one issuer and one trading venue without their compliance states contaminating one another because the relevant compliance object is the instrument envelope, not a blanket entity-level label.

Instrument-level harbor set. The definition indexes the envelope over H(S) rather than H(E) because a security issued by a multi-harbored entity need not carry all of the issuer’s harbors. An instrument listed only on the ADGM exchange has H(S) = \{\text{ADGM}\} even if the issuer is harbored in Delaware, Singapore, and ADGM. Its composed envelope is then C^{\mathrm{App}}_{\text{ADGM}}(S) alone; adding a Singapore listing is a harbor-addition event for the instrument, governed by the same corridor protocol as harbor addition for the entity, but scoped to the instrument.

Securities are not entities, but the algebra is the same. A multi-harbored security is not a legal entity. It cannot have governance, beneficial ownership, or delegated programs in the same sense an entity does. What it shares with the multi-harbored entity is the algebraic structure: a harbor set, per-harbor compliance state, pointwise meet composition on the Applicable fragment, and a compliance passport that binds the per-harbor evaluations to the same instrument identity. The proof obligations are also the same: each per-harbor envelope must be evaluated under the corresponding harbor’s rules, the composed envelope is the pointwise meet, and the compliance passport must prove that the composed envelope is consistent with the issuer state vector and with the corridor agreements of all harbors in H(S).

Relation to programmable securities. A multi-harbored security is a static description of the instrument’s compliance state at issuance. A programmable multi-harbored security is one whose compliance envelope can evolve: an instrument that starts with H(S) = \{\text{Delaware}\} and adds Singapore as a harbor when the issuer completes the corresponding corridor evaluation, or one whose Sharia compliance envelope is re-evaluated when the instrument’s structure changes. This paper treats the static case; the evolution of multi-harbored instrument envelopes, and any formal account of tiered graduation, is addressed in the Intelligent Assets paper.

4. Corridors and harbor transitions

A corporation that wants to change its jurisdiction of incorporation today must undergo a legacy jurisdictional transfer: a process that in most cases involves creating a new entity in the target jurisdiction, transferring all assets, contracts, and regulatory relationships, and dissolving the original entity. The process takes months, costs hundreds of thousands of dollars in legal and administrative fees, and involves discontinuity: there is a window during which the entity’s legal status is ambiguous, contracts may need novation, and regulatory approvals must be re-obtained.

The multi-harbored entity separates harbor addition and lawful harbor retirement from ordinary jurisdictional transfer. A corridor is a bilateral relationship between two jurisdictions’ systems, parameterized by a re-evaluation mask R, a partial domain map \mu, and, where needed, restrictive grade-recognition maps \gamma: which compliance domains require fresh evaluation in the receiving jurisdiction, how recognized source domains translate into destination domains, and at what grade of recognition carried evidence is accepted. A corridor can support adding a new simultaneous harbor, or, under a separate legal act, retiring an old harbor; the primitive itself is simultaneous presence, not migration.

Definition (Corridor). A corridor from jurisdiction A to jurisdiction B is a triple (R_{AB}, \mu_{AB}, \gamma_{AB}), where R_{AB} \subseteq \mathcal{D}_B is the destination-side re-evaluation set, \mu_{AB} : \mathcal{D}_A \rightharpoonup \mathcal{D}_B is the partial domain-recognition map, injective on its domain of definition so that at most one source domain is recognized into each destination domain, and \gamma_{AB,d} : V_{A,d} \to V_{B,\mu_{AB}(d)} is the optional grade-recognition map on recognized Applicable coordinates. For each recognized pair the corridor instrument fixes a monotone embedding \iota_d : V_{A,d} \to V_{B,\mu_{AB}(d)} of the source grade order into the destination grade order, the identity when both factors are the standard three-chain; each \gamma_{AB,d} is monotone and restrictive, \gamma_{AB,d}(v) \leq \iota_d(v) for every v.

The triple (R_{AB}, \mu_{AB}, \gamma_{AB}) also has a clearing-side reading. The re-evaluation set names the domains in which fresh evaluation is required at B; the recognition map names which A-side domains B accepts as evidence; and the grade-recognition map governs the degree to which A-side verdicts retain their force on the B side. The corridor’s recognition depth, informally how much of the issuer’s A-side compliance state B accepts at face, controls how much of that state a holder in B may rely on. Shallow recognition (large R_{AB}, downgrading \gamma_{AB}) means the holder may rely on little; deep recognition (small R_{AB}, identity-like \gamma_{AB}) means the holder may rely on most of the carried state. The corridor parameters are therefore typed inputs on the clearing side, alongside the issuer’s harbor set and the instrument’s own rule set.

Definition (Carry-forward). Given an entity E with compliance vector T_A(E) \in V^{\mathcal{D}_A} in A, the carry-forward across the corridor (R_{AB}, \mu_{AB}, \gamma_{AB}) is the vector T_{A \to B}(E) \in V^{\mathcal{D}_B} defined coordinatewise:

T_{A \to B}(E)(d_B) = \begin{cases} \gamma_{AB,d_A}(T_A(E)(d_A)) & \text{if } \mu_{AB}(d_A)=d_B \text{ and } d_B \notin R_{AB}, \\ p_V & \text{if } d_B \in R_{AB} \text{ or no recognized } d_A \text{ maps to } d_B. \end{cases}

Here p_V is the fail-closed Pending grade on the applicable compliance factor. It is the coordinate’s initial value in B: the value that stands until B’s own signed evaluation of that coordinate supersedes it. Carry-forward itself never treats absence of evaluation as clearance.

Definition (Post-corridor state). The receiving jurisdiction B then evaluates the entity under its own rules in every destination domain it did not recognize, producing a signed vector \mathrm{fresh}_B on those coordinates. The entity’s compliance state in B is

T_B(E)(d_B) = \begin{cases} \mathrm{fresh}_B(d_B) & \text{if } d_B \in R_{AB} \text{ or no recognized } d_A \text{ maps to } d_B, \\ \gamma_{AB,d_A}(T_A(E)(d_A)) & \text{if } \mu_{AB}(d_A)=d_B \text{ and } d_B \notin R_{AB}. \end{cases}

The fresh verdict replaces the placeholder that carry-forward wrote into its coordinate; it is not met with it. Meeting the two would defeat the purpose of re-evaluation: p_V \wedge v = p_V for every v above p_V in the coordinate order, so no fresh verdict could raise a re-evaluated coordinate above Pending, and no domain in R_{AB} could ever clear. Substitution is the same move the remediation operator of Section 6 makes: the authority that owns a coordinate replaces its value by a signed state transition, rather than composing a further constraint into it. Fail-closure is preserved by an invariant instead of by the meet. T_B(E) is defined only once B has signed an evaluation for every coordinate in R_{AB} and for every destination coordinate that no recognized source domain maps to; until then those coordinates stand at p_V, and no operation that requires them may proceed.

Composition across harbors is unchanged by this. Carry-forward and fresh evaluation act on one harbor’s coordinates over time; the meet of Section 2 acts across harbors at one time. For an entity now harbored in both A and B, the state governing cross-harbor operations is the pointwise meet T^{\mathrm{App}}_A(E) \wedge T^{\mathrm{App}}_B(E) on the Applicable fragment, exactly as Section 2 defines it.

Definition (Staged corridor route). Given corridors (R_{AB}, \mu_{AB}, \gamma_{AB}) and (R_{BC}, \mu_{BC}, \gamma_{BC}), the always-defined composite object is the ordered route A \xrightarrow{(R_{AB},\mu_{AB},\gamma_{AB})} B \xrightarrow{(R_{BC},\mu_{BC},\gamma_{BC})} C, not a single raw corridor triple. Evaluation along the route first applies the A \to B carry-forward, records any fresh B evaluations required by R_{AB}, and then applies the B \to C carry-forward to the resulting B-side evidence state. Route concatenation is associative as list concatenation of evidence-producing steps; collapse of a staged route to a direct corridor is an additional coherence property, not automatic algebra.

Where the relevant domain maps are defined and no intermediate fresh-evaluation evidence is needed, the staged recognized-domain map is \mu_{BC}\circ\mu_{AB} and the staged grade map is \gamma_{BC,\mu_{AB}(d)}\circ\gamma_{AB,d}. If an intermediate coordinate is re-evaluated at B, the B-side fresh evaluation, not the original A-side value, is the source evidence for the next hop.

Open obligation (route-coherence collapse). A direct corridor (R_{AC},\mu_{AC},\gamma_{AC}) between A and C is coherent with the staged route only when it produces the same carried state and the same required fresh-evaluation obligations as the route above, after accounting for intermediate evidence. This requires typed equations between destination-side masks, domain-recognition maps, grade maps, and instrument clauses. The normalized equality checker over carried cells, fresh-evaluation domains, and instrument clauses is mechanized in the machine-checked artifact accompanying the companion Op paper; the open obligation is the semantic lift from real corridor triples, pack-version windows, and clause objects to that normalized snapshot. The paper does not claim that arbitrary corridor triples compose to a single associative corridor triple; it claims that the protocol can execute staged routes and can surface non-coherence as a structured obstruction.

This is separate from the pure meet algebra, where associativity already determines the multi-zone composed result on the Applicable fragment.

Re-evaluation mappings: creation, maintenance, and legal basis. The corridor parameters (R,\mu,\gamma) are the load-bearing mechanism of the corridor. R specifies the subset of the twenty-three compliance domains that require fresh evaluation by the receiving jurisdiction: domains where the sending jurisdiction’s evaluation is not accepted. Domains not in R are accepted via mutual recognition when \mu maps the source domain to the destination domain. \gamma specifies the recognition grade for accepted Applicable domains: a function from the sending jurisdiction’s verdict in a domain to the receiving jurisdiction’s accepted verdict, which may involve downgrading (e.g., the sending jurisdiction’s “Compliant” maps to “Pending” in the receiving jurisdiction, triggering a review).

Re-evaluation mappings are negotiated bilaterally by the regulatory bodies or designated agencies in each jurisdiction that control the jurisdiction’s compliance infrastructure. In practice, this means the financial regulators, corporate registrars, and relevant government agencies of the two jurisdictions, potentially with a neutral technical facilitator providing reference implementations, template agreements, and interoperable kernel software.

The legal basis for re-evaluation mappings is the same as for existing Mutual Recognition Agreements (MRAs) and bilateral regulatory cooperation agreements. The FATF’s framework provides a model for framework-level trust, not an entity-level AML passport by itself: a FATF-compliant source jurisdiction may justify reduced or partial receiving-zone review, while the corridor still needs entity-specific evidence and an explicit bilateral recognition rule before AML can be accepted. The IOSCO Multilateral Memorandum of Understanding provides a similar basis for securities cooperation. The innovation is the formalization of the re-evaluation set into a machine-executable mapping over a fixed domain taxonomy, so that the bilateral agreement produces a computational object rather than a legal text that must be interpreted by humans on each application.

Re-evaluation mappings evolve as regulations change. When a jurisdiction updates its rules in a domain, it notifies its corridor partners, and the re-evaluation mapping is revised. If the update strengthens the jurisdiction’s rules, the mapping may remain unchanged (the sending jurisdiction is now more compliant than the mapping requires). If the update weakens the jurisdiction’s rules, the receiving jurisdiction may downgrade recognition in that domain from “full” to “partial” or revoke it entirely. This re-evaluation can be automated: the corridor parameters include version identifiers for the regulatory frameworks they reference, and a change in version triggers re-evaluation of the mapping.

The first corridor is the hardest: no jurisdiction will invest in corridor infrastructure until there are entities that want to use it, and no entity will become multi-harbored until corridors exist. The path through this chicken-and-egg problem is to begin with jurisdictions that already have MRAs or bilateral cooperation agreements (the raw legal material already exists) and to offer the corridor as a technological upgrade to an existing legal relationship, not as a novel legal construct. The ADGM-DIFC corridor, the Singapore-Australia financial services MRA, and the EU’s existing passporting infrastructure are all candidates for this kind of upgrade. Each live corridor lowers the cost of the next.

Temporal staleness. The system must handle the gap between when a jurisdiction changes its rules and when the corridor mapping is updated to reflect the change. During this window, the corridor may over-recognize (accepting evaluations against rules that have since been tightened) or under-recognize (requiring fresh evaluation against rules that have since been relaxed). The system handles this conservatively: corridor parameters include a validity window, and operations that occur after the validity window expires require re-verification of the mapping before the corridor can be used. The mechanism is analogous to certificate expiry in TLS, and the failure mode (temporary inability to use the corridor until parameters are refreshed) is safe.

When an entity harbored in jurisdiction A wants to add jurisdiction B as a simultaneous harbor, or retire A under a separate legal act after B is established, the corridor-mediated operation proceeds as follows:

1. The entity presents its compliance passport to B’s system. The compliance passport is a hash-chained, cryptographically verifiable record of every compliance evaluation the entity has undergone in A. Each evaluation records the rule archive, proof-term digest, evaluator signature, validity window, and predecessor digest. The chain is tamper-evident: modifying any historical evaluation changes every subsequent hash.

2. B’s system verifies the passport cryptographically. This verification does not require trusting A’s system online or querying it in real time; it requires trusting A’s authenticated sovereign root and the corridor’s accepted rule archives. The verifier confirms that the chain is intact, that signatures are valid, that proof-term digests match the disclosed or sealed witnesses required by the corridor, and that the passport has not been tampered with.

3. B’s system consults the corridor parameters (R,\mu,\gamma). R specifies which destination domains B must re-evaluate locally. For domains in R, B requires fresh evaluation and does not accept A’s verdict. For domains not in R, B accepts A’s evaluation only when \mu maps a source domain to the destination domain, applying the grade-recognition map \gamma, which may downgrade the verdict (e.g., from “Compliant” to “Pending”) and flag the domain for review.

4. B’s system evaluates the entity in the domains that require fresh evaluation. Each fresh verdict is written into its own coordinate, replacing the fail-closed placeholder that carry-forward left there, and the recognized domains keep the carried-forward verdicts that \gamma produced. The two together are the entity’s compliance state in B, as the post-corridor state definition above specifies. The step is substitution on B’s own coordinates, not a meet against the carry-forward, and B’s state is not complete until every domain in R carries a signed B evaluation.

5. If the legal act retires A as a harbor, the entity’s harbor in A is deactivated once B’s evaluation is complete and the entity is fully compliant in B. That state is reachable whenever the requirements of the harbors the entity holds are co-satisfiable in the sense of Section 2. Where they are not, the corridor returns the InfeasibleHarborSet obstruction, and what must change is the harbor set rather than the entity’s evidence.

The FATF already rates jurisdictions on a four-level scale for anti-money laundering: Compliant, Largely Compliant, Partially Compliant, Non-Compliant. Those ratings assess national frameworks, not individual entities. A corridor can use a pair of favorable FATF assessments as evidence for reduced AML re-evaluation. AML leaves R only if the bilateral corridor also recognizes the relevant entity-level passport artifacts. Between a compliant and a largely-compliant jurisdiction, the corridor may retain AML in R with a partial recognition grade; for a non-compliant jurisdiction, it should retain AML in R with no recognition.

Why sanctions are in R by default. Sanctions are structurally distinct from quality-assessment domains (AML, securities, data privacy) because at least one major jurisdiction’s sanctions regime, notably OFAC under IEEPA Section 1702(a)(1), enforced through Section 1705, claims extraterritorial reach through financial-infrastructure dependencies that bind entities globally. Sovereignties do delegate sanctions determination in specific settings: UN Security Council Chapter VII resolutions are binding on all 193 member states under Article 25 of the UN Charter, EU Common Foreign and Security Policy decisions bind all 27 member states to implement identical sanctions lists, and FATF high-risk jurisdiction guidance circulates as a quasi-mandatory coordination instrument among participating jurisdictions. The multi-harbored framework treats sanctions as in R for general-purpose cross-sovereign corridors because for any corridor network that includes a jurisdiction subject to OFAC extraterritoriality, in practice the entire USD-clearing system, the conservative rule dominates: a corridor that did not re-evaluate sanctions could carry forward a permissive verdict that OFAC would not recognize, exposing the entity to secondary sanctions. Sanctions is also the domain in which the co-satisfiability hypothesis of Section 2 is known to fail. Council Regulation (EC) No 2271/96, Article 5, extended to the United States Iran measures by Commission Delegated Regulation (EU) 2018/1100, prohibits European Union persons from complying with the listed United States secondary sanctions, and the Court of Justice gave that prohibition effect in private litigation in Bank Melli Iran v Telekom Deutschland (C-124/20, 21 December 2021). For a harbor pair caught by both instruments, obeying the stricter requirement is itself the violation in the other harbor: the two requirements are not ordered, and no composed grade names an available action. The meet is not wrong here. It returns NonCompliant, the operation is refused, and the delegated program of Section 6 stops. What the corridor owes such a pair is the typed InfeasibleHarborSet obstruction naming both sovereign authorities, so that an infeasible harbor set is reported as such rather than as an ordinary blocked action that further evidence could clear. For a corridor confined to a subnetwork where a single sovereign determination binds (intra-EU CFSP, for instance), sanctions can be removed from R only under an explicit shared-sanctions-authority certificate and the corresponding corridor proof obligation. The general construction keeps sanctions in R because practical corridor networks do not confine themselves to such subnetworks. Characterizing the subnetworks for which sanctions is removable from R is an open question we return to in Section 10.

The compliance cost of a harbor transition under this model is the fresh evaluation of all domains in R (which includes sanctions by default for general-purpose cross-sovereign corridors, and may include additional domains depending on the corridor). For two jurisdictions with comprehensive mutual recognition (both FATF-compliant, both adherent to Basel III capital standards, both enforcing GDPR-equivalent data privacy), R can be limited to sanctions, and the remaining evaluation burden is minimal. The compliance component of switching cost is then proof verification plus fresh evaluation of the domains in R. The entity still needs to satisfy the target jurisdiction’s substantive requirements (physical presence, local directors, minimum capital). The compliance work, the evaluations, the evidence gathering, the regulatory filings, carries forward as a cryptographic artifact.

The compliance passport. The compliance passport requires a specific data structure; the abstract talk of a “cryptographic record” is not enough to determine how selective disclosure, tamper-evidence, and per-jurisdiction linkage interact. We commit to the following.

Definition (Compliance passport). A compliance passport for entity E is a content-addressed Merkle DAG P_E in which:

1. Each node is a compliance evaluation record comprising the entity identifier, the evaluating jurisdiction, the domain set evaluated, the resulting vector slice, the rule-version identifiers used, the timestamp, and the signature of the evaluating kernel’s signing key.
2. Each non-genesis node contains the SHA-256 digest of its predecessor evaluation record by the same jurisdiction, yielding a per-jurisdiction hash chain.
3. Each evaluation node contains a Merkle root over its per-domain verdicts, enabling per-domain selective disclosure via Merkle proofs.
4. Cross-jurisdictional corridor operations produce corridor records that reference both the sending jurisdiction’s passport head and the receiving jurisdiction’s evaluation nodes by their content hashes, linking the per-jurisdiction chains into a DAG.

Definition (Threat model). The passport’s default integrity model assumes:

1. Each jurisdiction’s kernel signing key is authentic, bound to the sovereign regulator via out-of-band mechanisms (a published root certificate anchored in the regulator’s public key infrastructure).
2. An entity cannot fabricate evaluation records without the corresponding sovereign kernel’s signature.
3. An entity may see its own passport in full and may attempt to withhold or re-present portions to a receiving jurisdiction. The per-domain Merkle structure permits selective disclosure; partial disclosure is a legitimate operation: the receiving jurisdiction’s corridor parameters specify which domains it requires disclosed for the corridor to proceed.
4. Privacy from the receiving jurisdiction is not provided by the default passport; it is an open problem addressed in Section 10.

Cross-jurisdictional consistency, the guarantee that the passport head seen by B matches the passport head seen by A, is ensured by bilateral notarization between kernels at corridor time. Global-consensus notarization is explicitly not required.

Under this threat model a receiving jurisdiction verifying a passport achieves soundness: if the passport verifies, then either (i) the claimed compliance vector was produced by the sending jurisdiction’s kernel signing key and has not been tampered with retroactively, or (ii) the compromise of that kernel’s signing key has enabled a forgery. Availability is not claimed; the receiving jurisdiction can always refuse the corridor. A zero-knowledge variant that may narrow the privacy gap is discussed in Section 10 and treated in The Sovereign Jurisdiction Network.

Harbors can be lost rather than retired. Every argument above is an argument from advantage: simultaneous operating power, composed constraints, avoided duplication, cheaper exit. There is a second argument, and it is about survival.

A jurisdiction is not a fixed feature of the world. It can be terminated, or folded into another, by an act of the sovereign or by treaty: a legal event the entity does not control and may not be warned of. For a single-harbored entity the consequence is severe: the registry that constitutes it as a legal person ceases, and there is no other place where it exists. It is not inconvenienced; it has no continuation. For a multi-harbored entity the same event is a re-homing problem. The entity survives in its remaining harbors, its composed state loses one coordinate, and the corridor machinery above is what carries it into a successor if one exists.

Two consequences follow that the composition algebra alone does not give.

First, the record of a jurisdiction’s own termination cannot live inside that jurisdiction, or a terminating registrar would be the custodian of the evidence of its own ending. It has to sit in a record above the individual jurisdictions, append-only and independently verifiable, and that record must not itself be terminable, or the same problem reappears one level up.

Second, succession has a live window rather than an instant. Between a declared termination and its effective date an entity is transiently harbored in both the predecessor and the successor, and during that window the composed state is the meet across both: an operation commits only if it clears under each. So the meet is not only the steady-state composition rule of Section 2; it is also what governs the legal cut itself. An entity crossing a succession is momentarily multi-harbored whether or not it chose to be.

This reframes what the harbor set is for. Diversification across jurisdictions is usually read as an operating convenience. It is also insurance against the discontinuity of a sovereign, and that is a property no single-harbored structure can buy at any price.

5. Jurisdictional competition

Albert O. Hirschman observed in 1970 that the members of an organization respond to decline through two mechanisms: exit (leaving) and voice (complaining). The relative effectiveness of each depends on the cost of exit. When exit is expensive, when leaving a country requires selling a house, finding new employment, learning a new language, and abandoning a social network, voice dominates. Citizens lobby, protest, vote. When exit is cheap, when switching banks requires filling out a form, exit dominates. Customers leave silently. The bank either improves or loses market share.

Hirschman’s analysis, however, is more nuanced than the simple “cheap exit is good” reading. Hirschman himself argued that excessive ease of exit can undermine voice and lead to institutional decay. If the most capable and engaged members of an organization are the first to leave (because they have the best outside options), the organization loses precisely the members whose voice would be most effective at driving reform. The institution deteriorates further, more members leave, and the cycle accelerates. This is Hirschman’s central tension: exit and voice are complements rather than substitutes, and the optimal institutional design makes both available.

The multi-harbored entity engages with this tension directly. In the multi-harbored model, exit is graduated. An entity can maintain its harbor in the declining jurisdiction while adding harbors elsewhere, preserving voice (the entity still has standing in the jurisdiction) while demonstrating the credible threat of full departure. This is closer to what Hirschman called “the threat of exit” strengthening voice than to the pure exit scenario he warned against. The entity that maintains a Delaware harbor while routing new operations through the ADGM is sending a signal to Delaware that has more disciplinary force than either pure exit or pure voice alone. The multi-harbored structure makes this signal structurally available, because adding a harbor is cheap while maintaining an existing one costs only ongoing compliance.

The multi-harbored entity blocks one route to a race to the bottom: a low-standards jurisdiction cannot relax the constraint surface of a cross-harbor operation, because the Applicable-fragment meet only tightens. That is a theorem about the composition operator, not an equilibrium theorem. Where the competitive advantage lands depends on corridor adoption, switching costs, and enforcement. The algebra creates the possibility of quality competition; it does not prove that the equilibrium selects it.

A full model is a two-stage game: jurisdictions choose corridor terms and enforcement; entities choose harbors and routes. Section 10 states the intended theorem suite. We prove nothing about it here.

For operations purely local to a single harbor, the entity operates under that harbor’s state vector alone (see Section 2). A jurisdiction with weak employment law could attract entities that route all employment operations locally. The defense is observational rather than algebraic: the compliance passport records all operations and their harbors. The algebra makes structuring visible. Punishing it is the jurisdiction’s job.

The multi-harbored entity and Tiebout’s idealization. Tiebout (1956) argued that under idealized mobility and information, competition between jurisdictions producing heterogeneous bundles of public goods yields an efficient spatial allocation: consumers sort into jurisdictions that match their preferences. The empirical weakness of Tiebout’s model has always been the gap between idealized mobility (costless relocation, perfect information) and the observed friction of moving between real places.

The program-operated multi-harbored entity narrows that gap along the compliance dimension. Compliance mobility becomes more algorithmic, compliance information becomes cryptographically inspectable under corridor disclosure rules, and the entity is less tied to a single physical location. These changes make Tiebout-style questions newly formalizable; they do not import Tiebout’s optimality conclusion without a game model.

Three caveats condition any Tiebout-style conclusion in the multi-harbored setting. First, Tiebout assumes additive utility across jurisdictions. The multi-harbored compliance state is the meet of per-jurisdiction constraints, not their sum. Meet over cross-harbor operations binds downward: adding a low-standards jurisdiction cannot relax cross-harbor compliance. This is compatible with Romano’s “race to the top” thesis (Romano, 1985), but it does not prove it: purely local operations (Section 2) do not experience meet-binding, and the fraction of activity that is cross-harbor determines how much the meet constrains behavior. Second, Tiebout did not model strategic jurisdictions, and the observed contest is weak: Bebchuk and Hamdani (2002) argue that no state credibly contests Delaware’s chartering position, so the race Romano described is barely run; corridors lower the cost of entering that contest without by themselves creating a challenger. Third, Hirschman’s voice-depletion problem remains: if exit-capable entities are also the entities whose voice would discipline the original jurisdiction, cheaper exit can weaken the residual voice pool. The game-theoretic question we return to in Section 10, whether jurisdictions in Tiebout-Hirschman-Romano equilibrium supply regulation at the quality frontier, at some intermediate level, at a laxity-seeking local-operation equilibrium, or at a pooling equilibrium, is the mechanism-design extension that a rigorous treatment requires.

Defaults, exit, and voice-depletion. Two strands of the law-and-economics literature sharpen the Hirschman reading, and a third qualifies it. Ayres and Gertner (1989) showed that penalty default rules induce disclosure by making silence expensive; the compliance passport of Section 4 disciplines in the same way, because structuring is recorded in a log the receiving jurisdiction consults as a precondition of the corridor. Roe (1994, 2003) documented that a credible exit threat disciplines managers against entrenched interests; the multi-harbored entity gives the entity-jurisdiction relationship the same channel, and the channel’s credibility depends on corridor availability and switching costs.

Hirschman (1970) argued that when the most capable exiters leave first, the institution loses the members whose voice would have been most effective, and the residual deteriorates. We inherit this risk. Partial harboring mitigates it: an entity that adds a harbor but does not abandon its original jurisdiction retains standing, voice, and reputational stake in the original. Whether the balance is preserved in equilibrium is a question our formal construction cannot answer on its own; it depends on how many entities choose partial over full exit and on whether the remaining voice is mobilized by those who stay. This is the voice-depletion tail risk that Hirschman himself warned against, and it is an open empirical problem that the multi-harbored infrastructure creates the conditions to study.

The framework does not undermine sovereignty. Each jurisdiction retains complete control over its rules, its evaluations, and its corridors. No jurisdiction is compelled to accept another’s compliance work. The re-evaluation mapping is a bilateral agreement, negotiated by regulatory bodies and formalized in machine-executable parameters, just as mutual recognition agreements are negotiated today. The framework formalizes the mapping and makes it machine-executable, but it does not override it. A jurisdiction that does not want to participate simply establishes no corridors. A jurisdiction that wants to participate selectively establishes corridors with specific partners, with specific recognition grades, for specific domains. What changes is the switching cost for the entity, not the authority of the jurisdiction.

6. Delegated programs operating multi-harbored entities

The exit signal of Section 5 is only as strong as it is fast, and its speed is set here: delegated programs operate the entity against the composed state at machine time, and machine-speed operation is what makes exit fast.

A delegated program operating within a multi-harbored entity navigates the composed compliance state vector as a constraint surface. The vector is a typed map of binding constraints.

Consider a multi-harbored entity with harbors in Delaware, Singapore, and the ADGM. A delegated program authorized to execute payroll operations in Singapore queries the composed state vector and sees: Employment domain is Compliant in all three harbors. Payments domain is Compliant in Singapore and the ADGM, Pending in Delaware (the entity lacks a payment processor authorization). The composed state for Payments is Pending, the most restrictive verdict. The program cannot execute payroll that involves cross-harbor payment flows until the Delaware Payments domain clears. A payroll operation purely within Singapore (local employment contract, local bank, local regulatory filing) operates under Singapore’s state vector alone, where Payments is Compliant, and the program can proceed.

What the program does next for cross-harbor operations is determined by an operator that would not exist without the lattice structure, and the operator must be named correctly. On each per-domain factor, and on the Applicable-fragment product of those factors, the lattice carries an implication operator, the residual. The residual is the right adjoint to meet: it answers questions of the form “which constraints are compatible with this target under the order?” It does not, by itself, improve the current compliance state. Since meet is restrictive, no value C can make A \wedge C strictly more compliant than A.

The scope matters. The full mixed-axis state is not a Heyting algebra, and two distinct repairs fail for two distinct reasons.

The first repair is to make the axis a chain: treat NotApplicable and Exempt as intermediate points between NonCompliant and Compliant. That fails on provenance rather than on algebra: collapsing them into one total five-element order destroys the distinction between an entity not subject to a domain and an entity compliant with it, which is the first thing a regulator asks and the audit trail must preserve.

The second repair is the one a lattice theorist reaches for, and it fails on the mathematics. Do not order the middles at all: adjoin a universal top and bottom and take greatest lower and least upper bounds. That does produce a bounded lattice, and the lattice contains the five elements \{\bot,\ \mathrm{NonCompliant},\ \mathrm{NotApplicable},\ \mathrm{Exempt},\ \top\} with the three middles pairwise incomparable, which is M_3, the diamond. Distributivity fails on it directly:

\mathrm{NonCompliant} \wedge (\mathrm{NotApplicable} \vee \mathrm{Exempt}) = \mathrm{NonCompliant} \wedge \top = \mathrm{NonCompliant},

while

(\mathrm{NonCompliant} \wedge \mathrm{NotApplicable}) \vee (\mathrm{NonCompliant} \wedge \mathrm{Exempt}) = \bot \vee \bot = \bot.

A non-distributive lattice is not Heyting, so this completion carries no residual. The obstruction is sharp but not universal: any bounded lattice in which the three middles have the same pairwise meet and the same pairwise join contains this M_3 as a sublattice and so fails distributivity, while a distributive completion does exist, for instance with the three states as atoms of the Boolean lattice 2^3. What the distributive completion costs is meaning: its synthetic joins, elements such as \mathrm{NonCompliant} \vee \mathrm{NotApplicable}, name no legal state, so a residual computed in it answers questions no regulator asks. The obstruction is semantic rather than order-theoretic, and the operational kernel responds to it directly: it uses two coupled objects, the residual on the Applicable fragment, and a remediation operator that tracks mixed-axis cases as structured outcomes rather than hiding them inside a single verdict.

Within that scope, the residual is sound as an implication operator. Its adjunction law is:

X \wedge A \leq B \quad \text{iff} \quad X \leq (A \Rightarrow B).

The planning primitive used by delegated programs is therefore a distinct remediation operator. It scans the current state vector, the target operation, validity windows, propagation graph, and corridor re-evaluation masks, then returns the set of coordinates whose state must change by fresh attestation, proof refresh, or typed discretion fill. If a coordinate is Pending and the target requires Compliant, the remediation operator does not meet in a new constraint; it names the evaluator or authority whose signed state transition can replace Pending with Compliant. If the operation touches mixed-axis cases, the operator returns the structured obstruction or preservation flag and routes the problem to the rule layer that owns the distinction. If the harbors admit no common course of action in a domain, so that the co-satisfiability hypothesis of Section 2 fails there, the operator returns an InfeasibleHarborSet obstruction naming the conflicting sovereign authorities instead of a fill plan: no sequence of attestations, proof refreshes, or discretion fills clears that coordinate while both harbors are held, and the harbor set is what must change.

This transforms the compliant part of planning from blind search to typed obligation discovery. The actual remediation (obtaining the required authorizations, producing the required evidence, satisfying the required evaluations) may still be expensive and time-consuming. The algebra eliminates ambiguity about which coordinates bind; the state-transition machinery changes the coordinates.

Typed discretion holes. Not every compliance evaluation is fully mechanical. Some require human judgment of a specified kind. The compliance rule language includes typed discretion holes: explicit markers in the evaluation where mechanical computation must stop and a human decision of a specified type must be supplied.

A discretion hole is typed. It specifies what kind of judgment is needed, who is authorized to supply it, and what the judgment’s effect will be on the compliance state. For example, a “fit and proper” determination for a fund manager in the ADGM requires judgment by the Financial Services Regulatory Authority. The compliance rule evaluates everything it can mechanically (the manager’s qualifications, the absence of criminal record, the absence of sanctions) and then halts at a typed hole: ? : FitAndProperDetermination @ ADGM_FSRA. The delegated program cannot fill this hole. Only the FSRA can. The type records that boundary.

Typed discretion holes are the formal boundary between machine and human in institutional operations. A delegated program operating a multi-harbored entity encounters these holes as explicit stopping points in its planning. The program can compute everything the algebra permits, use the remediation operator to identify authorized state transitions, execute mechanical operations, and then halt where human judgment is required.

Hart, Dworkin, and the type-theoretic form of open texture. Hart (1961, ch. VII) observed that legal rules have an open texture: core cases can be decided mechanically, but penumbral cases require judgment. Dworkin (1977) pushed further, arguing that principled judgment, rather than mere discretion within gaps, is constitutive of legal reasoning, and that a purely rule-based positivism cannot account for how principles guide decisions in hard cases. The typed discretion hole is a type-theoretic formalization of this long-standing observation. A rule evaluates everything its mechanical content permits, then halts at an explicitly typed hole whose type specifies the kind of principled judgment the law requires, the authority permitted to supply it, and its effect on the composed state. The type-theoretic framing is novel; the underlying recognition that some legal determinations are irreducibly judgmental is Hart’s, sharpened by Dworkin. The compliance state vector records the Hartian line between core and penumbra, and the Dworkinian reading of what happens in the penumbra is encoded in the type rather than disguised as a Boolean flag.

Delegation boundaries. The composed compliance state vector, the Applicable-fragment residual, the remediation operator, and the typed discretion holes together define the space within which a delegated program can operate. The state vector says where the entity stands. The residual is the Heyting implication on fixed Applicable slices; it supports compatibility reasoning. The remediation operator says which authorized state transitions, proof refreshes, or discretion fills are needed. The discretion holes say where the program must stop. Within these boundaries, the program has latitude: it can choose which compliance improvements to pursue first, which jurisdiction to route operations through, which banking partner to use. The latitude is bounded: the program cannot proceed through a NonCompliant domain, cannot fill a discretion hole it is not authorized to fill, and cannot make the entity less compliant than the meet of its harbors.

The practical consequence is that a delegated program operating a multi-harbored entity needs only to read a state vector. The regulatory expertise is encoded in the rules that produce it. The compositional expertise is encoded in the algebra. The boundary between machine execution and human authority is encoded in the typed discretion holes. The program operates within a formally defined space.

Systemic risks at scale. The formal construction admits deployment at scales ranging from a handful of sophisticated multinationals to a population of many program-operated entities. The dynamics at different scales are not symmetric. We name four systemic risks that become material at scale and that the construction in this paper does not address; each is a candidate for the game-theoretic agenda of Section 10.

First, herd behavior. If delegated programs optimize against similar objective functions (minimize compliance cost, maximize operational flexibility), they may route operations to the same harbors and create concentration risk. A regulatory change in a popular harbor could then trigger a mass exodus that destabilizes both the departing and the receiving jurisdictions. Second, regulatory arbitrage at speed. The passport-visibility check (passport-based structuring detection) requires jurisdictions to inspect passports, and inspection at machine speed is a computational challenge in its own right. If delegated programs can restructure faster than jurisdictions can inspect, the defense degrades. Third, sovereignty erosion by revealed preference. If the data show that entities overwhelmingly prefer certain regulatory configurations, jurisdictions may converge on those configurations through competitive pressure, producing a de facto harmonization that was never democratically chosen. Fourth, the emergence of entities that exist in dozens or hundreds of harbors simultaneously, with compliance states so tightly composed that operational latitude is effectively determined by the intersection of all participating jurisdictions’ rules. Such entities would be maximally compliant and maximally constrained: a novel institutional form that operates at the regulatory frontier of the whole network. Whether this is a race to the top in compliance or a regulatory paralysis from over-constraint depends on the structure of the jurisdictional network and is an open empirical question.

The infrastructure described in this paper makes these dynamics possible. Whether the resulting equilibrium is an improvement on the status quo depends on whether jurisdictions use the new feedback signals well, a question the infrastructure raises but cannot answer.

7. What this requires

The multi-harbored entity is the apex of a dependency chain. Building it requires specific infrastructure, each component derivable from the requirements of the object itself.

An algebra for composing compliance constraints. The pointwise meet of compliance state vectors requires a formal algebraic structure with declared scope. On the Applicable fragment of the twenty-three-domain product, the structure is a bounded distributive lattice with a Heyting residual available pointwise on the per-domain factors and therefore on the Applicable-fragment product. On the full state space it behaves as Section 2 fixes: meet on jointly Applicable coordinates, an explicit disagreement record elsewhere. The open theorem is audit-correctness: for each committed coordinate bundle, the reported result must be exactly the reduction of the signed source cells bound to the passport root, and no mixed outcome may be eliminated into an executable verdict without a named corridor or rule-layer authority. This algebra is derived from the legal requirement that a composed grade never exceed any member’s grade (restrictiveness, which with locality forces meet, Section 2), from the order-independence that follows (the meet is commutative and associative, so jurisdiction order does not matter on the Applicable fragment), and from the planning requirement that remediation be expressed as authorized state transition rather than as an illicit upward move under meet.

A logic for encoding jurisdictional rules. The compliance state vector is only as good as the rules that produce it. If rules are encoded as Python functions or Java conditionals, one cannot inspect where human judgment is needed, reason about rule interactions across jurisdictions, or produce the typed discretion holes that bound delegated execution. What is needed is a language designed for compliance rules: one that handles defeasible reasoning (later rules override earlier ones, specific rules override general ones), temporal stratification (historical facts are frozen; derived legal consequences can change when rules change), authority-relative interpretation (the same rule text means different things when asserted by different jurisdictions), and typed discretion holes (explicit boundaries where computation stops and human judgment must be supplied). Each of these properties addresses a concrete problem. Defeasibility encodes how regulatory exceptions work in practice. Temporal stratification encodes the distinction between what happened and what follows from what happened. Authority-relative interpretation encodes the fact that “anti-money laundering” in Singapore and “anti-money laundering” in Pakistan are not the same program, even when they share a name. Discretion holes encode the fact that some compliance determinations are irreducibly human. The formal study of defeasible legal rules and legal argumentation is mature (Governatori, 2005; Prakken and Sartor, 2015); the language requirements here are its engineering consequences.

Two prior projects carry most of the relevant design experience. Catala (Merigoux, Chataing and Protzenko, 2021) is a domain-specific language for legislative code, compiled to OCaml and used for French family-benefits statutes. Its design goal is faithful transcription of a single jurisdiction’s statute with its default-logic exceptions (the French principe de spécialité: specific provisions override general ones), together with a tabulated proof-of-equivalence between the statute text and the compiled program. Catala’s contribution is that an individual sovereign’s rule-system can be written by lawyers and programmers together and made executable with high assurance. L4 (Listenmaa et al., 2021; Mahajan, Strecker and Wong, 2022; Centre for Computational Law, Singapore Management University) targets the same problem for a different jurisdiction and in a visual, spreadsheet-adjacent surface syntax, with explicit focus on Singapore statute and regulations. Both projects establish that writing jurisdictional rules as programs with a formal semantics is feasible, and both pay serious attention to defeasibility and temporal change within a single legal system.

Neither project addresses cross-jurisdictional composition. A Catala program encoding French family-benefits statutes does not compose with a Singapore L4 program encoding the Monetary Authority of Singapore’s payments regulations; the two produce disjoint verdicts in disjoint type systems. Our construction positions itself immediately downstream of this work. Each jurisdiction’s rule-system (Catala-like, L4-like, or otherwise) produces a single coordinate of the compliance state vector; the multi-harbored construction adds (i) the pointwise meet across per-jurisdiction state vectors, recovering the composition that Catala and L4 do not attempt, and (ii) corridor parameters (R_{AB},\mu_{AB},\gamma_{AB}) translating domains and recognition grades under a bilateral re-evaluation set. The companion paper Lex specifies a rule logic that unifies the inspectability properties of Catala and L4 with the typed-discretion-hole discipline required for delegated execution in the multi-harbored setting.

A proof-producing kernel. The multi-harbored entity’s compliance state must be computed and proved. A regulator in Singapore needs to verify that the entity’s composed state vector was computed correctly from each jurisdiction’s evaluation. An auditor needs to reconstruct the compliance history. A court needs evidence that is tamper-evident. This requires a system, a kernel, that evaluates compliance against jurisdictional rules and produces, for every evaluation, a cryptographic proof bundle: a content-addressed mutation journal entry, a structured evaluation record, and a hash-chain update to the compliance passport. The kernel is the sole writer to its database, because if two processes could write, the audit trail could have gaps, and a court could not rely on it.

A network of sovereign kernels connected by bilateral corridors. Each jurisdiction deploys its own kernel. No kernel has authority over another. No kernel reads another’s database. Cross-jurisdictional operations are coordinated through corridors: bilateral relationships where each kernel evaluates the operation independently, signs its verdict, and commits only when both verdicts agree. The corridor protocol is a signed commitment protocol: resources are locked, verdicts are collected, and terminal action is authorized only by explicit finality evidence. If that evidence is absent, the operation remains in a bounded-blocking regime until timeout, abort evidence, or the missing signature arrives. The blocking behavior is the classical price of atomic commitment across autonomous parties (Skeen, 1981; Gray and Lamport, 2006).

Each of these components exists because the multi-harbored entity requires it. The algebra exists because compliance must compose. The logic exists because rules must be inspectable and explicit about their boundaries. The kernel exists because compliance evaluations must produce proofs. The corridor network exists because jurisdictions are sovereign and must coordinate without ceding authority. Remove any component and the multi-harbored entity cannot be constructed. The numbered companion papers specify the layers: Lex: A Logic for Jurisdictional Rules for the rule logic, Op: A Typed Bytecode for Compliance-Carrying Operations for the workflow substrate, and The Sovereign Jurisdiction Network for the kernel and corridor network. The founding thesis (Programmable Institutions) derives the necessity of programmable institutional infrastructure from first principles, and Intelligent Assets extends the construction to financial instruments that carry their own compliance rules and execute autonomously within the composed constraint surface.

Protocol and application layer. Once harbors, corridors, and passports are standardized, the resulting architecture admits a natural two-layer reading. The base layer is a decentralized institutional protocol: it carries issuance, transfer, routing, and settlement of compliance-bearing assets between sovereign kernels. Above it sits an application layer of delegated programs and tools that automate entity formation, treasury, governance, and trade. This protocol-and-application decomposition is an architectural reading of the standardized object, offered to locate the construction; the layer interface that this paper establishes formally is the algebraic one of Section 9.

The lattice-security analogy. The compliance state vector inherits a classical pattern from computer-security engineering. Bell and LaPadula (1973) modeled multi-level security over ordered security levels (Unclassified \leq Confidential \leq Secret \leq Top Secret), a distinction between subjects and objects, and a simple-security property together with the star-property (“no write-down”: a subject cleared at level \ell cannot write to an object at level \ell' < \ell); their Basic Security Theorem is an induction on state transitions, showing that if every transition preserves the two properties, every reachable state satisfies them. Denning (1976) made the lattice structure of secure information flow explicit: classifications form a lattice and information flow is monotone, so composition of secure flows remains secure.

The multi-harbored construction is structurally the same system, re-typed for institutional compliance. On the Applicable fragment, the per-domain compliance-grade order plays the role of the security-level lattice, and each regulatory domain contributes an independent copy. The subject-object distinction becomes the entity-jurisdiction pair: the entity plays the role of the subject, the jurisdiction plays the role of the object being accessed. Bell-LaPadula’s star-property has a direct analogue: composition is no-write-up in the verdict order. Adding a jurisdiction to a harbor set cannot raise any component of the composed verdict above its current level; it can only lower it, because the meet is monotone downward and never upward. The Bell-LaPadula simple-security property maps to the principle that an entity may operate only within the constraint surface its own composed verdict permits, never above it.

Three structural differences separate the two systems. First, the compliance lattice is a product of per-domain factors rather than a single chain; Bell-LaPadula is recovered as a one-domain specialization. Second, the Applicable-fragment lattice carries a residual (Section 6), while the mixed-axis case requires a structured partial algebra rather than one total lattice. Third, corridor operations transport compliance state between distinct lattices (sending and receiving jurisdictions), a structure with no analogue in the single-lattice Bell-LaPadula setting; the domain-recognition map \mu, grade-recognition map \gamma, and route-coherence equations for multi-hop corridors are new. The analogy nevertheless shows that the proof obligation for a jurisdictional compliance system is the same kind of obligation that has supported decades of formally-verified security kernels, and that the lattice-theoretic machinery of the present paper is the natural generalization of a well-understood design.

8. What this is not

Not a blockchain. A blockchain is a global consensus mechanism where every node validates every transaction against the same rules (Nakamoto, 2008). The multi-harbored entity requires no global consensus. Each jurisdiction evaluates independently under its own rules. There is no shared ledger, no proof of work, no proof of stake, no validators. The question a blockchain answers, “do these untrusted nodes agree on the order of transactions?”, is not the question here. The question here is: “does this entity satisfy the requirements of multiple sovereign jurisdictions simultaneously?” The answer is computed per-jurisdiction and composed point-by-point. No global agreement is needed.

The superficial similarity is that both use cryptographic hash chains. But a hash chain is a data structure, not an architecture. Using SHA-256 to link compliance evaluations is no more “blockchain” than using a Merkle tree in Git makes Git a cryptocurrency.

Not EU passporting. The EU’s passporting regime (for investment services, Directive 2014/65/EU, MiFID II) allows a firm authorized in one member state to operate in other member states under its home authorization. This is the closest existing analog to multi-harbored operation, and the difference is precise.

EU passporting is wholesale acceptance: the host state accepts the home state’s authorization entirely, without composition. There is no combined constraint surface. The home state’s rules govern. This works within the EU because member states have harmonized their regulatory frameworks. They have agreed, through decades of political negotiation, to apply materially equivalent rules. Multi-harbored operation does not require harmonization. It composes heterogeneous requirements through algebraic meet. Delaware corporate law and Singapore corporate law need not be similar for the composition to work. The meet takes the most restrictive requirement from each, domain by domain.

EU passporting is also limited to the single market. A firm passported within the EU has no mechanism to carry that authorization to Singapore or the ADGM. The compliance passport, by contrast, is portable to any jurisdiction that establishes a corridor, because the corridor defines the re-evaluation mapping on a per-domain basis.

Not the LEI system. The Legal Entity Identifier provides a unique identifier for entities involved in financial transactions. It solves the problem of knowing that “Entity X in Delaware” and “Entity X in Singapore” are the same entity. This is a necessary component of multi-harbored operation (the entity must be identifiable across jurisdictions), but it is not sufficient. LEI is an identifier. The compliance passport is an identifier plus the full compliance history. The multi-harbored entity requires both: a stable identity (which LEI or a similar system provides) and a portable compliance state (which the passport provides). LEI does the first. It does not attempt the second.

Not RegTech. Regulatory technology, the industry of software tools for compliance monitoring, reporting, and risk management, operates post-hoc. A RegTech tool monitors an entity’s operations and flags potential compliance issues. It does not evaluate compliance within the write transaction. It does not produce a cryptographic proof of compliance. It does not compose compliance states across jurisdictions.

The distinction is temporal. RegTech asks: “given what this entity has done, is there a compliance problem?” The compliance state vector asks: “given what this entity proposes to do, does the operation satisfy every relevant jurisdiction’s requirements?” The first is surveillance. The second is a gate. Both are necessary.

The remaining neighbors. Estonia’s X-Road exchanges data between government databases; it composes no constraints, and the citizen carries no passport. Cosmos IBC relays opaque packets between chains; a corridor carries typed compliance state, and the corridor knows what it is carrying. BEPS coordinates one domain, tax, across 140+ jurisdictions and produces no portable per-entity artifact; its rules can be encoded in the compliance logic and composed like any other Tax-domain verdict. The OECD Common Reporting Standard exchanges information between tax authorities, not the compliance state of the entities the information concerns. Regulatory sandboxes relax requirements inside one jurisdiction and do not travel; the multi-harbored entity seeks no exemption, satisfies all requirements in all harbors, and carries the proof. Delaware’s chartering dominance (Romano, 1985) is jurisdictional competition at the speed of doctrine, years per move, and a Delaware corporation in California is still evaluated from scratch; that timescale is precisely the friction this construction removes. Estonia’s e-Residency digitizes incorporation within Estonia’s own compliance surface and composes it with no other. Singapore’s COSMIC platform shares money-laundering risk data among institutions in one jurisdiction and one domain. The ADGM-DIFC arrangement cross-recognizes court judgments between two free zones of one federation. The IAIS and IOSCO multilateral memoranda coordinate supervisor-to-supervisor information sharing. Each is real infrastructure. None produces a composed, portable, per-entity compliance state.

9. The composed state as a pricing input

This section assembles the object, the corridor, and the delegated-program layer into the interface that connects the multi-harbored entity to the clearing of claims and their derivatives. The contribution here is the algebraic interface: what the multi-harbored entity contributes to the price of an instrument, and what the corridor contributes to the reliance a holder may place on it.

The discounted-cash-flow reduction. Standard valuation theory reduces every tradeable instrument to a probability-weighted discounted future cash flow: equity is a claim on residual earnings, debt a claim on principal and coupon timing, a sukuk a claim on Sharia-permissible asset usage cash, parametric insurance a contingent claim on an adverse-event cash flow; derivatives are claims constructed from claims. We call the union the contingent-claim taxonomy; a claim, in this paper, is the type whose instances are its elements. The reduction is standard (Damodaran, 2012; CFA Institute, 2015; Koller, Goedhart and Wessels, 2020). What is new is the observation that the object whose admissibility composes by meet across jurisdictions, the composed compliance state vector, is exactly the object whose composition determines the holder set, and therefore the liquidity, of any claim the entity issues.

The pricing surface. Fix a multi-harbored entity E with composed Applicable-fragment state T^{\mathrm{App}}(E), and let S be a contingent claim issued by E. The clearing price of S at any time is the conditional expectation of its discounted future cash flows under a probability measure on the cash-flow-determining state and a holder population. The composed state enters through the holder population, three ways. First, it is an admissibility filter: in each jurisdiction J \in H(S), the meet T^{\mathrm{App}}(E) \wedge C^{\mathrm{App}}_J(S) of the issuer’s state and the per-instrument envelope determines which holders in J may lawfully receive the instrument, and a claim whose composed envelope is NonCompliant in any domain the holder’s harbor marks Applicable cannot be held there. Second, it is a quantitative pricing input, and the two corridor parameters enter with different signs. A pointwise-larger grade-recognition map \gamma_{AB} weakly raises every carried coordinate, hence weakly enlarges the holder set in B, and a weakly larger holder set means weakly more liquidity and, under any standard liquidity-discount model (Amihud-Mendelson, 1986; Pastor-Stambaugh, 2003), a weakly higher clearing price. Removing a domain from R_{AB} carries no such sign: the carried grade then stands in place of B’s fresh evaluation, which enlarges the holder set where the carried grade weakly dominates what that evaluation would assign and shrinks it where it does not, and before the evaluation is signed the comparison is unknown. Recognition depth is therefore a typed pricing input, not a monotone one; only the \gamma direction carries a sign. Third, none of this is specific to a product class: a clearing substrate that consumes the composed envelope and the corridor’s recognition depth handles the whole taxonomy, parameterized per class by the authority, evidence, risk, dispute, and reporting structure each class requires. We call that substrate the universal-claims clearing layer.

What this paper does not specify. Matching, settlement, risk reservation, reliance recording, dispute, and recovery on the clearing side are not specified here, and no companion paper specifies them yet. Intelligent Assets supplies the typed object class that crosses this interface, not the clearing substrate that consumes it; the substrate’s specification is stated as an open obligation in Section 10. This paper fixes what the clearing substrate consumes, the composed Applicable-fragment state, the corridor parameters, and the per-instrument envelope, and the operations it must respect: the meet, the recognition depth, and the typed discretion-hole assignment.

10. Open problems

The multi-harbored entity creates formal problems whose solutions are not known.

Open obligation (multi-jurisdictional tax interaction). When an entity operates in jurisdictions J_1, J_2, \ldots, J_n, each jurisdiction taxes the entity according to its own rules. Tax obligations do not compose through meet: they compose through addition before relief, then through treaty and anti-avoidance transformations that may credit, exempt, reduce, re-characterize, or obstruct a liability. The compliance state vector handles the binary question (“is the entity tax-compliant in this jurisdiction?”) but does not model the interaction between tax obligations across jurisdictions.

The target object is a typed TaxLedger, a finite multiset of TaxLine records (taxpayer, creditor_jurisdiction, kind, period, legal_basis, base, rate_rule, amount, due_date, status, evidence, relief_key) modulo normalization. Jurisdiction-local assessment maps produce raw lines and typed discretion holes; treaty morphisms produce credit, exemption, withholding-reduction, tie-breaker, information-exchange, or obstruction lines; transfer-pricing and GloBE passes normalize the ledger. The theorem suite is: termination and confluence of normalization; additivity of raw obligations before relief; no-erasure relief, meaning every raw liability is paid, credited, exempted, reduced by a cited treaty article, or surfaced as an obstruction; legal-basis and evidence preservation; projection soundness from normalized ledger to the binary Tax-domain verdict; and cycle coherence as equality of normalized ledgers rather than identity of raw obligations.

Open obligation (game theory of jurisdictional competition). The claim that cheaper exit creates jurisdictional competition is a Hirschman/Tiebout/Romano mechanism hypothesis, not a proved equilibrium theorem. The formal target is a two-level game: corridor-network formation followed by entity mobility. Jurisdictions choose policy vectors (\text{tax}, \text{rule quality}, \text{processing speed}, \text{enforcement quality}, \text{disclosure floor}, \text{corridor policy}, R,\mu,\gamma); entities choose harbor sets, local/cross-harbor operation allocation, routes, and exit/voice effort under parameters for non-computational switching cost, passport-signal precision, cross-harbor operation share, inspection intensity, and voice value. The intended theorem suite is finite mixed-Nash existence for a discretized model, exit-signal monotonicity under explicit single-crossing or logit assumptions, the meet-floor theorem for cross-harbor operations, and parameter-regime classifications for quality-seeking, laxity-seeking, pooling, and segmented equilibria. The paper does not claim uniqueness, efficiency, or any general race-to-top/race-to-bottom classification.

Open obligation (privacy-preserving compliance portability). The compliance passport carries the entity’s full compliance history. Sharing this history with a receiving jurisdiction reveals information that the entity may prefer to keep private: which domains have been flagged, how many evaluations have occurred, whether there was a period of non-compliance that was subsequently remediated. The disclosed verification path is narrower and already specified: a receiving zone checks signed evaluation nodes, hash-chain continuity, Merkle inclusion for disclosed domain commitments, accepted pack windows, non-revoked sovereign and PCAuth credentials, quorum attestations where discretion fills are disclosed, and append-only proof-bundle replay. That gives ordinary disclosed soundness under the stated cryptographic assumptions. Zero-knowledge proofs offer the stronger solution: the entity proves that its compliance passport satisfies the receiving jurisdiction’s requirements without revealing non-required contents. The remaining obligation is to define the public inputs, hidden witnesses, leakage profile, revocation freshness, and circuit relation for the required passport predicates, then prove soundness and selective-disclosure non-interference. This is active cryptographic and language-compilation work, not a solved problem.

Open obligation (corridor network governance). The corridor network grows as jurisdictions establish bilateral relationships. The governance question remains: who governs the network itself, who decides that a corridor parameter is misconfigured, and who arbitrates when two jurisdictions’ corridor definitions are inconsistent? These are governance questions that do not have technical answers. The corridor protocol is designed to be bilateral: each pair of jurisdictions negotiates its own terms. The network effects of multi-hop corridors, such as an entity adding harbor C through B rather than directly from A, create externalities that bilateral negotiation may not handle well. The target construction is a signed corridor-governance state machine with endpoint ratification, route-impact notice, validity-window binding, watcher registry, dispute forum, bond custodian, epoching, drain windows, emergency halt/suspension, schema-evolution events, shared-sanctions-authority certificates, and proof-status monotonicity. The obligation is to prove authorization soundness for each governance transition, replay-based audit reconstruction, sovereignty preservation for non-endpoint zones, route-coherence publication before loosening or schema change, sanctions local re-evaluation unless a valid shared-authority certificate covers the corridor, watcher/slashing soundness, and proof-status honesty.

Open obligation (route-dependence and corridor obstructions). When an entity adds harbor C from jurisdiction A, it can use a direct corridor or route through jurisdiction B. If both routes produce the same corridor-recognized compliance state and the same instrument obligations, the corridor system is coherent for that route. If they differ, the system has a structural inconsistency. The pure Applicable-fragment meet is associative, so the obstruction is not a hidden triple failure inside the lattice. It lives in the corridor data: the direct mask and recognition map must agree with the staged composite, and the instrument clauses must agree under the same route. The obligation is to define necessary and sufficient route-collapse equations and prove that failing equations are reported as structured RouteCoherenceObstruction values rather than silently normalized.

Open obligation (universal-claims clearing layer). Section 9 fixes the interface the clearing side consumes: the composed Applicable-fragment state, the corridor parameters (R,\mu,\gamma), and the per-instrument envelope. The layer that consumes them is specified neither in this paper nor in any companion paper of this programme. The target object is a clearing substrate parameterized per claim class by the authority, evidence, risk, dispute, and reporting structure the class requires. The theorem suite is: admissible-holder-set determination, that the holder set computed from an instrument’s composed envelope and a candidate holder’s own harbor vector is exactly the set of holders no participating harbor bars from holding; reliance-binding soundness, that the reliance a holder in B may place on carried issuer state is bounded by the recognition depth of the corridor that carried it, so that a shallow corridor cannot underwrite a deep reliance; settlement finality against corridor validity windows, so that no settlement is final on evidence whose window has expired; and dispute and recovery, that a verdict revoked at the issuing harbor after settlement has a defined unwind over a bounded set of affected holders. Until that suite exists, the consequence drawn in Section 9 is a statement about the admissibility filter and the holder set it determines, not about a mechanized clearing system.

Non-computational switching costs. This paper argues that the compliance component of jurisdictional switching cost can approach proof verification plus corridor-required re-evaluation under an accepted corridor. But compliance is not the only switching cost. Physical assets, local employees, banking relationships, contractual obligations, tax consequences, governance consents, and reputational capital all create friction that no algebraic operation can eliminate. The interaction between computational switching costs (which the multi-harbored entity reduces) and non-computational switching costs (which it does not) determines the actual competitive dynamics between jurisdictions. An empirical analysis of the relative weight of these costs for different entity types and industries is needed to calibrate the competitive claims.

Delegated fiduciary duty under programmatic management. When a delegated program operates a multi-harbored entity on behalf of its beneficial owners, the classical principal-agent relationship (Jensen and Meckling, 1976) is re-mediated. The program’s action space is bounded by the composed compliance state vector and by the typed discretion holes the rule-system exposes; within those bounds the program executes operations without a human in the loop, and its behavior is recorded on the compliance passport. This is a form of delegated authority that existing fiduciary-law doctrine is not designed to handle. Sitkoff (2011, 2014) articulates the loyalty and care duties that bind fiduciaries under common law; Möslein (2018) and Armour and Eidenmüller (2020) examine the strain that delegating corporate decisions to algorithms places on those duties. The open problem is to define, formally, what it means for a delegated program to discharge a fiduciary duty when (i) its action space is a typed remediation surface over a composed compliance state vector, (ii) the principal’s preferences are represented by scoped parameters rather than by ongoing oversight, and (iii) the evidentiary record of its decisions is a content-addressed cryptographic log. A theory of delegated fiduciary duty under programmatic management would specify (a) which decisions remain irreducibly the principal’s, encoded as typed discretion holes; (b) what a loyalty breach by a delegated program operating within a typed constraint surface looks like; and (c) what enforcement mechanism makes the passport evidentiarily admissible in fiduciary litigation. The present paper states the problem; it does not solve it.

11. Conclusion

The multi-harbored entity is not multinational structuring by another name. It is one legal-operational identity with a harbor set, a corridor-valid compliance passport, and a twenty-three-domain state vector composed across jurisdictions by pointwise meet on the Applicable fragment. Read as a portfolio, it is a typed bundle of jurisdictional contingent claims whose pointwise-meet composition is the binding constraint surface for cross-harbor operation. That primitive buys explicit composition, portable proof, and a legible account of which jurisdictional constraint binds. It also buys per-instrument envelopes: one issuer can support a sukuk, a sovereign parametric insurance contract, and a conventional structured-credit instrument without pretending they share one undifferentiated compliance profile.

The infrastructure to support the object follows from those requirements: scoped algebra, inspectable rule logic, proof-producing kernels, corridor protocols, and a protocol layer carrying compliance-bearing assets between sovereign systems. Above that protocol belongs a clearing layer that consumes the composed admissibility envelope as a typed input and prices, matches, settles, and binds reliance to claims against it across the full contingent-claim taxonomy. This is the institutional analogue of protocol plus application layer. The companion Sovereign Jurisdiction Network paper specifies the multi-kernel network and bilateral corridor protocol on which the issuance side operates; the companion Intelligent Assets paper specifies the typed-object surface: the class of instruments that carry their own compliance rules across that interface. The clearing layer itself is specified in no paper of this programme yet; its specification is an open obligation of Section 10. The pair the construction points at is issuance and clearing: the multi-harbored institution mints and governs claims; a universal-claims clearing layer clears, settles, prices, and binds reliance to them.

The principal consequence of the construction is structural. The composed state vector enters the pricing surface for any instrument the entity issues, because the meet determines the holder set; the corridor’s recognition depth enters as a typed liquidity input through the grade-recognition map. When the compliance component of jurisdictional exit becomes cheaper, jurisdictions receive a stronger exit signal, and entities receive a richer issuance surface across the claim taxonomy. The construction reduces the compliance component of exit to proof verification plus corridor-required re-evaluation. What jurisdictions do with it is the open game. Sovereignty is preserved because every harbor still evaluates under its own rules and every corridor is bilateral. The open obligations remain substantial. Multi-jurisdictional tax interaction, game-theoretic equilibrium analysis, privacy-preserving compliance portability, corridor network governance, route-dependence obstructions, the interaction with non-computational switching costs, and the formal specification of the universal-claims clearing layer’s matching, reliance, and dispute mechanisms are genuine research problems this paper does not solve. They define the research agenda downstream of the construction.

Appendix A. Dependent verdicts and typed dependency graphs

The construction in the body of the paper treats the domains in \mathcal{D} as independent coordinates of the compliance state vector: the value at one coordinate is computed by the relevant jurisdiction’s rules and does not, in the base formalism, depend on the value at another coordinate. This is deliberately the minimal structure. Real legal rule-systems, however, exhibit genuine dependencies: an entity’s custody-domain verdict for a regulated asset may depend on its licensing-domain verdict, which may in turn depend on its fit-and-proper determination in the corporate-governance domain. We sketch the strongest safe extension currently visible. It is an open obligation, not a claim that all dependent schemas inherit the uniqueness theorem automatically.

A dependent-verdict schema over a finite domain set \mathcal{D} is a finite directed acyclic graph < on \mathcal{D} together with a family of rules

r_d : \prod_{d' < d} V_{d'} \to V_d

for each domain d. We write (v(d'))_{d' < d} for the tuple of predecessor verdicts that domain d’s rule may consult. A compliance evaluation against a dependent-verdict schema is a section v \in \prod_{d \in \mathcal{D}} V_d that respects the dependency graph: for every domain d, the component v(d) \in V_d is determined by the domain’s rule r_d applied to (v(d'))_{d' < d}.

Open obligation (dependent-verdict composition). Let v_1, \ldots, v_n be valuations for n jurisdictions, each satisfying the dependency graph of the shared schema. In the homogeneous case, where the same rule family r_d is used for the theorem statement, a sufficient condition for the pointwise meet v(d) \coloneqq \bigwedge_k v_k(d) to satisfy the same dependency graph is: (i) the dependency graph is shared across jurisdictions, (ii) each rule r_d is monotone in its predecessor arguments, and (iii) each r_d preserves finite meets of predecessor valuations. Without the meet-preservation premise, the pointwise meet of two satisfying valuations need not itself satisfy the same dependent rule.

Real jurisdictions use heterogeneous rule families. For that case the target theorem must name a composed rule r^{\wedge}_d and prove the meet-compatibility square

r^{\wedge}_d\left(\bigwedge_k (v_k(d'))_{d' < d}\right) = \bigwedge_k r_{k,d}\left((v_k(d'))_{d' < d}\right).

Without this square, the pointwise meet is only a candidate valuation, not a dependency-respecting section. The remaining proof obligation is to mechanize closure of dependency-respecting sections under meet and prove that locality and restrictiveness descend to that constrained subspace; only then does the uniqueness theorem lift from independent coordinates to the dependent schema.

Proposition (Cycles are forbidden for the well-founded evaluator). If the dependency relation < on \mathcal{D} contains a cycle, the dependent-verdict schema is not well-founded for the evaluator used here: the value of at least one domain depends, directly or indirectly, on itself, so no topological finite application of the rules r_d computes the valuation. This does not prove that no valuation exists under any semantics; cyclic systems can have fixed points. It states the admissibility rule of this paper. Cycles must be resolved out-of-band (by splitting a domain, by staging evaluation, by selecting a least/greatest fixed-point semantics with a uniqueness theorem, or by a bilateral agreement between jurisdictions on the dependency order) before the compliance state vector is well-defined in the present well-founded calculus.

Dependent verdicts are a refinement of the independent-coordinate construction: an independent-coordinate schema is the special case where the dependency graph is empty, and every result of the body of the paper specializes to that case. For non-empty dependency graphs, proof work remains. Corridor schema transport is also open: \mu_{AB} must be a graph homomorphism from the source dependency graph to the destination dependency graph, or the corridor must return a dependency-graph mismatch; \gamma_{AB} must preserve the rule hypotheses needed for meet-closure and the heterogeneous meet-compatibility square. A staged corridor route respects dependent verdicts only under those additional obligations.

References.

• Hirschman, A. O. (1970). Exit, Voice, and Loyalty: Responses to Decline in Firms, Organizations, and States. Harvard University Press.
• Hart, H. L. A. (1961). The Concept of Law. Oxford University Press. Ch. VII (“Formalism and Rule-Scepticism”), sec. 1: “The Open Texture of Law.”
• Dworkin, R. (1977). Taking Rights Seriously. Harvard University Press.
• Romano, R. (1985). “Law as a Product: Some Pieces of the Incorporation Puzzle.” Journal of Law, Economics, and Organization, 1(2), 225-283.
• Bebchuk, L. A. & Hamdani, A. (2002). “Vigorous Race or Leisurely Walk: Reconsidering the Competition over Corporate Charters.” Yale Law Journal, 112(3), 553-615.
• International Association of Insurance Supervisors. (2007, revised 2014). IAIS Multilateral Memorandum of Understanding on Cooperation and Information Exchange. Adopted 15 February 2007; revised 10 July 2014.
• International Islamic Financial Market. IIFM Sukuk Report. Annual series. (Successive editions report global sukuk issuance on the order of $200B a year.)
• OECD. (2017). Standard for Automatic Exchange of Financial Account Information in Tax Matters (Common Reporting Standard). OECD Publishing.
• Republic of Estonia. (2014). e-Residency of Estonia. Government of the Republic of Estonia.
• Merigoux, D., Chataing, N., & Protzenko, J. (2021). “Catala: A Programming Language for the Law.” Proceedings of the ACM on Programming Languages, 5(ICFP).
• Listenmaa, I., Morris, J., Ang, A., Hanafiah, M., & Cheong, R. (2021). “An NLG Pipeline for a Legal Expert System: A Work in Progress.” arXiv:2107.02421. Centre for Computational Law, Singapore Management University.
• Mahajan, A., Strecker, M., & Wong, M. W. (2022). “Overview of the CCLAW L4 Project.” ProLaLa 2022: Programming Languages and the Law, POPL 2022 workshop, Philadelphia, 16 January 2022. Centre for Computational Law, Singapore Management University.
• Governatori, G. (2005). “Representing Business Contracts in RuleML.” International Journal of Cooperative Information Systems, 14(2-3).
• Prakken, H. & Sartor, G. (2015). “Law and Logic: A Review from an Argumentation Perspective.” Artif. Intell., 227.
• Kwon, J. & Buchman, E. (2019). “Cosmos Whitepaper.” Interchain Foundation.
• Nakamoto, S. (2008). “Bitcoin: A Peer-to-Peer Electronic Cash System.”
• European Commission. (2014). Directive 2014/65/EU (MiFID II): Markets in Financial Instruments Directive. Official Journal of the European Union.
• Financial Action Task Force. (2012). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. Updated 2023.
• e-Estonia. (2001). X-Road: A Distributed Data Exchange Layer. Estonian Information System Authority.
• Tiebout, C. M. (1956). “A Pure Theory of Local Expenditures.” Journal of Political Economy, 64(5).
• Gray, J. & Lamport, L. (2006). “Consensus on Transaction Commit.” ACM Transactions on Database Systems, 31(1).
• Skeen, D. (1981). “Nonblocking Commit Protocols.” Proceedings of the 1981 ACM SIGMOD International Conference on Management of Data.
• OECD. (2015). OECD/G20 Base Erosion and Profit Shifting Project: Final Reports. OECD Publishing.
• OECD. (2023). Two-Pillar Solution to Address the Tax Challenges Arising from the Digitalisation of the Economy. OECD/G20 Inclusive Framework on BEPS.
• Global LEI Foundation. (2014). The Legal Entity Identifier (LEI): Global LEI System. GLEIF.
• Financial Conduct Authority. (2016). Regulatory Sandbox. FCA Innovation.
• Monetary Authority of Singapore. (2023). COSMIC: Collaborative Sharing of ML/TF Information and Cases. MAS.
• IOSCO. (2002). Multilateral Memorandum of Understanding Concerning Consultation and Cooperation and the Exchange of Information. International Organization of Securities Commissions.
• McKinsey & Company. Global Banking Annual Review. Series, various years. (Successive editions have documented the rise of compliance and control costs at large banks to 5 to 10% of revenue.)
• Bank for International Settlements. (2010, revised 2017). Basel III: International Regulatory Framework for Banks. Basel Committee on Banking Supervision.
• Bell, D. E. & LaPadula, L. J. (1973). Secure Computer Systems: Mathematical Foundations. MITRE Technical Report ESD-TR-73-278.
• Denning, D. E. (1976). “A Lattice Model of Secure Information Flow.” Communications of the ACM, 19(5), 236-243.
• Ayres, I. & Gertner, R. (1989). “Filling Gaps in Incomplete Contracts: An Economic Theory of Default Rules.” Yale Law Journal, 99(1), 87-130.
• Roe, M. J. (1994). Strong Managers, Weak Owners: The Political Roots of American Corporate Finance. Princeton University Press.
• Roe, M. J. (2003). Political Determinants of Corporate Governance: Political Context, Corporate Impact. Oxford University Press.
• Jensen, M. C. & Meckling, W. H. (1976). “Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure.” Journal of Financial Economics, 3(4), 305-360.
• Sitkoff, R. H. (2011). “The Economic Structure of Fiduciary Law.” Boston University Law Review, 91, 1039-1049.
• Sitkoff, R. H. (2014). “An Economic Theory of Fiduciary Law.” In A. S. Gold & P. B. Miller (eds.), Philosophical Foundations of Fiduciary Law, Oxford University Press, 197-208.
• Möslein, F. (2018). “Robots in the Boardroom: Artificial Intelligence and Corporate Law.” In W. Barfield & U. Pagallo (eds.), Research Handbook on the Law of Artificial Intelligence, Edward Elgar, 649-670.
• Armour, J. & Eidenmüller, H. (2020). “Self-Driving Corporations?” Harvard Business Law Review, 10(1), 87-116.
• Damodaran, A. (2012). Investment Valuation: Tools and Techniques for Determining the Value of Any Asset, 3rd ed. Wiley.
• CFA Institute. (2015). Equity Asset Valuation, 3rd ed. (J. E. Pinto, E. Henry, T. R. Robinson, & J. D. Stowe, eds.). Wiley.
• Koller, T., Goedhart, M., & Wessels, D. (McKinsey & Company). (2020). Valuation: Measuring and Managing the Value of Companies, 7th ed. Wiley.
• Amihud, Y. & Mendelson, H. (1986). “Asset Pricing and the Bid-Ask Spread.” Journal of Financial Economics, 17(2), 223-249.
• Pastor, L. & Stambaugh, R. F. (2003). “Liquidity Risk and Expected Stock Returns.” Journal of Political Economy, 111(3), 642-685.