Conformance and recognition are different acts

The distinction the whole protocol rests on is the one most often collapsed.

Conformance is a fact about software. A node — the software a jurisdiction runs at a network endpoint — either answers the specified interfaces with the specified semantics, or it does not; the question is decided by running a published test suite and publishing the result. It is technical, machine-decidable, and reproducible by anyone who downloads the suite.

Recognition is an act of a sovereign authority. A ministry, registrar or supervisor decides that determinations made under another jurisdiction’s law will be given effect under its own, in stated domains, at a stated grade, subject to stated conditions. It is legal, discretionary, and revocable.

These are performed by different parties, and the protocol keeps them apart everywhere. The body that writes the specification certifies conformance and holds no power to grant, withhold, condition or revoke recognition, and no power to admit or exclude any jurisdiction. The competent authorities grant recognition and hold no power over the specification. In one line: the standards body keeps the pen; the sovereigns keep the list.

This split is not a courtesy. A private company that both writes the rules and decides who is in the club is the arrangement sovereigns refuse, and refuse correctly. A private company that publishes a testable standard while the membership decision stays with the members is an arrangement sovereigns already accept across conformity assessment, aviation registries, financial-messaging standards and internet numbering. The split is what makes the protocol acceptable, and — because a membership decision that requires no central approval is a membership decision that does not queue — it is also what makes it scale.

The protocol therefore certifies nothing about any authority, ministry, court or officer. It certifies the behaviour of software at a network endpoint, on a date, against a published suite.

The four boundaries

Four properties are stated as invariants of the design rather than as policy, because a network that violates any of them is one a sovereign can join only by ceding something it will not cede.

There is no consensus protocol binding nodes that are not both endpoints of the transaction. There is no append-only log that the network shares as authoritative state: each node keeps its own, and a corridor’s record is held by its two endpoints alone. There is no validator set that validates transactions on behalf of nodes that did not produce them. And there is no act of the network that can create, modify or extinguish a recognition edge in a node without that node’s own signature.

Validation is local. Corridors exchange proofs, not trust. A jurisdiction that accepted a network quorum’s determination of what its own registry says would have delegated its registry, and no amount of cryptographic elegance changes what that delegation is.

What two nodes do run between themselves is a commitment protocol in which each endpoint signs its own side and neither can commit alone. That is a bilateral agreement, and it binds nobody who is not party to it. The boundaries above are about the network; they say nothing against two parties agreeing with each other.

The boundaries create an immediate problem, and it is worth stating before its solution: a network with no central authority cannot create an edge by a network act — and the entire value of accession is that one act creates many edges.

Three objects, before the construction

Three objects recur, and the construction is unreadable without them.

A listing is the published record of a node’s conformance: its class, the specification version it was tested against, the date, and the evidence. Classes are ordered, and each class carries a ceiling on the grade any participant may assert toward a node holding it.

A grade, per compliance domain, is how far a participant gives effect to another’s determinations: in full, in full but flagged for local review, conditional on a stated fact, or not at all. The companion paper Mutual Recognition develops the vocabulary and the composition rules.

A corridor is a directed channel between two participants over which compliance state travels, carrying its own grades per domain.

The standing recognition instruction

The resolution of the problem above is a local policy object, installed by each participant in its own node, which we call a standing recognition instruction.

The instruction states four things in the participant’s own words: a ceiling grade, per compliance domain, beyond which it will not recognize anyone; a minimum conformance class it requires of a counterparty node; a floor specification version below which it will not interoperate; and an exclusion set naming jurisdictions it declines. Its effect is a standing rule: for every jurisdiction listed in force in the register that is not excluded, whose node holds a current listing at or above the required class against a specification version at or above the floor, emit a locally signed recognition edge at the lesser of this participant’s ceiling and the ceiling that the counterparty’s certified conformance class carries.

The class is a cap, not a setting. The certified class of a node fixes the highest grade any participant may assert toward it, and each participant still chooses its own grade beneath that cap. A node refuses to act on an inbound corridor instrument asserting a grade above its class. Making the cap machine-derived from a tested class, rather than from anything the counterparty writes down about itself, is what stops a participant from raising the grade at which the network recognizes it by declaring a higher one.

Five properties follow, and they are the design.

The edge is created by the participant’s own signature, evaluated by its own node, under its own policy. No network act creates it. The boundary above is preserved exactly, not approximately.

The register is an input to a local policy, not an authority. A participant that stops trusting the register narrows or revokes its instruction and loses nothing else. Its existing edges live in its own authority registry, signed by itself.

One deposited instrument produces edges with every participant whose instruction admits it. The number of edges is the number of admitting participants; the number of negotiations is zero. This is the accession construction, implemented without a central actor.

Recognition under an instruction is reciprocal. A participant is entitled to the grade another participant’s instruction offers it only to the extent its own instruction offers that grade in return, so each direction carries the lesser of the recognizing participant’s ceiling, the counterparty’s ceiling and the counterparty’s class cap. Recognition is directed and the two directions differ whenever the two nodes hold different classes; what reciprocity fixes is that neither side can be entitled to more than it offers. This is the second of the five hypotheses, and it is what makes one deposit per participant reproduce the relation that pairwise negotiation would have reached. A participant that files no instruction offers a ceiling of none, so the pair grade is none and the pair simply has no edge.

No participant is obliged to install one. A participant may operate on explicit per-counterparty recognition only. It is fully a participant. It gains fewer edges, one at a time — which is to say it has chosen the bilateral regime for itself while remaining inside the multilateral one. Where a participant already holds an explicit bilateral recognition with a jurisdiction its instruction also admits, the two are separate grounds for the same acceptance and the stronger governs, exactly as two mutual recognition agreements over one corridor compose by taking the strongest resolved grade — subject to the class ceiling, which binds every ground inside the protocol’s conformance scope. The grade is the lesser of that ceiling and the strongest available ground. A bilateral instrument asserting more than the ceiling allows is outside conformance and composes nothing here. The rule is published and nobody adjudicates the overlap, and where a participant holds an unregistered bilateral its pair grade is computable only by the two parties to it. That is the fourth hypothesis.

The instruction is published in machine-readable form, so that a jurisdiction considering accession can compute in advance exactly which counterparties it will reach and at what grade. An instruction is a standing rule rather than a one-time computation: each node re-evaluates it against the register on each published register head, so an edge tracks the counterparty’s current class and falls with it. A participant’s own narrowing runs forward only and is not retroactive to corridors already committed. A counterparty’s fall in class takes effect at the next evaluation, because an edge above its source’s present strength is one no counterparty instrument would support.

The register is evidence

The register is an append-only transparency log holding signed declarations. It holds no state any node needs in order to validate anything.

A node completes every verification the protocol requires with no access to the register. The register is never a precondition of a corridor transition. Any participant may mirror it in full, and the log is published in a form permitting independent mirroring and independent verification of its head. If the register is unavailable, corridors continue. If the register is wrong, each participant’s own existing recognition edges stand, because those edges live in that participant’s own registry and were signed by that participant.

Two further properties keep the log from becoming an authority through the back door, and they matter because the instruction’s trigger reads register facts even though the instruction’s signature is the participant’s own. Every entry is self-authenticating: a deposit carries the competent authority’s own signature, and a listing carries the operator’s signed result together with the identity of the suite that produced it, so a participant’s node verifies the entry itself. The log can omit an entry; it cannot manufacture one. And every listing is independently re-runnable against the live endpoint it describes, under credentials the operator publishes for a monitor role, so a node that has stopped conforming is discoverable on published evidence without the log’s cooperation. The limit is that the tested party hosts the test: an operator able to distinguish suite traffic from production traffic can conform to the first alone. Self-administered conformance is evidence of conformance rather than proof of it, and a listing is defeasible on evidence of divergent behaviour.

What remains is availability. A log that omits or delays an entry costs the affected jurisdiction edges until the omission is shown, and the affected authority holds its own signed deposit as the proof. Each participant republishes the edge set its instruction produced against the head it verified, so the age of any participant’s view is itself a published fact.

The register’s function is to make one thing publicly checkable: who has declared what, and when.

This is the architectural choice certificate transparency made, and for the same reason, with one difference stated so it is not mistaken. Certificate transparency puts the log outside the trust boundary — the log is untrusted, its append-only property is proved by consistency proofs rather than asserted, and a log that shows two histories is caught by comparing tree heads — but it does make appearance in a log a condition of a certificate being honoured. This register goes one step further: appearance in it is a condition of nothing. What both share is the property the network needs, which is that nobody can maintain two histories without the divergence being detectable — and that property does the work only when someone is watching. Monitors, an independently re-runnable suite, and a published challenge route are part of the design, not optional additions to it.

Accession, in eight steps

The sequence from a jurisdiction wants in to in force has eight steps, and no step turns on a discretionary act by the standards body, by the council that maintains the register, or by any existing participant. No participant can stop an accession. The one gate that is not the acceding jurisdiction’s own is the conformance suite: a current listing is a precondition of deposit, and the suite is the standards body’s to write and to revise on published notice. That is the whole of the standards body’s leverage over who joins, it is a published and self-administered test, and it is stated here rather than left to be discovered.

Designation. The jurisdiction designates its competent authority by reference to that body’s official function — the registrar of companies, the financial services authority, the ministry responsible for the commercial register — never by the name of an individual. The designation carries the authority’s public key material and the provenance chain binding that key to the function. No body applies any test to a competent authority: neither the standards body nor the council may assess it, and no assessment by either is a condition of any participant’s recognition. A participant that takes a view of another jurisdiction’s competent authority expresses it the one way the protocol provides, by declining, and its declination carries the same bilateral effect and the same publication as any other.

Commissioning. A node is built and stood up. It may be built and operated by the jurisdiction, a state agency, an accredited operator, a systems integrator, or anyone else the jurisdiction chooses; it may be an independent implementation, with no requirement to license the reference implementation. The protocol imposes no requirement on who builds or runs a node. It tests what the node does.

Certification. The operator runs the published suite and publishes the result, and the published result is the listing: the node’s conformance class, the specification version it was tested against, the date, and the evidence. Self-certification with published evidence, rather than assessment by the standards body, is what keeps the conformance path free of a bilateral contract with a private gatekeeper. A listing stays current while the node meets the version-currency requirement and each re-certification trigger, and it lapses on a date computed from published dates alone, with no act by the council and no discretion in the computation. A lapsed jurisdiction remains a participant: it loses edges under other participants’ instructions, and regains them by re-certifying, with no fresh deposit and no fresh declination window.

Deposit. The competent authority deposits the instrument of accession with the depositary, a body of a class participants already accept for that purpose and distinct from the council that maintains the register. It is a deposit, not an application: no discretion attaches to receiving it.

Notification. The council publishes notification of the deposit to every participant within thirty days of receiving it.

The declination window. For six months from the depositary’s dated receipt of the instrument, any existing participant may decline the accession as between itself and the acceding jurisdiction. The clock runs from the deposit rather than from the council’s publication, so no administrative delay can shorten a participant’s window or postpone entry into force. Publication is how participants learn of the deposit, and a participant that receives notice late keeps the balance of its window from the date it had actual notice, which is what the third hypothesis requires. The historical record supports it. Two Hague conventions took opposite defaults. Under the Apostille Convention, where silence consents, eighty-eight states acceded; twenty-one accessions drew an objection, and each objection suppressed one pair and nothing else. Under the Evidence Convention, where a relation forms only on an affirmative acceptance, fifty states acceded, and because its Article 39 makes acceptance a condition of every relation, all fifty sit behind an acceptance procedure. The two instruments differ in more than their default rule — the Evidence Convention also limits who may accede at all — so this is strong evidence rather than a controlled experiment.

Entry into force. On a fixed day after the window closes, pair by pair.

Publication. The register records the accession in force, together with the pairwise map that results from every participant’s published instruction.

Steps one and two belong to the jurisdiction. Step three is machine-decided. Step four is a deposit. Step six belongs to each participant, and it is the one place in the sequence where discretion lives. Steps five, seven and eight are administration performed on published dates, and the administrator holds no discretion in any of them.

Declination

The declination mechanic is where a protocol of this kind is either honest or not, so it is specified tightly.

Only a participant may decline, acting through its designated competent authority, under signature. The standards body may not. The council may not. An accredited operator may not. A node operator that is not a competent authority may not. The power to exclude a counterparty belongs to sovereigns and to nobody else — which is the answer to the first question any ministry asks, why would we accept a private accreditor’s list? The list is not the accreditor’s, and every jurisdiction chooses for itself.

The effect is bilateral. A declination means the protocol does not enter into force between the declining participant and the named jurisdiction. It does not delay the accession, condition it, reduce the acceding jurisdiction’s conformance class, remove or downgrade its listing, affect its relations with any other participant, or alter the grade of any other edge the declining participant holds.

Operationally it adds one name to the declining participant’s exclusion set, and the participant’s own node then emits no edge to the named jurisdiction. That alone does not deliver what a declination promises. Recognition composes along paths and the grade of a path is its weakest hop, so deleting one edge is satisfied by any two-hop route: the declining participant would receive through a neighbour exactly the determinations it declined to receive directly.

Closing it requires the determination to carry more than a grade, and the honest account of what that buys is shorter than it first appears.

A composed determination carries a recognition set: the unordered set of authorities whose grades composed to produce it, each adding itself under its own signature. A declining participant refuses any determination whose recognition set contains the excluded jurisdiction. The set is unordered because nothing reads the order — the refusal is a membership test — and because an ordered sequence would break the composition the rest of the design depends on: recognition composes by meet, which is commutative and idempotent, and an ordered component is neither. It is the same accumulation the verdict provenance already performs, not a new object.

Three limits belong with the mechanism, and the third is the one that matters.

The set is about recognition, not about the entity. It names the authorities whose determinations composed, and says nothing about where the entity has been. An entity that once incorporated, filed or screened in the excluded jurisdiction is unaffected, which matters because the compliance passport carries an entity’s full evaluation history by design.

Each signature attests to the set as its signer presented it, and that is all it attests to. A participant that drops a predecessor and signs the shortened set produces an object every signature verifies, because no signature binds to its predecessor’s and nothing in the object commits to how many authorities there should have been. Completeness of a self-carried set cannot be established from the set alone; it needs an anchor outside it, and the register is expressly not one. What a receiving node can do locally is check that every pair of authorities it can order from the published map holds an edge — which refutes a shortcut across a non-edge, and refutes nothing in a dense network. Attestation is what the set delivers. Proof of completeness is not.

And the set reaches carried recognition only. Where an intermediary consumes a foreign determination as evidence and issues its own fresh evaluation, the output is that intermediary’s determination, and its recognition set names the intermediary. The excluded jurisdiction’s conclusion arrives; its name does not. This is not an attack on the protocol but a route the protocol specifies: a jurisdiction that re-evaluates rather than recognises is doing the thing sovereignty entitles it to do, and the resulting determination is genuinely its own.

A participant that wants exclusion to reach transit therefore needs a different instrument, and one is available without leaving the boundaries. Every participant’s standing instruction is published, and the register publishes the pairwise map those instructions produce. A declining participant can therefore compute which participants hold an edge to the jurisdiction it excludes, and narrow its own instruction against that neighbourhood. That is exclusion by closure rather than by inspection: local, computed from published data, needing no wire object at all, and delivering what inspecting a set cannot. Its price is bluntness — it declines participants whose only fault is a relationship — and that is the trade a sovereign is entitled to make for itself rather than have made for it.

The price of the set is smaller and should be stated too. A declining participant loses composed traffic that merely passed through the excluded jurisdiction, not only traffic that originated there. The set is visible to every downstream recipient, so a determination now discloses which authorities composed it, which is a disclosure a participant should weigh before accession. And a determination that carries a set is distinguishable from one that did not travel, so route coherence — the property that a staged route and a direct route deliver the same arrival state — holds in the grade component rather than on the object as a whole.

Every step is performed by the declining participant’s own node, against a set the incoming object carries and whose signatures that node verifies itself, so no network act is involved.

No grounds are required, and publication is. A declination is a unilateral sovereign act and needs no justification, exactly as a state party to the Apostille Convention objects to an accession without stating a reason. It is published and attributed: the register records who declined, whom, and when. A participant may state grounds and the register will publish them; it may state none.

The asymmetry is deliberate. Requiring grounds would create an adjudicator, and an adjudicator is precisely what this protocol does without. Publication is evidence of these acts and never the act itself. A sovereign instrument takes effect on the sovereign’s signature, and a register that could delay effect by delaying publication would hold a veto over the acts it exists to record. Requiring publication and attribution means a declination is a named act with a diplomatic cost. A participant that prefers not to lodge one narrows its instruction instead — raising its ceiling grade, its minimum class, or its version floor until the target falls out — and the narrowed instruction is published in the same machine-readable form, so the counterparties it drops are computable by anyone from the register. Exclusion is visible either way. What differs is reach: a lodged declination is a named act that also refuses composed determinations naming the excluded jurisdiction, while a narrowed instruction only stops the participant’s own edge. A participant that wants the wider effect has to lodge, and pay the diplomatic cost of doing so.

A declination may be withdrawn at any time by signed notice to the counterparty, effective on that notice, and the acceding jurisdiction holds the same right in the other direction, exercisable at deposit. After entry into force the same instrument works as suspension: signed notice, effective on that notice, stating whether open corridors settle or freeze, and settling by default, because freezing other people’s transactions is a larger act than withdrawing one’s own recognition.

Grades, and the one domain that travels only under an instrument

Recognition is graded per compliance domain. What the protocol adds is a constraint that no ordinary instrument may vary.

Sanctions is never recognized by ordinary corridor grade. The grade is none in every recognition edge, every ordinary corridor instrument and every standing instruction, and a node that emits a recognition object carrying the sanctions domain on an ordinary corridor is non-conformant.

The reason is exact, and it is not conservatism. Recognition transports assessments of an entity: whether its controls meet a standard, whether its data handling meets one. A sanctions clearance asserts something else — that the entity appears on none of this jurisdiction’s lists. That is a membership test against one jurisdiction’s own designations, and it answers another jurisdiction’s question only where every designation the second applies is one the first applies too.

That containment is directed, and it holds exactly when the destination applies no list the source does not. Where one participant applies a shared list alone and the other applies that list with national additions, the second’s clearance settles the first’s question and the first’s does not settle the second’s. Shared authority is the symmetric case, which reaches containment in both directions at once. One instrument records either: a certificate naming the authority or lists relied on, the direction or directions it covers, the parties bound, the corridor epochs to which it applies, the validity window and the revocation procedure. On a corridor covered by such a certificate, and on no other, the sanctions domain inherits. Every general-purpose corridor screens sanctions locally, whatever else it recognizes — because outside a shared-authority certificate, a corridor that inherited clearance would clear precisely the entities the destination has designated and the source has not, which is the one failure mode a compliance network cannot survive.

A second constraint of the same kind: every wire object carries an explicit declaration of the legal tradition it was produced under. There is no default and no implicit fill, and a node whose deployment manifest omits the declaration refuses to start. Silent defaulting of a legal tradition is how a system produces an answer under rules nobody chose.

What the standards body holds

A protocol that a private body writes must say plainly what that body keeps, in the open text, before anyone deposits. There are five things.

The pen. The body authors, versions and releases the specification and the conformance suite, on a published cadence with published notice periods. The suite is the larger lever and is bounded accordingly: a revision may not cause a current listing to lapse inside the currency window of the version it was tested against, so a participant always has that window to re-certify or to decline the revision and keep its existing standing until the window closes. It certifies conformance. It holds no power over recognition.

The conformance mark. Conformance is expressed as a licensed mark, granted on published and uniform terms to the operator of a node holding a current listing. The licence is the only instrument between the standards body and a node operator: no audit agreement, no assessment contract, no delivery agreement sits in the conformance path. The mark is also the enforcement instrument, and it works without any court in the acceding state, because what is withdrawn on lapse is a listing rather than a right. Loss of the listing is loss of every counterparty’s standing recognition, which is commercially decisive and does not depend on a court in the acceding state enforcing anything.

Two constraints on the mark deserve statement because they are where instruments of this kind fail. It is not a statutory certification mark and cannot be one: under 15 U.S.C. § 1064(5)(B) a United States certification-mark registration is cancellable at any time where the proprietor “engages in the production or marketing of any goods or services to which the certification mark is applied”. The workable instrument is an ordinary trademark licence coupled to a published suite and a public evidence repository, with the non-discrimination duty of § 1064(5)(D) adopted voluntarily by contract. A second constraint is the termination right. Any licence of this kind also ends on an uncured material breach after notice, and that is a right the standards body reads and exercises on its own — over an instrument whose loss costs the operator every counterparty’s recognition. The instrument therefore has to define material breach exhaustively and name the forum and the governing law for a dispute about it — and since the council’s competence reaches only whether a stated formal defect existed, that forum is an arbitral one named in the licence rather than anything this protocol supplies. Without those three, the mark is a discretionary switch on the network’s membership held by the one body the design says holds no such power, and every assurance in this section fails with it.

And the antitrust exposure of any admission process is minimised by the same design that makes it scale: an admission process that never refuses on the merits, because the test is published and self-administered and the only refusals available are for stated formal defects that may be cured and redeposited immediately, is an admission process with very little to litigate.

One seat on the council. The register is maintained by a council legally separate from the standards body and constituted by the protocol itself. Every participant holds a seat and a vote on it. The standards body holds one seat and one vote, no veto, no chair, and no depositary function, and the council’s powers are exhaustively ministerial: it receives, notifies, publishes, and hears one narrow appeal on whether a stated formal defect existed. It has no power to admit, exclude, grade or assess.

The reference implementation, published on open terms, which nobody is required to use.

A fee for what it actually supplies — publication, listing, suite maintenance — on uniform published terms, held until the supervisory body described below is constituted and passing to that body when it is.

The boundary matters more than the holding. The standards body cannot admit or exclude a jurisdiction, object to an accession, grade another sovereign’s determinations, appoint anyone’s competent authority, or amend the four boundaries, which sit outside the amendment procedure entirely. Fee-setting and data-openness obligations sit with a disinterested supervisory body, which Accession Networks shows is necessary rather than merely prudent, and which is also the design’s principal legal asset. The standard-setting antitrust cases — Radiant Burners, American Society of Mechanical Engineers v. Hydrolevel, Allied Tube — attach exposure to discretion exercised in a process where competitors hold influence. A decision-maker with no economic interest in exclusion removes the facts that theory needs, and it is what an operator trading in the certified market can never supply by drafting.

The precedents this design copies

Nothing here is invented where something ratified already works. Treaty membership figures below are as at 1 September 2026 and move.

One caution about reading the precedents as a rate rather than a shape. The Apostille’s 130 parties accumulated over sixty years, and the closest modern analogue for a machine-readable standard is the UNCITRAL Model Law on Electronic Transferable Records, at thirteen adopting jurisdictions in nine years. The shape precedent is the Apostille; the rate precedent is the Model Law, and it is the slower of the two by a wide margin.

The unilateral-accession-with-declination shape is the Hague Apostille Convention’s, whose record is the proof it works: eighty-eight accessions, twenty-one of which drew an objection, and not one of which was blocked. The counts are the depositary’s status table read on one rule: rows recording accession, with the objected subset counted separately, as at the table’s last update of 30 June 2026. Every objection removed one pair under Article 12 and left every other relation, and the accession itself, untouched. The two-sidedness and the withdrawal right are drawn from the 2019 Hague Judgments Convention’s establishment-of-relations mechanic rather than the Apostille’s older drafting. Article 29 makes the relation form unless one side notifies against it, gives the notification to either side — to an incumbent within twelve months, to the acceding state at deposit — and lets the notifying state withdraw at any time. This protocol takes the two-sidedness and the withdrawal, and keeps six months rather than Article 29’s twelve, because a node reconfigures faster than a foreign ministry.

The three-role separation — a commercial registrar operating the register, an intergovernmental body supervising it, and a distinct depositary — is the Cape Town system’s. Since its International Registry opened on 1 March 2006, an Irish company held jointly by a private firm and a national government has been the registrar, appointed and dismissible by an intergovernmental supervisory authority that owns the data, sets the fees and approves the regulations, with a third body as depositary. Eighty-seven states are party to the Aircraft Protocol under which that register runs, sixty-nine of them by accession. Cape Town also supplies, in ratified text, the portability clause (Article 17(2)(c)), the asset separation under which the operator never owns the data (Article 17(4)), the liability allocation under which the operator answers for its own errors, omissions and system malfunctions short of an inevitable and irresistible event, but never for the truth of what participants file (Article 28), compulsory insurance sized by the supervisory body (Article 28(4)), and inviolability of the register archive (Article 27(4)) — the last of which is a treaty immunity, available only to a register a treaty constitutes.

The governance half is the Global Legal Entity Identifier Foundation’s: a foundation whose oversight body is constituted by a charter that creates no legal rights or obligations of its own, because every power it exercises sits inside the foundation’s statutes — inspection, hearings, reports, and a duty on the board to publish its reasons whenever it declines a recommendation — policed by a public supervisor, with a non-profit purpose and an asset lock.

The modification-by-intersecting-declarations mechanic — one deposited text modifying a large number of existing bilateral instruments according to the declarations each party filed — is the BEPS Multilateral Instrument’s, which by mid-2026 had modified more than sixteen hundred bilateral tax treaties from a single text, across one hundred and seven jurisdictions, in under a decade.

None of these was designed for compliance kernels. All of them answer the question a ministry asks first, which is whether anything like this has been done before by anyone it recognises.

Open questions

Three things this protocol leaves for others to decide, stated here rather than left to be discovered.

Whether an authority will accept recognition that reached it through an intermediary. The composition results assume a determination that travelled A \to B \to C is capable of being given effect at C. Whether that holds is a question of each jurisdiction’s law, and it is worth the entire value of composition. It is not a mathematical question and this design does not answer it. What it does is make the private obligations riding on composed state enforceable regardless, which is the companion paper Recourse.

Whether technical conformance is a proxy for legal assurance. A node that passes the suite behaves as specified at an endpoint. That says nothing about the quality of the jurisdiction’s supervision, the competence of its authority, or the truth of what it files. The protocol is explicit that it certifies software behaviour — and a participant that treats a conformance listing as a proxy for institutional quality has made an inference the protocol does not license, which at scale some participants will.

Where liability lands when a jurisdiction relies and the reliance was misplaced. In the United States the standard-setting cases put the duty where the control is. Applying section 324A of the Restatement (Second) of Torts, a New Jersey trial court held that a body with no power to compel compliance owed nothing (Meyers v. Donnatacci, 220 N.J. Super. 73 (Law Div. 1987)), and the state’s supreme court held that a body which accredited and inspected its members, and whose inspection reports a regulator accepted in lieu of its own, owed a duty (Snyder v. American Association of Blood Banks, 144 N.J. 269 (1996)). Those are physical-injury cases decided under a rule that reaches physical harm only, and the loss a misplaced recognition causes is economic. No court has yet carried the line across that gap, and the route that would reach economic loss is negligent misstatement rather than the section the cases turn on. The exposure is open rather than settled, and a network whose entire product is that an authority relies on a finding instead of performing its own evaluation is the case that will test it. The design therefore carries the exposure rather than drafting around it: the certifier sits in a separate entity, reliance limits are published on the artefact itself, and the exposure is insured at a level a supervisory body sets.

The result

The protocol is small. A jurisdiction designates an authority, stands up a node, runs a suite, deposits an instrument, and publishes a standing instruction stating whom it will recognize and how far. Everything after that is arithmetic performed locally by each participant on its own state, under its own signature.

What it buys is the property the companion theorem identifies, and buys it only because the instrument above satisfies that theorem’s hypotheses: the relation that unconstrained bilateral negotiation would eventually have produced, reached at one instrument per participant instead of one per pair, without any participant ceding a decision it would not cede, and without any central body acquiring a power it should not hold.

References

Allied Tube & Conduit Corp. v. Indian Head, Inc., 486 U.S. 492 (1988).

American Society of Mechanical Engineers v. Hydrolevel Corp., 456 U.S. 556 (1982).

Convention Abolishing the Requirement of Legalisation for Foreign Public Documents. The Hague, 5 October 1961, Articles 6, 12 and 15.

Convention on International Interests in Mobile Equipment. Cape Town, 16 November 2001, Articles 17, 27 and 28, and the Protocol thereto on Matters Specific to Aircraft Equipment, Cape Town, 16 November 2001.

Convention on the Recognition and Enforcement of Foreign Judgments in Civil or Commercial Matters. The Hague, 2 July 2019, Articles 24, 29 and 32.

Convention on the Taking of Evidence Abroad in Civil or Commercial Matters. The Hague, 18 March 1970, Article 39.

Global Legal Entity Identifier Foundation. Statutes of 7 August 2018, Articles 2, 3, 4, 30, 31 and 39; and Regulatory Oversight Committee Charter, § 20.

Hague Conference on Private International Law. Status tables for the Conventions of 5 October 1961 and 18 March 1970. Retrieved 1 September 2026.

Laurie, B., Langley, A., and Kasper, E. Certificate Transparency. RFC 6962, Internet Engineering Task Force, 2013. Obsoleted by Laurie, B., Messeri, E., and Stradling, R. Certificate Transparency Version 2.0. RFC 9162, 2021.

Multilateral Convention to Implement Tax Treaty Related Measures to Prevent Base Erosion and Profit Shifting. Paris, 24 November 2016. Signatories and parties, status as at 18 June 2026.

Radiant Burners, Inc. v. Peoples Gas Light & Coke Co., 364 U.S. 656 (1961).

Restatement (Second) of Torts § 324A. American Law Institute, 1965.

UNIDROIT. Status — Protocol on Matters Specific to Aircraft Equipment. Retrieved 1 September 2026.

Lanham Act, 15 U.S.C. § 1064(5).