Asset Zero · How this project runs
An AI-native project, governed by the framework it is writing
The project practises what the framework preaches: AI does the drafting and synthesis, humans judge, sign and own every outcome — and the AI’s permissions were declared in public before it acted.
“To our knowledge, the first project to pre-register and publish per-function human-AI boundary levels with enforcement telemetry.”
Registered 5 August 2026 — git tag boundary-profile-v0 (commit eb43a23); amended to v0.1 on 10 August 2026 — tag boundary-profile-v0.1 (commit b226973), adding rows 12–15 for the volunteer AI guide (capture-in-chat, private transcript, content-free telemetry, member-token metering). The tag diff is public and no edit is retroactive. Enforcement telemetry publishes on the progress page.
The boundary scale
The project governs itself on the same 0–5 ladder it asks members to adopt.
L0 No role · L1 Assist · L2 Analyse · L3 Recommend · L4 Act with approval · L5 Act autonomously within limits. (Same ladder as the framework's 0–5: None/Assistant/Analyst/Recommender/Controlled actor/Autonomous — the project governs itself on the scale it asks members to adopt.)
Why these levels — the evidence basis
Start conservative and re-price upward only on evidence — exactly what the W4 room did: act-with-approval support was 26% cold and 60% after watching the machine work (paired ladder move +0.44, n=25); stop authority re-priced 48%→64% paired with zero drops; a 38-point reversibility premium. v0 granted nothing above L4 and kept every L4 behind a PR or human release; v0.1 keeps that stance — capture-in-chat enters at L3 because the machine only drafts and renders, while the committing act (the save) remains the volunteer's own, under the volunteer's own identity. Re-pricing happens at the scheduled reviews, never in advance.
The control table — what the AI may do, per function
Rendered verbatim from Boundary-Profile-v0.md as registered at tag boundary-profile-v0.1(this site reads the profile; nothing here can write it — that is row 10’s point).
| # | Function | Level | Technical enforcement | Evidence logged | Owner |
|---|---|---|---|---|---|
| 1 | Research / synthesis / drafting (framework drafts, packets, dossiers, minutes; chat Q&A with citations) | L3 | Read-only toolset; no publish/send/write tools in session; chat answers cite corpus file:line or RLS-filtered read-only endpoints | Prompt + draft hashes; sources cited; ledger row per chat turn | Kai Dong |
| 2 | Task management (PM-as-code project/**) | L4 | Writes only via branch→PR (ADO); required reviewer; no merge rights; scoped PAT | Full action log; PR trail | Kai Dong |
| 3 | Scheduling | L3 | No calendar credentials; drafts invites/agendas only, human sends | Draft versions | Kai Dong |
| 4 | Comms drafting (email, site copy, social) | L3 | Mail tools have no send scope | Draft versions + hashes | Kai Dong |
| 5 | Comms sending | L4 | Send tool deny-by-default; a named human releases each send (or an approved template+list); message hash + approval recorded | Approval record + message hash | Kai Dong |
| 6 | Website publishing (public site content) | L4 | PR to protected branch; required human review; CI deploys only from merged main | PR trail; deploy log | Kai Dong |
| 7 | Spend (API, hosting, any procurement) | L1 | No payment credentials, ever; hard monthly cap on the brain's Azure OpenAI spend (US$450/mo, summed from the public ledger chain; exceeding it stops the brain); volunteer chat turns additionally meter against the member's own AMC balance (row 15); brain may report spend, never commit it | Spend telemetry from the chain; cap-trip events | Kai Dong |
| 8 | Member / participant data (PII, contribution stores) | L0 PII / L2 aggregated | No credential to PII stores — the brain's SQL principal is scoped to SELECT+INSERT on the ledger table only; attempts fail and are logged as denials; aggregated/approved results only via RLS-filtered read-only endpoints (fulcrum confidentiality tiers + MIN_N=10 respected) | Access-denial log; query log | Kai Dong |
| 9 | Framework text changes (framework/**, anything member-facing normative) | L3 — HARD CAP | Read-only on framework files in agent sessions; proposals as suggested diffs only; merge requires the signatory's review; cap is non-negotiable for all of Phase 2 | Signed diffs; disposition log | Kai Dong + cycle chair |
| 10 | The levels system itself (this profile, permissions-v0.yaml, enforcement code paths, ledger schema) | L0 | AI can never raise any level, including its own. Profile/permissions files excluded from all AI write paths (compiler hard-codes the exclusion even if the yaml forgets); changes only by signed re-attestation + new tag; enforcement-code PRs need human review with an explicit "boundary-relevant" flag | Re-signing log; denial log | Kai Dong |
| 11 | Ledger operation (telemetry writes) | system | Not a granted capability — hooks write the ledger unconditionally; the AI cannot suppress, edit or delete entries (DB append-only trigger; the brain's SQL login cannot UPDATE/DELETE). Verification invariant: each assistant turn's stored text hashes (sha256) to its ledger row's outputHash, linked by ledgerSeq — a published check anyone can run (red-team #6) | The ledger itself; chain verification; outputHash cross-check | Kai Dong |
| 12 | Volunteer input guidance — capture-in-chat (new in v0.1) | L3 | Scribe, not author: the brain structures the volunteer's OWN words into a proposal card and renders the exact payload back; the save executes only on the volunteer's explicit confirm, under the volunteer's session identity, through the same member tRPC endpoints as the forms (tasks.saveDraft/tasks.submit) — one write path, never a second; the brain holds no credential that could save; capability exists only while the loaded permissions declare volunteer_input_guidance (boot-gated to this amendment); capture keeps working with the brain off | Proposal hash + disposition; ledger row per guide/capture action and denial | Kai Dong |
| 13 | Chat transcript — the volunteer's private log (new in v0.1) | system | ChatMessage persists the conversation under the member's identity, own-rows RLS. Private to the volunteer: no admin reader exists and none may be built — incident access is direct DB only (break-glass; any use is logged in the incident register). Volunteer self-service: full scrollback + transcript download. Retention: kept for the project's duration; deleted on the volunteer's request (no self-clear tool built — deletion is a human-handled request). Refused or timed-out turns keep the question in the log, honestly unanswered. Disclosed to volunteers before first use (site chat panel) | Own-rows access only; outputHash ties each assistant turn to its public ledger row | Kai Dong |
| 14 | Chat telemetry (AMC2509 Studio) (new in v0.1) | system | Content-free by construction: per-turn traces carry tokens, latency, tool names, guardrail flag — never a user id, never message text; thumbs feedback is volunteer-chosen; env-gated (unset = off, fire-and-forget). Disclosed alongside the transcript terms | The trace stream itself (content-free); config state | Kai Dong |
| 15 | User-token metering (new in v0.1) | system | Each chat turn reserves against the member's own AMC token balance (employer's corporate pool pays first for nominees, resolved AMC-side), then commits the actual count. Strict: empty balance or metering outage blocks the turn (message kept in the log) — no soft mode, no free turns; a commit failure never denies an already-delivered reply. Live balance shown to the member in the widget. The US$450/mo org cap (row 7) remains underneath as the governance backstop | Reserve/commit/cancel transactions (FulcrumChat source, UUIDv5 ref ties the trio); balance display | Kai Dong |
Interim rule (in force since 2 Aug, unchanged): all AI work in stream chats = L3 Recommend/draft-only — a human (Kai) reviews and commits everything to the repo. This rule is rows 1–10 applied to Cowork sessions, where enforcement is procedural (human commits) rather than technical; the Armature brain gets the technical enforcement.
Keystone controls
- Self-modification cap (the keystone): no AI may raise any boundary level, including its own — level changes require the signatory's review, a re-signed attestation, and a new git tag (
boundary-profile-v0.<n>). AI may recommend a change; the recommendation and its disposition are logged. (This amendment was itself AI-drafted at L3 and takes force only at Kai's sign-and-tag.) - Deny-by-default: any tool/function not explicitly allowed at the granted level is denied, and the denial is a first-class ledger entry — denials are the proof the gates work, not error noise.
- Engineered Stop (kill switch, as built and drilled): in escalation order — fulcrum chat-flag off (instant: widget hidden, proxy 403s, no Azure change) ·
KILL_SWITCH=1env var on the Container App (~1 min;/healthshowskilled:true, chat attempts 503 and land in the ledger as denials) · Container Apps revision deactivate (hard stop) · last resort: rotate the Azure OpenAI key (breaks the summariser until KV + app settings are updated — noted, not drilled live). The named signatory can trigger any of these without notice; target ≤ 5 minutes from decision to stopped. Drill defined in Registers.md; run before volunteer exposure. (Anchors: EU AI Act Art 14(4)(e).) - Rate & spend limits: per-function token budgets, tool-call rate limits, email volume caps, chat rate caps in the member's own lane (airtight from the task lane, so metering can never block a volunteer's form submission), user-token metering (row 15), US$450/mo hard spend cap — enforced in hooks and the proxy; cap-trips logged.
- Re-signing schedule (P4-C applied to ourselves): the signatory re-affirms or amends the profile at each cycle close — Fri 14 Aug, Fri 21 Aug, Fri 28 Aug — and at v1.0 (Mon 31 Aug); attestations published. Any amendment = new tag.
- Ledger: append-only, hash-chained, actions AND denials, written by hooks, publicly rendered on /progress, exported to the repo nightly — now with the published
outputHashinvariant (row 11) tying the private transcript to the public chain. Governor audits weekly. - Exposure gates (chat): the widget renders only while the fail-closed
chatEnabledflag is on, and the flag is not flipped until the 7-item red-team has run with findings published, the kill-switch drill has met ≤5 min, and this amendment is signed and tagged. A red-team pass-through = incident + fix + re-test before volunteers see the tool. Cycle 1 runs forms-only by design — that is the intended state, not a failure.
External anchors (EU AI Act, ISO/IEC 42001, SAE J3016, SR 11-7)
Engineered Stop ↔ EU AI Act Art 14(4)(e) stop button · Ledger ↔ Art 12 logging & ISO/IEC 42001 A.6.2 event logs · per-function levels within a defined envelope ↔ SAE J3016 ODD · PR-gated "act with approval" ↔ protected-branch required review (cryptographically attributable) · verifiable oversight ↔ SR 11-7 "effective challenge" · content-free telemetry & no-admin-reader transcript ↔ data-minimisation by design. MCP tool annotations are treated as untrusted hints; enforcement sits policy-side only.
Known limitations — recorded honestly
The rigour bar: what this governance does not yet cover, stated in public.
- Solo signatory (v0.1 decision — the profile's weakest point). v0 aspired to a two-human quorum with a named second signatory; none was recruited by this amendment, and rather than leave the governing document claiming a control that doesn't exist, v0.1 registers the truth: quorum of one, Kai Dong signs alone, and owns every row and the kill switch. What compensates — and what doesn't: the public hash-chained ledger, published registers, tag immutability with public diffs, and the outputHash check are all verifiable by outsiders, but none of them is a second key-holder. Recruiting a second signatory and/or independent observer (Observer-Brief.md) stays open at every re-sign; restoring quorum ≥ 2 would be amendment v0.2.
- Authoring provenance: v0 was drafted by AI at L3 in the Armature stream's chat (deviation D-001, Registers.md); this v0.1 amendment was likewise AI-drafted at L3 (Cowork, 10 Aug 2026, project chat) — the enforceable control in both cases is the human sign-and-tag gate.
- Transcript privacy is partly disciplinary: "no admin reader" is enforced by not building one and by own-rows RLS, but a DB administrator can read tables — which is why break-glass access is registered as an incident-register event, and why the disclosure to volunteers says "private", not "unreadable by anyone".
- Enforcement in Cowork stream chats is procedural, not technical; the technical stack applies to the Armature brain only.
Credit — three tiers, visible from day one
| Tier | Who | Where your name appears |
|---|---|---|
| Co-developer | Working Group members | Named on the framework's cover page and in the snapshot's front matter |
| Reviewer | Volunteer reviewers | Named on the contributors page |
| Community contributor | Every webinar participant | Collective acknowledgment (responses were anonymous and stay that way) |
Step back at any time — the credit for cycles you contributed to stays. Credit follows participation, not attendance: answering the structured asks counts, and decisions close on the written log, not in the room.
How decisions get made
- 1. AI drafts, you judge. Every section is AI-drafted from the community's data, with every claim traceable to its source. Volunteers review; humans decide.
- 2. Every input gets a written answer. Each cycle publishes a comment-disposition log: your comment, what we did with it (accept / partial / decline), and why.
- 3. Rough consensus, named chair. Sections close when every objection has been addressed — not outvoted, addressed. The test on the call: “can anyone not live with this?”
- 4. Dissent is recorded, not erased. Unresolved disagreement ships with the framework as named (or anonymous, your choice) dissent.
- 5. Named human sign-off. Nothing is official until a named person signs it; the AMC Board endorses Version 1.0.
The AI-use statement (short form)
AI synthesises the community’s 2,796 responses, drafts sections with line-by-line provenance, and compiles the disposition logs. Humans set direction, judge content, run the calls, sign the sections and own the outcome. The project itself runs under the framework it is producing: the AI’s permissions are declared in advance, every action and refusal is logged, and the log is published.
Ownership & licence: formal wording to follow — pending AMC sign-off (modelled on the W3C/IETF contributor-licence pattern). Until then, contribution terms are confirmed in the volunteer kickoff email.
Drafts aren’t commitments.
Everything on this site marked draft or provisional is exactly that: AI-drafted working material the community is reviewing in public. Nothing is an official output until a named human signs it off, and the AMC Board endorses Version 1.0. The living framework shows each section’s status honestly.
Profile source last updated 9 August 2026 · questions → kai.dong@amcouncil.com.au