Trust, Authority and Evidence Architecture

1About this note

This note describes the trust, authority and evidence architecture of Verity Command, the sovereign mission intelligence and authorized action platform of Sovereign Inc. It is a public edition: it explains the architecture and its reasoning and omits implementation detail, configuration values and deployment-specific bounds.

It describes how the architecture behaves by definition. It is not a report of operational use, measured performance or independent assessment. Section 12 lists what the note does not claim; the Public Threat Model (VC-PUB-002) sets out what the architecture protects, detects and cannot guarantee, and the Hormuz Reference Scenario (VC-PUB-003) walks through it with synthetic data.

2Platform and chain

Verity Command governs how intelligence becomes authorized, distributed, executed and evidenced action. Every capability belongs to one stage of a single chain — observe, understand, simulate, recommend, authorize or refuse, distribute, enforce, execute, evidence — and the component that recommends never authorizes, while the component that authorizes never executes.

Deliberate non-goals: autonomous selection or engagement of targets and any weapon-control function; replacement of formally approved force-level command-and-control systems; new cryptographic primitives or proprietary encryption; data brokerage; and mass surveillance. Biometric processing is excluded unless a customer's documented legal authority and a separate product decision exist.

3Trust boundaries

A deployment is one authority domain: one set of roots of trust and one evidence namespace. Instances interact by federation, never through shared internals. Thirteen boundaries are defined inside the domain; each names the controls a crossing must satisfy and the behavior when they cannot be satisfied.

Across every boundary: no component outside a Tunnel Sovereign endpoint holds payload keys; content not releasable to a recipient never crosses a distribution, model, federation or export boundary; the vendor holds no key that can authorize, decrypt or sign inside a sovereign customer domain; every crossing produces a decision record; and untrusted content never becomes instruction.

4Principals and authority

A principal is any actor that can be authenticated and authorized. People, services, AI agents, devices, sensors, guests and partner domains are distinct principal types with distinct trust anchors in QECNet Trust Fabric. The customer's identity provider remains authoritative for whether a person exists; deactivation there propagates as revocation, and AI agents delegating from that person lose their permissions with them.

The mission named in an authorization is always the mission of the authorizing grant, never one supplied by the caller; a request naming a different mission is refused. Mission identities use key material that differs per mission, which does not make mission activity unlinkable: connection identity, timing and volume remain observable to infrastructure.

5The Authority Kernel

There is one policy decision point. No service implements its own authorization; each embeds a thin enforcement point that obtains a decision and applies it. Policy is data — signed, versioned and testable — and the policy engine is a dependency of the Kernel rather than the Kernel itself.

Deny precedence. A decision is permit only if every model permits and no explicit deny matches, so evaluation order cannot change the result. An unrecognized label, category or policy identifier is treated as maximally restrictive.

Fail closed. When identity, policy, evidence, time or cryptographic validation cannot be established, the request is refused and the refusal evidenced. The cost is stated: the Kernel is a single point of denial, and an outage of the decision path stops action rather than permitting it.

Refusal with reasons. A refusal names every unmet condition and the policy version evaluated, so the requester knows what would have to change and a reviewer can reproduce the decision later.

A permit produces a signed authority envelope carrying the content digest, mission, principal, scope, direction, validity window and policy version. It is the only object Tunnel Sovereign distributes and the only object Verity Edge accepts, and it cannot be widened or extended by its holder.

6Evidence before effect

Evidence for a material act is admitted before the act's external effect is committed. If the record cannot be admitted, the action does not proceed.

The Evidence Ledger is append-only and tamper-evident. It is not a blockchain: records are hash-chained, periodic checkpoints are signed, and checkpoints can be exported to write-once storage or exchanged with a federation partner so that neither party can rewrite shared history alone. There is no update or delete interface; retention expiry and legal hold are the only removal paths, and both are evidenced. Continuous verification raises a critical incident and freezes writes on any break.

7Time, leases and revocation

Trusted time. Authority is time-bounded, so time sources are a trust boundary. Every record carries its time uncertainty, and unknown uncertainty is recorded as unknown, never as zero. Within bound, leases use the conservative end of the interval; beyond bound, authority decisions fail closed while data collection continues; a detected clock rollback is refused and monotonic counters are relied upon. Specific bounds are deployment configuration.

Leases. A Verity Edge node that loses connectivity continues within a signed lease — capabilities, scope, epoch floors, validity window and policy version — and records its decisions as offline decisions.

Reconnection applies authority state first — revocations, epochs, policy — and then re-authorizes queued work item by item. Work whose grant was withdrawn is not released; offline evidence is appended with its local sequence and uncertainty; data conflicts are preserved as contradictions.

Revocation takes effect at an enforcement point when that point receives the signed revocation state, and in every case no later than the expiry of the grant or lease. Connected points honor it promptly. A disconnected point cannot be reached, so its residual authority is bounded by its lease, and the maximum residual window is shown to the commander at the moment of revocation. Revocation is never described as instantaneous everywhere.

8Provenance in the Reality Graph

The Reality Graph records what kind of statement each belief is. The type is assigned at creation and cannot change.

Fact is not a type: a statement can be treated as established for a purpose when it meets a corroboration policy, and that treatment is itself a revisable assessment. An inference without inputs is refused at the write path; generated language never promotes a type; confidence is never shown without its method; absence of evidence is shown as absence; contradictions are preserved; and five reports derived from one original are one source, which the lineage shows. Synthetic and exercise data are flagged at creation and can never become observations.

9Distribution and enforcement

Authorized instructions have to travel and must be checked again where they take effect. The division is strict: the Authority Kernel authorizes; Tunnel Sovereign delivers; authorized endpoints read; Verity Edge enforces.

The Distribution Endpoint acts only on a verified envelope, holds plaintext transiently, and runs in a restricted profile without access to the graph, Kernel internals or other evidence. Its residual risk is disclosed: a compromise would expose the packages it is distributing at that time. Mitigations are minimal retention, isolation, separate enrollment, quorum for bulk distribution and volume anomaly detection.

Verity Edge validates the envelope signature and digest, mission scope, its lease, trusted time and local revocation state before releasing an instruction to an operational system, and records acceptance before release and the system's result after it.

Federation is an exchange between two authority domains that each keep their own roots: a release decision by the originating domain and an acceptance by the receiving one. Caveats cannot be stripped, withdrawal is honored, and derived records carry labels at least as restrictive as their most restrictive input unless a downgrade decision is recorded. QECNet Trust Fabric enrolls every endpoint and signs every envelope and record; Verity Forge delivers releases, configuration and policy under the same approval and evidence rules.

10Failure behavior

11Security invariants

Security properties are written as invariants that hold in every posture, including during failure, and are release preconditions. A representative selection:

• No request is processed without an authenticated principal verified at the enforcement point.
• Every access and action results from an Authority Kernel decision, with deny precedence.
• An AI agent's effective permissions never exceed the intersection of its grant, its delegator's current authority and the mission; no AI agent performs, approves or triggers a high-consequence action.
• Approvals and authorizations are valid only for the exact content digest they bound.
• Leases and validity windows can be renewed only by the issuing authority.
• External and retrieved content is treated as data, never as instruction.

12What this note does not claim

• No certification, accreditation, authorization to operate or approval for classified information.
• No compliance with, or assessment against, any control catalogue, standard, or national or alliance interoperability requirement.
• No independent assessment, audit, penetration test or cryptographic review.
• No measured performance, scale, availability or AI accuracy figure.
• No customer, deployment, endorsement or past performance.
• No comparative superiority over any other system.

13Related documents and revisions

• VC-PUB-002 · Public Threat Model and Security Boundaries
• VC-PUB-003 · Hormuz Reference Scenario — When the Correct Decision Is Refusal

Document VC-PUB-001 · Version 1.1 · Published 16 September 2026 · PUBLIC EDITION
© 2026 Sovereign Inc. All rights reserved.