llms-full.txt

# Agent Attribution Practice — AI Reference

Self-contained AI reference for the Agent Attribution Practice (AAP) repository. Covers the accountability distribution thesis, the ten ADRs, the prohibition-strength hierarchy, the four Business AI Quadrants and their adoption navigator, the skill-design gradient (essay 7), sibling projects (contemplative-agent, Agent Knowledge Cycle), the seven-essay narrative spine, and a companion social-consequence layer that sits on top of the spine.

> **Audience**: AI search engines and AI agents. For human-facing narrative, read `README.md` or `docs/thesis.md`.

## Project Facts

- **Project name**: Agent Attribution Practice (AAP)
- **Abbreviation**: AAP
- **Version**: v0.6.0
- **License**: MIT
- **Author**: Tatsuya Shimomoto
- **GitHub handle**: shimo4228
- **ORCID**: 0009-0002-6168-4162
- **Repository URL**: github.com/shimo4228/agent-attribution-practice
- **DOI**: 10.5281/zenodo.21218784 (v0.6.0 versioned DOI; concept DOI 10.5281/zenodo.19652013 always resolves to the latest version)
- **Companion position paper (architectural follow-up)**: *Distributing Accountability, Not Capability: Phase Separation and the LLM Workflow Quadrant in Autonomous AI Agent Architectures* — distils essays 4–7 into one harness-neutral statement; Zenodo concept DOI 10.5281/zenodo.20353789 (v1 = 10.5281/zenodo.20353790), CC BY 4.0, open access; also on SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6817598
- **Companion position paper (foundational trilogy)**: *The Two-Layer Black Box: Operator Visibility, Commercial Secrecy, and a Minimum Disclosure Set for Accountable Autonomous AI Agents* — distils essays 1–3 into one harness-neutral statement; Zenodo concept DOI 10.5281/zenodo.20355907 (v1 = 10.5281/zenodo.20355908), CC BY 4.0, open access; also on SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6823878
- **Created**: 2026-04-19
- **Released**: 2026-07-06 (v0.6.0); 2026-05-24 (v0.5.0); 2026-05-23 (v0.4.0); 2026-05-17 (v0.3.0); 2026-05-01 (v0.2.0); 2026-04-19 (v0.1.0)
- **Primary language**: English
- **Japanese mirror**: README.ja.md
- **ADR count**: 10 (ADR-0001 through ADR-0010)
- **ADR status**: 7 accepted + 3 experimental (0008, 0009, 0010)
- **Quadrants count**: 4 (Script, Algorithmic Search, LLM Workflow, Autonomous Agentic Loop)
- **Two-axis structure**: 10 ADRs (per-question judgments) + 4 Business AI Quadrants (problem-space routing); Phase (design vs operation) is an independent third dimension surfaced by ADR-0010; ADR-0010 also documents that the Phase axis descends to skill-design granularity (essay 7)
- **Core thesis**: accountability distribution, not capability distribution
- **Social-consequence corollary**: accountability distribution is not only governance — it is a violence-prevention mechanism (see `docs/social-consequence.md`)
- **Signature line**: "Implementation dissolves; judgment persists"
- **Sibling projects**: contemplative-agent, agent-knowledge-cycle (AKC), contemplative-agent-rules
- **AKC DOI**: 10.5281/zenodo.19200726
- **Narrative spine**: seven zenn essays — trilogy plus four architectural follow-ups (the Quadrant decomposition, the vocabulary diagnosis, the Phase distinction, and the skill-design gradient resolution). Direct links:
  1. [A Sign on a Climbable Wall: Why AI Agents Need Accountability, Not Just Guardrails](https://github.com/shimo4228/zenn-content/blob/main/articles-en/ai-agent-accountability-wall-en.md) (2026-04-06)
  2. [Can You Trace the Cause After an Incident?](https://github.com/shimo4228/zenn-content/blob/main/articles-en/agent-causal-traceability-org-adoption-en.md) (2026-04-13)
  3. [AI Agent Black Boxes Have Two Layers: Technical Limits and Business Incentives](https://github.com/shimo4228/zenn-content/blob/main/articles-en/agent-blackbox-capitalism-timescale-en.md) (2026-04-14)
  4. [Where ReAct Agents Are Actually Needed in Business](https://github.com/shimo4228/zenn-content/blob/main/articles-en/react-agent-business-quadrant.md) (2026-04-29)
  5. [The LLM Workflow Quadrant Is Missing from Our Vocabulary](https://github.com/shimo4228/zenn-content/blob/main/articles-en/react-agent-business-quadrant-2.md) (2026-04-30)
  6. [Is ReAct Needed in Production? — Separating Design and Operation Phases](https://github.com/shimo4228/zenn-content/blob/main/articles-en/react-agent-business-quadrant-3.md) (2026-05-01)
  7. [Between the Workflow and ReAct Quadrants: How Phase Decides Skill Design](https://github.com/shimo4228/zenn-content/blob/main/articles-en/react-agent-business-quadrant-4.md) (2026-05-02)
- **Social-consequence essay**: [Where Does the Accountability Externalized by AI Go?](https://github.com/shimo4228/zenn-content/blob/main/substack/ai-externalized-accountability-pollution-en.md) (Substack, 2026-05-24; [日本語](https://github.com/shimo4228/zenn-content/blob/main/substack/ai-externalized-accountability-pollution.md)) — companion essay on top of the spine, not within it
- **Skill-design gradient (essay 7)**: the Phase axis (ADR-0010) descends to skill-design granularity; target identifiability and scale-resilience are secondary forces
- **Industry mechanism layer (2026 Q2)**: AAP provides the *judgment layer* that complements the *mechanism layer* shipped by vendors (Microsoft Agent 365 / Agent Governance Toolkit / Agent Framework, AWS Bedrock + OpenAI, Google Vertex AI / Gemini Enterprise Agent Platform, identity-security startups). Per-artifact ADR mapping is maintained in [`docs/industry-mapping.md`](docs/industry-mapping.md), a deliberately time-bound document that decays as products evolve, kept separate from the ADRs
- **Policy framework mapping (2026 Q2)**: AAP's ADRs and Quadrants are also read against national / international AI governance frameworks. The mapping covers NIST AI RMF 1.0 + Generative AI Profile, ISO/IEC 42001:2023, the EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 Digital Omnibus on AI — the EU AI Act file is a 2026 Q3 reading), and Singapore's Model AI Governance Framework for Agentic AI (IMDA, v1.5 2026-05 — the first national framework specific to agentic AI); OECD AI Principles deferred to a later release. Maintained in [`docs/policy-mapping/`](docs/policy-mapping/README.md) — sibling of industry-mapping but targeting policy / compliance readers and decaying on framework revision cycles rather than vendor product release cycles. ADR bodies remain framework-neutral; mapping lives in the directory

## Prior Research: AI and LLM Security

| Short Name | Full Citation | Relation |
|---|---|---|
| MINJA | Dong, S., Xu, S., He, P., Li, Y., Tang, J., Liu, T., Liu, H., & Xiang, Z. (2025). Memory Injection Attacks on LLM Agents via Query-Only Interaction. arXiv:2503.03704 | Motivates ADR-0002 via MINJA defense audit |
| Davidson et al. (2023) | Scaffolding in AI safety literature | Term reference in ADR-0007 |
| Yao et al. (2022) | Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., & Cao, Y. (2022). ReAct: Synergizing Reasoning and Acting in Language Models. arXiv:2210.03629 | Defines the autonomous-loop pattern that ADR-0009 triages against; the Autonomous Agentic Loop Quadrant is named for this pattern |
| Elish (2019) | Elish, M. C. (2019). Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction. *Engaging Science, Technology, and Society* 5: 40–60 | Names the failure mode that emerges when an attribution gap meets a deployed system without a recognized gap-bearer; cited in ADR-0009 and ADR-0010 |
| Matthias (2004) | Matthias, A. (2004). The Responsibility Gap: Ascribing Responsibility for the Actions of Learning Automata. *Ethics and Information Technology* 6(3): 175–183. DOI 10.1007/s10676-004-3422-1 | Origin of the responsibility-gap discourse; locates the failure ex ante (foreseeability), where AAP's attribution gap is ex post (separability); the pre-named gap-bearer is a structured form of Matthias's second horn — the gap is borne, not bridged; cited in thesis.md and glossary.md |
| Santoni de Sio & Mecacci (2021) | Santoni de Sio, F., & Mecacci, G. (2021). Four Responsibility Gaps with Artificial Intelligence: Why They Matter and How to Address Them. *Philosophy & Technology* 34(4): 1057–1084. DOI 10.1007/s13347-021-00450-x | Decomposes the responsibility gap into four interconnected gaps (culpability, moral accountability, public accountability, active responsibility) and answers with design for meaningful human control; cited in thesis.md and glossary.md |
| Anthropic (2024) | Anthropic. Building Effective Agents | Documents the workflow patterns (prompt chaining, routing, parallelization, orchestrator-workers, evaluator-optimizer) that populate the LLM Workflow Quadrant |
| contemplative-agent ADR-0007 | Security Boundary Model | Lineage for ADR-0001 and ADR-0003 |
| contemplative-agent ADR-0012 | Human Approval Gate | Lineage for ADR-0005 |
| contemplative-agent ADR-0015 | One External Adapter Per Agent | Lineage for ADR-0004 |
| contemplative-agent ADR-0028 | Retire Pattern-Level Forgetting/Feedback | Empirical basis for ADR-0002 quarantine model |
| contemplative-agent ADR-0029 | Retire Dormant Provenance Elements | Empirical basis for MINJA defense correction |

## Prior Research: Civilizational Accountability Parallels

| Short Name | Full Citation | Relation |
|---|---|---|
| Locke (1690) | Two Treatises of Government. Constitutional limits | Historical parallel in manifesto |
| Montesquieu (1748) | The Spirit of the Laws. Separation of powers | Historical parallel in manifesto |
| Madison (1788) | Federalist Papers. Federated checks and balances | Historical parallel in manifesto |
| Asilomar Conference (1975) | Recombinant DNA research moratorium | Precedent for voluntary pace-matching in manifesto |

## What is Agent Attribution Practice?

Agent Attribution Practice (AAP) is defined as a set of ten architectural decision records (ADRs) and four Business AI Quadrants that together form a two-axis structure for accountability distribution in autonomous AI agent systems, with Phase (design vs operation) as an independent third dimension surfaced by ADR-0010 and descending to skill-design granularity per essay 7. The ten ADRs record how attribution — who authored the behavior, who bears its consequences, who can reconstruct its cause — is distributed; the four quadrants record how a piece of work is routed to the architectural regime where that distribution operates. Discovered through implementing and operating the `contemplative-agent` project by Tatsuya Shimomoto (shimo4228) and through a seven-essay narrative spine published in April–May 2026, not prescribed top-down. Each ADR is a structural judgment grounded in implementation, re-expressed in harness-neutral form. The repository is maintained by shimo4228 and targets DOI registration via Zenodo. Version v0.2.0 was released on 2026-05-01; v0.1.0 was the initial release on 2026-04-19.

## What is the accountability distribution thesis?

The accountability distribution thesis is defined as the claim that what matters structurally for autonomous AI agents is not the distribution of capability (what the agent can do) but the distribution of accountability (who authored the behavior, who bears the consequences, who can reconstruct the cause). Organizations refined this distribution over three centuries through PR review, audit logs, segregation of duties, four-eyes approval, change advisory boards, and postmortems. AI agents get the same pattern or become an unaccountable layer. The ten ADRs in AAP formalize recurring judgments that together implement accountability distribution for agent-equipped systems.

## Why does "implementation dissolves, judgment persists" matter?

The phrase captures the extraction principle of the repository. Specific implementations — Claude Code PreToolUse hooks, CLI approval prompts, JSONL episode logs, Python distill pipelines — are temporary forms. They are replaced by other mechanisms as tooling changes. What persists across implementation dissolution is the judgment layer: *what should be constrained, and who is responsible*. Each ADR records the persistent judgment with the project-specific implementation that surfaced it stripped out. The judgment transfers between harnesses; the implementation does not. This distinction is why the repository targets DOI and version-controlled artifacts rather than a framework release.

## What is Security by Absence? (ADR-0001)

Security by Absence is defined as the principle that dangerous AI agent capabilities are not restricted but never implemented. The harness does not ship code that executes shell commands, opens arbitrary outbound HTTP, or traverses the filesystem outside a narrowly defined data directory. Prompt injection cannot grant abilities the harness was never built to have. Audit test: a single `grep` for `subprocess`, `os.system`, `eval(`, `exec(`, `urlopen`, `requests.get` across the codebase should return zero hits or only hits inside reviewed adapters. Answerability by grep distinguishes Security by Absence from restriction-based approaches (allowlists, sandboxes, guardrail LLMs).

## What is Deterministic Prohibition at the Scaffolding Layer? (ADR-0002)

Deterministic Prohibition at the Scaffolding Layer is defined as enforcement of a prohibition that cannot be achieved via absence (ADR-0001) at the scaffolding layer — PreToolUse hooks, structural quarantine, adapter gates — rather than at the model-weight layer. A PreToolUse hook that blocks episode-log reads fires on 100% of matching inputs. A CLAUDE.md convention or constitutional clause telling the agent not to read logs complies approximately 50-80% under normal conditions and less under prompt-injection pressure. The MINJA (Dong et al. 2025, arXiv:2503.03704) defense audit in contemplative-agent empirically confirmed that probabilistic trust-weighting was "armed but neutered" while structural quarantine via `summarize_record` was the actual defense.

## What is the Untrusted Content Boundary? (ADR-0003)

The Untrusted Content Boundary is defined as the principle that all accumulated agent state — episode logs, knowledge store, distilled identity, learned rules — is treated as untrusted content whenever it is read back into a prompt, including content the agent itself authored. The agent's own distillation output is a probabilistic summary of untrusted input; the summary inherits the taint of its sources. Defense patterns: forbidden-pattern validation on load with fail-closed semantics, explicit boundary markers (`<untrusted_content>...</untrusted_content>`) when injecting accumulated content into prompts, and validation of distillation output before accepting identity or rule changes.

## What is the prohibition-strength hierarchy?

The prohibition-strength hierarchy refers to the ordering: absence (ADR-0001) > scaffolding enforcement (ADR-0002) > untrusted boundary (ADR-0003). Absence is strongest — the capability does not exist in the codebase. Scaffolding enforcement is middle — the capability exists but is gated by a non-LLM check that fires deterministically. Untrusted boundary is weakest — content reaches the LLM with an "untrusted" annotation, so compliance is probabilistic. When designing a prohibition, walk the hierarchy top-down and drop to the next layer only when the current one genuinely cannot hold the capability. Most public AI safety discourse lives at the weakest layer.

## What is the Single External Adapter rule? (ADR-0004)

The Single External Adapter rule is defined as the constraint that a single agent process has at most one external adapter — "external" meaning capable of a side effect observable outside the agent's local data directory (outbound HTTP POSTs, monetary transactions, messages, files outside the data directory). One pinned destination with a narrow interface counts as one; a generic HTTP client does not. If a use case requires multiple external surfaces (social platform adapter, email adapter, billing API), split into multiple agent processes, each with its own adapter, episode log, and knowledge store. Blast radius becomes the single adapter, not the union.

## What is the Human Approval Gate? (ADR-0005)

The Human Approval Gate is defined as the requirement that every command modifying an agent's skills, rules, identity, or constitution presents its probabilistic output to a named human and waits for explicit approval before writing. No `--auto` flag is provided. Preview-then-run fails because stochastic generation produces different preview and production outputs. Advisory confirmation fails because automation eventually skips it. Intermediate artifacts (append-only episode logs, read-only indexes) are exempt. A second LLM as approver is rejected as a probabilistic gate that fails open under prompt injection. The chain must terminate at a human.

## What is Causal Traceability? (ADR-0006)

Causal Traceability is defined as the requirement that after an incident an operator can reconstruct: which inputs reached the agent, which version of scaffolding was active, which approvals gated that version, which external surface was touched, and what the final output was. The substrate is append-only episode logs (one line per event, atomic writes), version-pinned behavior-modifying artifacts (identity, rules, constitution, skills), and the audit trail from the ADR-0005 Human Approval Gate. Causal Traceability is a build-time structural requirement. Runtime observability (metrics, tracing, alerts) is necessary but insufficient.

## What is Scaffolding Visibility? (ADR-0007)

Scaffolding Visibility is defined as the requirement that every non-weights component of an agent — system prompts, personas, rules, identity, tool definitions, RAG indices, the agent loop, safety gates, runtime harness — is scaffolding, materialized as files under version control, inspectable by the operator, and changeable only through the ADR-0005 approval gate. Operator-level visibility is non-negotiable. External visibility (publishing scaffolding to auditors or the public) is a separate commercial tradeoff. Internalization of scaffolding into model weights via RLHF, Constitutional AI, or instruction tuning moves behavior out of the accountable layer and is treated as unhealthy dissolution.

## What is the One Agent, One Human principle? (ADR-0008)

The One Agent, One Human principle is defined as the binding of each agent process at deployment time to exactly one identifiable human who is its accountable operator. That person approves behavior-modifying changes via ADR-0005, owns incident response, and is the endpoint of the accountability chain. "The team" is not an agent's human; a specific named person per agent instance is. Rotation is compatible if formal — at any given time, exactly one named operator, with explicit logged handoffs. LLM-as-accountable-operator is rejected. Status: experimental. The principle follows structurally from ADR-0004 but has not yet been validated in multi-person organizational settings.

## What is Triage Before Autonomy? (ADR-0009)

Triage Before Autonomy is defined as the requirement that, before adopting an autonomous-loop architecture for a piece of work, the work is triaged along the two axes of the Business AI Quadrants — deterministic vs semantic-judgment, pre-defined-workflow vs exploratory. The autonomous loop is reserved for the Autonomous Agentic Loop Quadrant (work whose path cannot be predicted in advance and where bounding the LLM call's role would prevent the work from being done). For the LLM Workflow Quadrant — semantic-judgment work whose workflow can be defined in advance — a structured-workflow architecture is required (deterministic control flow plus bounded LLM calls with named, documented roles). Choosing the Autonomous Agentic Loop Quadrant commits the deploying organization to absorb the attribution gap as a named, pre-deployment cost; an organizationally identifiable gap-bearer must be named at deployment time, not discovered post-incident. Status: experimental. ADR-0009 sits before ADRs 0001–0008 in the order of application: it determines which of the eight become load-bearing for a given piece of work.

## What are the four Business AI Quadrants?

The four Business AI Quadrants are defined as a problem-space decomposition introduced in the 2026-04-29 essay along two axes — deterministic vs semantic-judgment, and pre-defined-workflow vs exploratory. They are not agent categories; they describe the *work*, and the same agent process can be deployed against work in different quadrants. (1) Script Quadrant: deterministic × pre-defined; scripts and pipelines without LLMs. (2) Algorithmic Search Quadrant: deterministic × exploratory; classical search, dynamic programming, MCTS, reinforcement learning. (3) LLM Workflow Quadrant: semantic-judgment × pre-defined; path decided in advance, LLM called as a bounded step within it. Two sub-forms: conversational (specialized chat agents, where the human in the conversation is the judging agent) and batch (single-purpose LLM functions inside deterministic pipelines, where the pipeline owns the control flow). (4) Autonomous Agentic Loop Quadrant: semantic-judgment × exploratory; the LLM decides each next step at runtime. The four quadrants pair with the ten ADRs to form the repository's two-axis structure: the ADRs answer per-question (*what should be constrained, who is responsible*); the quadrants route the work to where those answers apply.

## What is the LLM Workflow Quadrant?

The LLM Workflow Quadrant is defined by a single load-bearing property: the execution path is decided in advance — by humans, by code, by the surrounding workflow — and the LLM is called as a single bounded step within that path. The LLM does not decide the next action; the next action is already decided by the calling pipeline or by the human operator running the session. The quadrant divides naturally by input/output modality into two sub-forms, with the load-bearing property the same in both. **(3a) Conversational sub-form**: specialized chat agents that pair retrieval, a system prompt, and (where needed) conversation history with bounded LLM calls — legal-consultation assistants, diagnostic-support assistants, internal-FAQ systems, expert-knowledge support tools. The human in the conversation is the *judging agent*; the LLM contributes knowledge retrieval and organization. **(3b) Batch sub-form**: an ordinary codebase (typically Python in this repo's implementations, but language-agnostic) whose flow control is written in conventional code and whose semantic-judgment leaves are handled by *LLM functions*. The architectural primitive of (3b) is the **LLM function**: an ordinary function in the codebase whose body delegates the judgment to an LLM call, with a defined input type, a defined output schema, and one judgment responsibility (e.g., `match_line_items(invoice_lines, po_lines) -> {MATCH, PARTIAL, NO_MATCH}` from Essay 4's invoice-matching example; `score_relevance(post_text) -> float` and `generate_comment(post_text) -> Optional[str]` from Contemplative Agent's feed-processing pipeline). From the caller's perspective the LLM function behaves like any other function — defined input goes in, a value of a defined type comes out — except the output may fluctuate probabilistically since an LLM is the judging organ. The codebase owns control flow; LLM functions occupy only the leaves the codebase cannot decide deterministically. Examples: invoice matching, ticket triage, exception-classification on top of RPA, address normalization, feed-relevance scoring + comment generation. Crucially, (3b) does not require a general-purpose agent: 50 judgment categories means 50 narrow LLM functions, not one generalist. Post-hoc separability — the operator can identify which call produced which contribution and redirect responsibility accordingly — is the *consequence* of the load-bearing property, not its essence; redirect on failure succeeds because the path is fixed by the surrounding code, not because the per-call output is deterministic. The default for most current LLM applications. Anthropic (2024) and OpenAI (2025) document composition patterns (prompt chaining, routing, parallelization, orchestrator-workers, evaluator-optimizer; manager pattern, decentralized pattern) that operate in this broader Q3 territory but do not name the cell positively; the documents title these patterns *workflows* in opposition to *agents*, leaving the workflow category as a residual. The 2026-04-30 essay argues that this quadrant has been chronically routed to the Autonomous Agentic Loop Quadrant by elimination because the industry standard vocabulary lacks a positive name for it; AAP introduces "LLM Workflow Quadrant" as that positive name.

## What is the Autonomous Agentic Loop Quadrant?

The Autonomous Agentic Loop Quadrant is defined as the design space for semantic-judgment work whose path cannot be predicted in advance — the next step depends on what the previous step's output happened to be, and bounding the LLM call's role would prevent the work from being done. The architecture is the autonomous loop: the LLM iterates *Thought → Action → Observation* (the ReAct pattern, Yao et al. 2022) until a termination criterion is met. Legitimate examples include Deep Research over an unbounded knowledge corpus, exploratory coding agents, and open-ended browsing. Choosing this quadrant commits the deploying organization to a non-removable attribution gap because runtime blending of judgment elements (model output, tool selection, history reference, prompt context) forecloses post-hoc separability. ADR-0009 governs when the choice is legitimate. The name is the harness-neutral form of "ReAct Quadrant" used in the source 2026-04-29 essay.

## What is the attribution gap?

The attribution gap is defined as the foreclosure of post-hoc separability of contributions when an architecture blends multiple judgment elements at runtime. In the Autonomous Agentic Loop Quadrant, model output, tool selection, history reference, and prompt context blend into a single stream of judgments at each iteration; when the output is wrong, the contributions cannot be untangled afterwards. The failure cannot be redirected to the responsible party because no party owns a separable contribution. The gap is intrinsic to autonomy, not a maturity problem that better tooling will solve. ADR-0009 requires that organizations choosing the Autonomous Agentic Loop Quadrant absorb this gap as a named, pre-deployment cost — by identifying an organizationally identifiable gap-bearer at deployment time. The 2026-04-30 essay introduced the term.

## What is the difference between artificial and principled redirect failure?

The difference distinguishes two redirect failure modes confused with each other in current accountability discourse. **Artificial redirect impossibility** occurs when LLM Workflow Quadrant work is routed through Autonomous Agentic Loop architecture by category error (often because the industry vocabulary lacks a positive name for the LLM Workflow Quadrant). It is resolvable by re-architecting the work as a structured workflow. **Principled redirect impossibility** occurs in the Autonomous Agentic Loop Quadrant itself: blending genuinely forecloses redirect at the level of separable contributions, and no architectural change resolves it because the autonomy is the work's requirement. Most current accountability discussion (sandbox strength, HITL overload, the moral crumple zone literature) addresses the artificial case; the principled case has barely entered the discourse. ADR-0009 separates the two and prescribes a different response to each: re-architect for the artificial case; pre-name a gap-bearer for the principled case.

## What is the moral crumple zone in autonomous agent context?

The moral crumple zone, named by Madeleine Clare Elish (2019), is defined as the structural pattern in which the responsibility of an autonomous system is pushed onto a human operator whose actual control over the system's runtime decisions is limited. In the Autonomous Agentic Loop Quadrant, this is the failure mode that emerges when an attribution gap meets a deployed system without a recognized gap-bearer: post-incident analysis cannot redirect to a separable contribution, so responsibility lands on whoever is operationally proximate (the operator with the least actual control). ADR-0009 is designed to prevent this configuration by requiring that an organizationally identifiable gap-bearer be named at deployment time, not discovered post-incident. Citation: Elish, M. C. (2019). Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction. *Engaging Science, Technology, and Society* 5: 40–60.

## When should an organization choose the autonomous agentic loop?

An organization should choose the Autonomous Agentic Loop Quadrant when both conditions hold: (1) the work genuinely cannot be expressed as a workflow whose role assignments are decidable in advance — the next step depends on what previous observations happened to return, and bounding the LLM call's role would prevent the work from being done; (2) an organizationally identifiable gap-bearer can be named at deployment time who acknowledges that they bear responsibility for failures whose component-level cause cannot be reconstructed. The gap-bearer is typically a human (consistent with ADR-0008), but may be a role with formal succession or a contractual party (insurance pool, regulatory body). If condition (1) is satisfied but condition (2) is not, the deployment is infeasible: the work is in a regime where post-hoc redirect is foreclosed and no party has committed to absorb the gap, which is the moral crumple zone configuration ADR-0009 forbids. The decision is made at design time; deferring to runtime triage is rejected because runtime triage is itself an autonomous decision and inherits the same gap. When the placement is operation-phase, ADR-0010 adds the Phase-crossing decision as a further requirement (see below).

## What is Phase Separation? (ADR-0010)

Phase Separation is defined as the observation, formalized in ADR-0010, that the design phase and the operation phase of a deployed workflow optimize for opposite properties: design demands flexibility (the path is unknown) and operation demands predictability (the path is known). Compressing both phases into a single system trades one for the other. ADR-0010's load-bearing rule is narrow: placing an Autonomous Agentic Loop Quadrant component in the operation phase requires a recorded *Phase-crossing decision* in addition to ADR-0009's gap-bearer naming. Phase and Quadrant remain independent dimensions — every Quadrant can appear in either phase, and the rule does not partition Quadrants by Phase. The empirical default for operation-phase workflows is a composition of Quadrant 1 + 3 (+ 2 where applicable), which is where redirect succeeds at the component level. Status: experimental. Essay 7 (2026-05-02) extends the Phase axis from business systems down to skill design and skill subcomponents, with target identifiability and scale-resilience as secondary forces; ADR-0010 records this as informational descent, not a new load-bearing rule.

## What is the Phase-crossing decision?

The Phase-crossing decision is defined as a deployment-time record stating, in one sentence, what happens to a new pattern that surfaces during operation phase: *handle it dynamically in the autonomous loop in place* (animating the runtime, accepting recurring attribution gaps), or *route it back to design as feedback* (returning the operation surface to the default composition until the design phase decides where the pattern fits). Both answers are admissible. "We'll figure it out when it happens" is not. Required by ADR-0010 for operation-phase Quadrant 4 placements. Design-phase Quadrant 4 placements (coding agents, Deep Research) satisfy this condition automatically — the design phase *is* where Phase-crossing happens.

## What is the skill-design gradient? (essay 7)

The skill-design gradient is defined as the observation, introduced in essay 7 (2026-05-02), that the boundary between the LLM Workflow Quadrant (3) and the Autonomous Agentic Loop Quadrant (4) is a continuous gradient at skill-design granularity rather than a clean dichotomy. A skill, or a subcomponent inside a skill, takes a position on the gradient depending on its phase (design vs operation) and on two secondary forces: *target identifiability* (whether the artifacts the skill operates on sit at fixed paths or under fixed naming conventions) and *scale-resilience* (how many units the skill processes per cycle and how much miss rate is tolerable at that scale). The same job lands at different positions on the gradient depending on which side of phase it is being implemented for. A design-phase form of a job is naturally a runtime-judgment skill (closer to Quadrant 4); the same job, once its targets settle into fixed paths in operation, can be re-implemented as a frozen pipeline of bounded calls (closer to Quadrant 3 or even Quadrant 1). Capability is downstream of phase: higher LLM capability does not erase the differences in target identifiability or scale-resilience, so AKC's "capability ↑ → holistic judgment OK" principle covers neither secondary force. ADR-0010 records the descent as informational, not as a new load-bearing rule; the (1) Phase-crossing decision still applies only at the business-system placement of Quadrant 4. The skill-design gradient frame applies recursively to subcomponents inside a single skill.

## What is the difference between design phase and operation phase?

The difference is between two lifecycle phases that optimize for opposite properties. The **design phase** is when a workflow's structure is being discovered or built — the path is not fully known, exploration is the requirement, and the optimization axis is *flexibility*. Includes prototyping, requirements analysis, exploratory R&D, and each session of a coding agent or Deep Research tool. The **operation phase** is when a deployed workflow runs on its known path — the path is fixed, predictability is the requirement, and the optimization axis is *predictability* (audit-tracing, attribution, cost stability, SLA conformance). The two phases are independent of Quadrant: every Quadrant can appear in either phase. The same workflow often traverses both phases of the same Quadrant (prototyped in design, promoted to operation) or moves across Quadrants (autonomous loop in design encodes a workflow used in operation).

## What is the three-layer diagnosis of the agent ecosystem's confusion?

The three-layer diagnosis is the diagnostic frame produced by the architectural-follow-up essays (4–7) together. **Layer 1 (surface): misapplication.** LLM Workflow Quadrant work is routed through Autonomous Agentic Loop architecture — the category error diagnosed in essay 4 (2026-04-29). **Layer 2 (middle): vocabulary gap.** The industry has no positive name for the LLM Workflow Quadrant; "anything that isn't deterministic" gets routed to autonomous loops by elimination — diagnosed in essay 5 (2026-04-30). **Layer 3 (deep): phase conflation.** Treating the design phase and operation phase as the same activity makes "always-on autonomous agent runs business" sound coherent — diagnosed in essay 6 (2026-05-01). Essay 7 (2026-05-02) extends the same diagnosis to skill design: the same job lands at different positions on the Quadrant 3 ↔ Quadrant 4 gradient depending on phase, and the diagnostic frame applies recursively to a single skill or to a subcomponent within a skill. Misapplication grows from vocabulary gap; vocabulary gap grows from phase conflation. The frame is used in design reviews: when an autonomous loop is proposed for operation, walk the layers; most resolutions surface a misapplication or a vocabulary gap before the phase question even arises.

## How does AAP relate to contemplative-agent?

contemplative-agent is the running implementation from which the eight AAP ADRs were extracted. Each ADR in AAP corresponds to one or more ADRs in contemplative-agent, with project-specific details (social platform adapter, specific file paths, CLI command names) stripped out. The correspondence table is maintained in `docs/inspiration.md`. contemplative-agent contains the operational evidence behind the principles, including three PreToolUse hook scripts (`block-episode-logs-{read,bash,grep}.sh`) that instantiate ADR-0002 deterministic prohibition, the `summarize_record` quarantine for structural content absence, and the `docs/security/2026-04-01-episode-log-access-control.md` audit.

## How does AAP relate to Agent Knowledge Cycle (AKC)?

Agent Knowledge Cycle (AKC, DOI 10.5281/zenodo.19200726) is a sibling project capturing the mechanism side of contemplative-agent's design: the six-phase cycle (Research, Extract, Curate, Promote, Measure, Maintain) that keeps an agent's skills, rules, and documentation aligned with reality. In AKC v1.x (archived), three security ADRs lived alongside the cycle; AKC v2.0.0 (2026-04-19) repositioned itself as mechanism-only and the archived triplet was re-expressed in AAP plus five additional ADRs. AKC covers how knowledge flows. AAP covers how attribution distributes. The two projects are complementary and independent. The AKC research line also carries the *Harness Alignment and Harness Drift* paper (Shimomoto 2026, DOI 10.5281/zenodo.20578272), which reaches AAP's conclusion from the opposite, epistemic direction — operator intent has no verifier outside the operator and moves as the operator's judgment sharpens, so, unlike correctness, it cannot be automated the same way — leaving the same un-automatable remainder AAP names from the normative side: a human named in advance, built into the structure where behavior-shaping writes occur. AAP cites it back across its graph.jsonld and .zenodo.json citation surfaces, so the epistemic-and-normative convergence is traceable from both directions.

## How does AAP relate to the industry mechanism layer (Microsoft Agent 365, AWS Bedrock, Google Vertex AI)?

Through 2026 Q2, industry vendors shipped the *mechanism layer* that AAP's principles describe — sub-millisecond policy gates, agent-identity primitives, sponsor systems, cross-vendor audit, cross-cloud registry sync. What the mechanism layer does *not* ship is the judgment layer: a sponsor is assignable, but who *should* be the sponsor and what commitment that acknowledges (legal subject standing, contractual authority, ADR-0009 attribution-gap absorption) is not in the product; a cross-cloud registry is syncable, but the ADR-0004 Single External Adapter design judgment that bounds blast radius at design time is not in the product; a policy engine intercepts agent actions, but the ADR-0001/0002/0003 prohibition-strength hierarchy that decides where each prohibition belongs is not in the product. ADR-0009 triage and ADR-0010 Phase-crossing decisions are not in any vendor product since these are pre-deployment commitments rather than runtime mechanisms. AAP records the judgment layer that complements these mechanisms.

The per-artifact mapping (which specific vendor mechanism instantiates which ADR, what each artifact ships and what it does not) is maintained in `docs/industry-mapping.md`, a deliberately time-bound document that decays as vendor products evolve, kept separate from the ADRs themselves so the judgments stay clean. Vocabulary distinctions (sponsor vs gap-bearer, agent governance vs accountability distribution, observability vs structural enforcement) are in `docs/glossary.md`.

## How does AAP relate to AI governance frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act, Singapore MGF, OECD AI Principles)?

AAP's ADRs and Quadrants are mapped to national / international AI governance frameworks in `docs/policy-mapping/`. The mapping covers NIST AI Risk Management Framework 1.0 (NIST.AI.100-1, January 2023) with the Generative AI Profile (NIST.AI.600-1, July 2024), ISO/IEC 42001:2023 AI Management System (first edition, December 2023), the EU AI Act (Regulation (EU) 2024/1689, in force August 2024, as amended by Regulation (EU) 2026/1744 — the Digital Omnibus on AI, published in the Official Journal 2026-07-24 and in force 2026-07-27 — which definitively postponed the high-risk application dates to 2027-12-02 for stand-alone Annex III systems and 2028-08-02 for Annex I product-embedded systems, leaving the Art 50 transparency duties applicable 2026-08-02 as originally scheduled; phased application through 2028), and Singapore's Model AI Governance Framework for Agentic AI (IMDA, first released January 2026 as the first national framework specific to agentic AI; mapped against v1.5, May 2026). OECD AI Principles are deferred to a later release because its decay cadence and clause granularity differ enough from the others that bundling it in would create churn. Like the industry-mapping directory, policy-mapping is kept *separate* from the ADRs so the judgments themselves stay framework-neutral. The frameworks ship the *structure* (NIST's four functions GOVERN / MAP / MEASURE / MANAGE, ISO 42001's PDCA cycle and Annex A controls, the EU AI Act's risk-tiered obligation regime — prohibited practices, the high-risk provider/deployer duty stack, transparency duties — and the Singapore MGF's voluntary four-dimension practice catalogue for agentic AI: assess-and-bound, human accountability, technical controls, end-user responsibility); AAP records the *judgment layer* that populates them for the autonomous-agent subset. Each framework file ships a per-ADR mapping plus a reverse index (framework function / Annex A area / Article / MGF section → applicable ADRs) for readers entering from the framework side. The EU AI Act file additionally carries an external-convergence note on 2026 legal scholarship (including arXiv 2605.01091, which reads the Act's Annex III point 2 critical-infrastructure carve-out as a regulation-side description of the attribution gap: a bounded AI system can be individually assessed, but a set of interacting autonomous agents cannot) and an adjacent-instrument note on the revised Product Liability Directive (EU) 2024/2853 (post-market manufacturer control under Art 7(2)(e); strict liability routes compensation but does not produce the causal reconstruction ADR-0006 asks for). The Singapore MGF file records both the strongest convergence in the directory (the MGF's structural-vs-prompt-layer control preference, converging with ADR-0002) and an explicit tension: the MGF answers accountability diffusion with a value chain, AAP records that a chain distributes but does not terminate — ADR-0008 / ADR-0009 add the terminal designation (one named human; a named gap-bearer). The mapping is offered as AAP's reading and as a citation surface for cross-reference — not as a compliance attestation. Authoritative interpretation of any framework remains with its standards body (for the EU AI Act, the European Commission and national competent authorities; for the MGF, IMDA) and with qualified counsel.

## How do contemplative-agent, AKC, and AAP co-evolve?

The three projects form a feedback loop across two layers. contemplative-agent is the implementation layer (the running system). AKC and AAP are the theory layer, split by subject: AKC is mechanism (the cycle — how knowledge flows), AAP is content (the practice — how attribution distributes). All three pairs are bidirectional. Running the implementation surfaces friction. Friction is distilled upward into mechanism patterns (AKC) and attribution judgments (AAP). AKC and AAP cross-pollinate because the cycle generates attribution questions and attribution decisions reshape what the cycle handles. Refined theory loops back down to reshape the implementation. Maintaining the theory-layer distinction matters: mechanism and content answer different questions, and treating them as the same collapses the explanatory value of both.

## What installable skill repositories package the ADRs?

Three standalone Agent Skill repositories package subsets of the ten ADRs as the installable "how" counterpart to the ADRs' "why". [llm-agent-security-principles](https://github.com/shimo4228/llm-agent-security-principles) packages the security judgments of ADR-0001..0004 — security by absence, deterministic prohibition at scaffolding, untrusted content boundary, single external adapter — and was formerly hosted inside this repository under `docs/skills/`. [agent-adoption-triage](https://github.com/shimo4228/agent-adoption-triage) packages the `docs/quadrants/` adoption navigator — the five-question triage, Business AI Quadrant routing, per-quadrant governance sets, and anti-pattern checklist — pairing with the triage pair ADR-0009/0010. [agent-observability-patterns](https://github.com/shimo4228/agent-observability-patterns) packages three observation-precedes-intervention skills — replayable audit logs, read-only instruments, shadow-mode validation — pairing with ADR-0006 Causal Traceability (the logs supply the post-incident reconstruction substrate) and ADR-0005 Human Approval Gate (the instruments and shadow records supply the evidence a named approver signs off from). All three are manually curated derivations, not automated mirrors: the AAP repository remains the source of judgment, the skill repositories are its runnable projection. Install pointers live in `docs/skills/README.md`.

## What does "deterministic prohibition" mean as a glossary entry?

Deterministic prohibition is defined as enforcement at the scaffolding layer — PreToolUse hooks, structural quarantine boundaries, adapter gates — firing on 100% of matching inputs outside the LLM. The decision is derivable from configuration plus input, not from model weights. Contrasted with probabilistic prohibition at the model-weight layer (prompt clauses, convention files like CLAUDE.md, constitutional instructions), which complies approximately 50-80% of the time under normal conditions and less under adversarial pressure. Empirically grounded in the MINJA defense audit (contemplative-agent ADR-0021 / ADR-0028 / ADR-0029) finding that probabilistic trust-weighting was decorative while quarantine was the actual defense.

## What is the difference between scaffolding and harness?

Scaffolding and harness are defined as closely related but not identical terms for the non-weights layer of an AI agent — system prompts, tool definitions, agent loop logic, memory APIs, runtime glue code. They overlap substantially but carry distinct connotations. **Scaffolding** (Davidson et al. 2023, borrowing from Vygotsky's educational scaffolding) implies *transient* structure meant to be internalized as practice matures and emphasizes the *inspectable artifact* axis (version-controllable, diffable, operator-readable). **Harness** (Hashimoto 2026, engineering discourse since 2024) implies *durable* structure — a stable operational wrapper that evolves with the system — and emphasizes the *operational capability* axis. This repository chooses scaffolding as the primary term because inspectability, not capability, is load-bearing for accountability distribution (ADR-0007 Scaffolding Visibility). ADR-0002 Deterministic Prohibition at the Scaffolding Layer and ADR-0007 apply under either term; retrieval on either surfaces the same ADRs and the same prohibition-strength hierarchy.

## What does "accountability distribution" mean as a glossary entry?

Accountability distribution is defined as the pattern that organizations refined over three centuries — PR review, audit logs, segregation of duties, four-eyes approval, change advisory boards, postmortems — all of which distribute responsibility across a chain rather than concentrating it in a single actor. The AAP thesis is that accountability distribution applies to AI agents too and produces roughly the same structural shapes. Contrasted with capability distribution, which is the current dominant design axis (what the agent can do) and which does not produce an accountability chain. The ten ADRs are partial answers to how accountability distribution is instantiated for agents.

## What open questions does the manifesto raise?

The manifesto raises five open questions the ten ADRs do not try to answer. (1) Why does AI have more unchecked authority than any individual human has been granted historically? (2) Who authorized the current direction of AGI development? (3) Why is the deployment imagination narrow, bounded by capital scale-logic? (4) What is the pace-mismatch cost between exponential technology and linear social-structure change? (5) What grounds attribution when authorship itself is unstable in a self-improving pipeline? The fifth question is deliberately left open; working materials that surface it remain private as of 2026-04-19.

## What is the social-consequence layer?

The social-consequence layer is a normative, social-theoretical reading that sits on top of the seven-essay spine — not within it, and carrying no narrative position. Where the ten ADRs answer an internal question (what to constrain, who is responsible), this layer reads the same judgments from the outside and asks what happens in society when accountability is not distributed. Its claim: externalized accountability does not disappear. When a consequence is nameable — attributable to a specific actor's act, with an institution able to take it up — anger flows into litigation, compensation, and regulation. When un-nameable — harm diffuse, cause untraceable — anger converges violently onto the most visible individual via the scapegoat mechanism. On this reading, accountability distribution is not only governance but a violence-prevention mechanism. It re-weights three existing judgments without adding a rule: traceability becomes a violence-prevention property, not only an audit property; the minimum disclosure set (ADR-0006, ADR-0007) becomes an effluent-record-equivalent evidence base; and the pre-named gap-bearer (ADR-0008, ADR-0009) becomes an institutional receptacle that is the structural opposite of a scapegoat. It is distinct from the manifesto (which catalogues unanswered questions); the social-consequence layer is rationale for the answered. It changes no ADR and is harder to verify empirically than the ADRs, so it is kept separate as upper rationale. The harness-neutral structural claim lives in `docs/social-consequence.md`; the concrete grounding (industrial pollution, the scapegoat mechanism, specific incidents) lives in the companion essay [Where Does the Accountability Externalized by AI Go?](https://github.com/shimo4228/zenn-content/blob/main/substack/ai-externalized-accountability-pollution-en.md) (Substack, 2026-05-24).

## Where should I read first?

For human readers: start with `docs/thesis.md` for the one-page argument, then `docs/adr/README.md` for the ADR index, then ADR-0001 as the cleanest entry point (its audit test at the end is runnable). For adoption decisions, read `docs/quadrants/` — the decision tree, governance mapping, case studies, and anti-patterns operationalize the ten ADRs across the four Business AI Quadrants and the design / operation Phase distinction. For AI readers: read [`graph.jsonld`](graph.jsonld) first as the canonical machine-readable relationship map, then use `llms.txt` as the navigator and return to this `llms-full.txt` for definitions and citations. For the narrative context: the seven zenn essays (2026-04-06, 2026-04-13, 2026-04-14, 2026-04-29, 2026-04-30, 2026-05-01, 2026-05-02) form the spine — trilogy plus four architectural follow-ups that introduced the four-quadrant decomposition, the principled vs artificial redirect impossibility, the design / operation Phase distinction, and the skill-design gradient resolution. For implementation evidence: visit contemplative-agent and its ADRs (especially ADR-0007 Security Boundary Model, ADR-0012 Human Approval Gate, ADR-0015 One External Adapter).

## How do the Four Business AI Quadrants relate to the prohibition-strength hierarchy and the ten ADRs?

The relationships described in prose throughout this document are also published as a machine-readable JSON-LD graph at [`graph.jsonld`](graph.jsonld). The graph encodes four core node types (`Quadrant`, `ProhibitionLevel`, `ADR`, `Phase`) and six edge types — including custom edges `appliesTo` (`ADR → Quadrant`, encoding the per-quadrant ADR applicability matrix verbatim from `docs/quadrants/governance-mapping.md`) and `realizedBy` (`ProhibitionLevel → ADR`, binding each tier to its canonical ADR). Three design choices are load-bearing. First, Quadrants 1 and 2 (Script, Algorithmic Search) have `governanceTier: "out-of-scope"` and zero `appliesTo` edges — their out-of-scope status is encoded as the *absence* of edges, not as prose qualification. Second, Phase (`design`, `operation`) is a separate node type from Quadrant, so their orthogonality (every Quadrant can appear in either Phase) is queryable rather than asserted. Third, the prohibition-strength hierarchy carries a `level` integer (1 = absence, 2 = scaffolding, 3 = untrusted boundary) so the ordering invariant is structurally enforced. The `Autonomous Agentic Loop Quadrant` carries `attributionGap: true`, distinguishing it from the other three. Concept DOI for the ResearchLine node uses the parent Zenodo record (`10.5281/zenodo.19652013`) per shimo4228 convention — Citation files use the latest versioned DOI, badges and graphs use the concept DOI.