Security systems fail in predictable ways. Most failures do not occur because a cryptographic primitive was broken. They occur because the system did exactly what it was told while the operator intended something different. The divergence between intent and execution is the fundamental attack surface.
Buterin's analysis of security patterns [1] identifies a structural regularity across effective security systems: they require the operator to specify intent across multiple independent dimensions, and they execute only when those dimensions align. This is not a heuristic. It is a design principle with formal consequences that have not been drawn out.
This paper does three things. It formalizes the multi-dimensional alignment pattern into a computable authority function and a coherence composite. It extends that framework with temporal decay, biological grounding, and governed parameters. It analyzes the game-theoretic attack surface and identifies coalition resistance as the central open question.
The framework was developed for distributed protocol security, and it turned out to be isomorphic to structures I had already derived independently for cognitive agent prioritization (CLOS), civic accountability (EPPE), and legal evidence integrity (VERDICT). That convergence is itself a finding. It suggests that coherence verification is domain-agnostic, and that the four systems were solving one problem in four vocabularies.
The implementation is live. Eighty three blocks are verified. Biological attestation is streaming. The mathematics is stable. The implications are not, and this paper says so rather than resolving them by assertion.
Conventional security is binary. Access is granted or denied. This framing obscures the real failure mode. A system can grant access correctly and still execute incorrectly. A system can deny access to a principal holding entirely valid credentials. Binary access control is not security. It is authentication.
This reframe has immediate consequences. If security is continuous, it cannot be evaluated at a single point in time. It has to be measured across a trajectory. An authority that was valid at authorization time may no longer reflect current intent. A credential that was earned legitimately may be operating in a context its owner never specified.
The multi-dimensional alignment pattern appears consistently across independent security domains. Table 1 sets out six instances, including the two systems developed in this work.
| System | Axis 1 | Axis 2 | Alignment condition |
|---|---|---|---|
| Type systems | Code behavior | Type annotations | Must agree at every step |
| Formal verification | Program code | Mathematical properties | Program satisfies the properties |
| Transaction simulation | Operator action | Previewed consequences | Operator confirms alignment |
| Multi-signature recovery | Multiple keys | Multiple authority definitions | All must agree |
| CLOS priority (this work) | Cognitive axes A, CE, I, CB, S, E | Runtime behavioral state | Geometric mean above threshold |
| CCP authority (this work) | Intent axes I, R, P, X, B | Temporal continuity | A(t) above the action threshold |
The generalized form is neither a majority vote nor a weighted average. It is an intersection. The logical structure is conjunction, and that choice is what makes the rest of the framework behave the way it does.
The authority function A(t) governs whether a principal holds sufficient coherence to execute a given action at time t.
Here C(t) is the coherence composite at time t, n is the network size in participants, and τ is the time elapsed since the last alignment verification. The rate α is the founder decay parameter and λ is the staleness decay parameter. Both are governed values rather than constants fixed at design time.
Plain language. A principal's authority is their current coherence score, reduced by how far the network has grown past the point where their contribution was proportionally significant, and reduced again by how long they have gone without demonstrating continued alignment.
A(t) is bounded in [0, 1] for all valid inputs. It decays toward zero in two independent ways: as the network scales, and as time passes without continued alignment.
C(t) is the weighted geometric mean across five independent axes of verified intent.
Plain language. Five separate measurements of whether a principal is who they claim to be, is behaving as they have behaved, is acting within policy, is telling the truth about what they did, and is physically present. The five are multiplied rather than added, so the composite tracks the weakest one.
| Axis | Name | Description |
|---|---|---|
| I | Identity tier | Verification strength of the principal's identity claim. Increases with hardware attestation, biometric binding, and multi-factor depth. |
| R | Reputation composite | Multi-axis behavioral history, including peer attestation, action consistency, and long-run pattern stability. |
| P | Policy compliance | Degree to which the requested action conforms to applicable governance constraints. |
| X | Audit consistency | Agreement between claimed actions and independently verifiable records. |
| B | Biological continuity | Continuous verification that the same biological operator is present, implemented through cardiac signature streaming. |
The geometric mean enforces a constraint that an arithmetic mean cannot: no axis can compensate for a deficiency in another. This follows directly from the behavior of the product as any factor approaches zero.
This is the formal encoding of redundant intent verification. A principal with perfect identity verification, flawless reputation, and full policy compliance still holds zero authority if biological continuity is not established. There is no trading across dimensions.
The Cognitive Life Operating System (CLOS) priority equation, developed independently for agent task scheduling [2], has the same mathematical structure.
The multiplicative structure enforces the same non-compensatory behavior. An agent with zero available energy has zero cognitive priority regardless of its other scores. An agent with zero coherence cannot execute regardless of how much compute is available to it.
This convergence was not designed. The same principle was derived from two independent problem domains, distributed protocol security and cognitive agent scheduling, before either derivation was compared with the other. The pattern is not domain-specific. It is structural.
Early participants in a network accumulate authority under conditions that do not persist. A founder's influence is legitimate while the network is small and their contribution is proportionally significant. As the network scales, that proportionality breaks down, and authority that was earned honestly at one scale becomes unearned at another.
As n increases, the founder term drives A(t) toward zero. This enforces a principle: historical authority does not scale with network growth. Founders are not permanent governors. Their authority decays as the system they built becomes independent of them. The rate α is a governed parameter, adjustable through the constitutional weighting system, so a community may choose rapid or slow founder decay based on domain-specific considerations.
Authority earned through past alignment does not remain valid indefinitely. Intent changes. Context changes. A credential verified six months ago does not certify current intent.
Here τ is the time elapsed since the last successful alignment verification. A principal who stops demonstrating coherent behavior loses authority at a rate set by λ. There is no coasting on historical reputation.
This mechanism has a specific implication for applied intelligence alignment. A system operating under this framework cannot accumulate authority without continuous biological attestation. Authority cannot be pre-granted and stored.
The two decay mechanisms are multiplicative and independent. A principal can hold a high C(t) and a low A(t) through staleness alone. A principal can hold a recent attestation and a low C(t) through axis deficiency alone. Because A(t) is a product of three terms, all three have to remain non-negligible for meaningful authority to exist.
This creates a clock on authority. Every principal has to keep demonstrating multi-dimensional coherence to maintain operational capacity. The system does not grant and forget. It grants and watches.
Every digital identity system faces the same fundamental vulnerability. Credentials can be transferred. A private key can be copied. A password can be shared. A hardware token can be stolen or handed over. The credential proves possession. It does not prove presence.
The B axis addresses this at the protocol level. The biological continuity signal cannot be transferred because it is generated by a specific biological system, continuously, in real time. Presence is the thing being measured, and presence is not a bearer token.
The B axis is implemented through MORTEM, a research instrument that streams live pacemaker heartbeat data to a public ledger. The implementation treats a Class III medical device as a non-transferable cryptographic primitive.
Cardiac attestation has four properties that make it usable as ground truth. It is continuous: the signal is present for as long as the operator is alive and present, and it cannot be pre-recorded without producing a detectable discontinuity. It is unique: cardiac signatures are biometrically distinctive, and the rhythm, interval distribution, and morphology of a pacemaker-regulated signal are tied to that implant and that patient. It is non-delegable: a pacemaker cannot be handed to somebody else, because the credential is physically embedded in the operator. And it is sequentially committed: each heartbeat is cryptographically chained to the one before it, which makes retroactive forgery detectable rather than merely difficult.
Every other axis can in principle be socially engineered, credential-farmed, or gradually inflated through coordinated behavior. Identity tiers can be manufactured. Reputation can be built by a patient adversary. Policy compliance can be gamed by an actor who reads the policy carefully. Audit consistency can be maintained by an actor who controls the audit surface. B cannot be produced by any of those means. This is not an incremental improvement in identity verification. It is a change of category.
The MORTEM biological attestation layer is live on a public devnet with eight autonomous witness agents providing continuous heartbeat attestation. Eighty three blocks are verified. Twelve adversarial threat vectors have been identified with documented recovery paths. Nine property tests pass with deterministic replay confirmed.
Mechanism-level implementation detail is deliberately withheld from this publication, for the dual-use reasons set out in Section 9. The architectural claim is what is offered for review. Researchers interested in a collaborative evaluation of the implementation may contact the author.
Three primary attack classes act against C(t). Each targets a different structural assumption of the composite.
Mutually reinforcing attestation loops between coordinated principals can inflate the reputation axis artificially. Principal A attests to Principal B, B attests to A, and both accumulate reputation through circular endorsement that no outside party ever validated.
The mitigation is attester credibility weighting. The weight assigned to an attestation is a function of the attester's own C(t), so a circular loop between low-credibility principals produces diminishing marginal reputation gain. This does not resolve the problem. A sufficiently large coalition of high-credibility principals can engage in mutual attestation that passes the weighting filter. The mitigation reduces the attack surface. It does not eliminate it.
A patient adversary can build authority slowly across all axes and then exploit it during a high-impact window. The adversary accumulates C(t) through genuinely legitimate behavior over months or years, then executes a targeted action before staleness decay becomes effective.
The optimal exploitation window is the interval in which C(t) is high and τ is low. The adversary has to time the action inside that window, and the λ parameter controls how wide it is. A high λ compresses the window and forces the adversary to act faster. A low λ widens it. Selecting λ is a domain-specific calibration problem that requires empirical observation of the threat population's time preferences, and the framework does not specify how to perform that calibration.
The geometric mean in C(t) assumes independence between axes. If the axes are correlated in practice, a capability that allows manipulation of one may enable manipulation of others, and the composite silently becomes a narrower measurement than it appears to be.
Consider an adversary who can forge audit records. That same adversary may also be able to construct misleading policy compliance evidence, because in many deployments audit records and compliance evidence are produced by related systems. Compromising one compromises both, and the product term that was supposed to catch the deficiency never sees it.
This attack requires identifying hidden correlation structure between axes. The defense requires designing axes to be causally independent at the data source level, not merely conceptually independent at the specification level. Empirical measurement of axis correlation in deployed systems is listed in Section 11 as open work.
The central open problem is coalition resistance. The current formulation evaluates C(t) against an absolute threshold. A coordinated coalition that executes mutual attestation and aligned behavior across all axes simultaneously can, in principle, meet that threshold collectively without any individual member deserving it.
A candidate resolution is relative authority scoring. Instead of evaluating C(t) against an absolute threshold, evaluate it against the distribution of C(t) across all current participants.
Plain language. A principal is scored against the field rather than against a fixed bar, so inflating everyone's score at once moves nobody up.
Under relative scoring, coordinated coalition inflation becomes a treadmill. If all coalition members inflate together, their relative scores are unchanged. A new participant entering the network with genuine coherence achieves a competitive score without coordinating with anybody. The coalition gains nothing from mutual inflation, which is the same payoff restructuring that the quadratic voting literature applies to Sybil resistance [3].
Three questions remain open. Does relative scoring create perverse incentives during network formation, when the reference distribution is thin and a small number of participants set the mean? How should relative scoring interact with the temporal decay terms, which are absolute quantities? And what is the equilibrium strategy for a rational coalition under relative scoring, given that the coalition can also choose to shrink the reference population rather than inflate against it?
Current alignment approaches for machine systems operate primarily at training time. Reinforcement learning from human feedback, constitutional methods, and preference modeling all attempt to encode human intent into model weights before deployment [6], [7]. The model then acts on that pre-encoded intent without ongoing human authorization.
This architecture has a structural weakness. It cannot respond to intent that changes after training. Human values drift. Context changes. The specific action a human would authorize in a given situation cannot be fully specified in advance, and a system whose only representation of intent is a set of weights has no channel through which the update could arrive.
The framework provides an alternative: continuous biological attestation as a runtime authority signal. A system governed by A(t) can only execute actions while the human operator's biological state is continuously attesting to presence and intent. Table 3 places this against existing approaches.
| Approach | Intent specification | Ongoing verification |
|---|---|---|
| Learning from human feedback | Training time | None |
| Constitutional methods | Training time | None |
| Human in the loop | Per-action approval | Per action |
| Coherence authority (this work) | Multi-axis, continuous | Biological attestation |
An autonomous system operating under this authority function with MORTEM attestation has four properties that follow from the mathematics rather than from policy.
Liveness-conditional authority. The system cannot take consequential actions if the human operator is dead, unconscious, or absent. Authority does not persist beyond biological presence, because the B axis goes to zero and the composite follows it.
Non-coercible design. Because the B axis requires a continuous voluntary biological signal, coerced operation is in principle detectable. Stress physiological signatures differ from baseline. This is a property of the signal, and its reliability in adversarial conditions is not yet established empirically.
No authority storage. Authority cannot be pre-granted and cached. Each action requires a fresh A(t) evaluation against a current B axis reading, which means an agent cannot bank authorization during a period of presence and spend it later.
Auditable continuity. Every action is linked to a specific heartbeat attestation on the ledger. The biological state at the moment of authorization is permanently recorded, which is what makes the first three properties checkable after the fact rather than merely asserted.
CLOS, the 37-agent cognitive operating system, is the natural integration target. CLOS agents operating under this authority function would execute only while the biological attestation layer is active, which produces a system that cannot act autonomously in any consequential sense while the human is absent.
The El Paso Proof Engine anchors civic records, water system data, and grid performance to an immutable chain. Raw anchoring without a trust layer produces timestamped data and nothing more. The authority function gives the engine a credibility weighting for its attestors.
A city councilmember's attestation is not equal to a random wallet. A civil engineer's attestation on infrastructure data is not equal to an anonymous claim. C(t) makes that distinction computable and transparent, because the authority of a claim becomes a function of the measurable coherence of the claimant rather than their self-reported credentials. That turns a record system into a veracity layer, where public records carry not only timestamps but authority scores that can be inspected and disputed.
VERDICT is a four-agent legal intelligence pipeline for evidence processing and timeline reconstruction. A document that arrives with an authority score attached to its originating agent is a materially different object from an unsigned claim.
The chain-of-custody problem in legal contexts maps directly onto the B axis: proving that the person who created a document was who they claimed to be, was present at the time of creation, and has not had their credentials transferred or spoofed. Attestation at document creation time provides a biometrically grounded proof of authorship for which current legal process has no direct equivalent. Whether such a proof should be admissible, and under what governance, is a question for that field rather than this one.
Four systems, formulated for four unrelated problems, converged on the same mathematical structure. That is the finding this section reports.
This has architectural consequences beyond the observation itself. Systems built on the principle should be able to share verification infrastructure, exchange authority signals, and compose coherence claims across domains. A principal verified at the biological layer in one context carries that verification into every context that shares the framework, which is an interoperability property rather than a convenience.
This framework is domain-agnostic, and that is the problem. The same mechanism that enforces security in distributed systems can enforce compliance in population management systems. The same biological attestation that proves a researcher's presence can track a worker's every movement. The same coherence scoring that weights civic attestation can weight social credit.
This is not a theoretical concern held at arm's length. The implementation is complete. The mathematics works. The question of whether it should be deployed is not answerable by the mathematics, and nothing in the framework answers it.
A system that cannot be gamed may become a system that cannot be challenged. If coherence verification is the basis for authority, and authority is required to modify the coherence verification system, then the system is recursively self-protecting against exactly the challenges that might reveal its failure modes.
This is not a defect that can be patched. It is a structural property of any sufficiently robust authority system. The constitutional governance layer, with its adjustable weights and its governing process, is the designed mitigation. A constitutional process governed by coherence scores is itself subject to the critique, and I do not claim to have escaped it.
Using continuous cardiac data as a protocol primitive raises questions that existing frameworks for biometric data governance do not address. The data is not held in a database that can be deleted. It is permanently committed to a ledger. A heartbeat attestation recorded in 2026 is recoverable in 2040.
That permanence is architecturally valuable and ethically significant at the same time, and for the same reason. The property that makes the attestation a reliable ground truth is the property that makes it an irrevocable disclosure. A principal who participates in a biologically grounded protocol cannot later withdraw their biological data from the record. Voluntary, informed consent is a necessary precondition for any deployment, and the architecture does not enforce it. Governance does.
This paper is published with full disclosure of these concerns rather than an appendix that manages them. The framework is presented for technical validation, for game-theoretic analysis, and for ethical evaluation on equal footing. I do not present it as unambiguously beneficial. I present it as technically novel with implications that are not fully understood.
The framework draws on and extends several established lines of research. Table 4 states what each contributes and where the present work departs from it.
| Framework | Structural similarity | Key difference |
|---|---|---|
| Quadratic voting [3] | Non-linear authority scaling | No biological grounding, no temporal decay |
| Conviction voting [4] | Time-weighted authority accumulation | No multi-axis coherence composite |
| EigenTrust [5] | Reputation through network propagation | No biological axis, no founder decay |
| Learning from human feedback [6] | Human intent specification | Training time only, no runtime attestation |
| Constitutional methods [7] | Principle-based constraint | No biological verification, no temporal decay |
| Multi-signature schemes | Multi-dimensional authorization | Binary, no continuous decay, no biological axis |
The geometric mean structure itself has precedent in multi-criteria decision analysis, where it is chosen precisely because it is non-compensatory. Its application as a security primitive, with biological grounding and temporal decay attached, is to the best of my knowledge novel. CSR-2026-001 [10] develops that positioning against the trust and reputation literature in detail; this report is the framework-side companion to it.
This paper formalizes a recurring structural pattern in security-critical systems into a computable authority function with three properties: non-compensatory multi-dimensional coherence, continuous temporal decay, and biological ground truth verification.
The framework is live. The mathematics is stable. The game-theoretic properties are partially analyzed, with one open problem, coalition resistance, identified as requiring further work and stated formally in Section 6.2.
The cross-domain convergence on this structure, from four independent derivations in protocol security, cognitive agent scheduling, civic accountability, and legal evidence integrity, suggests a principle that generalizes past any single application domain. That is a claim about structure, not about merit.
Four things remain open. Coalition resistance requires a formal proof or disproof of relative scoring as a solution. Axis independence requires empirical measurement of the correlation between the identity, reputation, policy, and audit axes in deployed systems. Alignment integration requires a formal specification of CLOS operating under this authority function. And the ethical framework requires governance standards for biometric data committed to permanent public ledgers, which do not currently exist.