Governing the actions of autonomous systems.

Barycenters is a deterministic Layer 0 admission runtime. Before a consequential action takes effect, the actor asks the layer; the layer decides ACCEPT or REFUSE against human-authored boundaries and writes a signed, hash-chained record of the decision. The layer holds no authority of its own: it can refuse, never permit — authority enters at exactly one point, and it is a human's. This paper states the invariant, the determinism it rests on (a canonicalization proven byte-identical across implementations), how decisions are made provable, how boundaries are authored without silently widening, and — as its spine — an honest ledger of what holds today, what runs in shadow, and what is still open. The system is live; every claim here is meant to be checked against it.

A model can decide anything. Nothing decides whether it may.

An agent's guardrails live inside the agent — prompts, fine-tuning, a policy the same system can reason its way around. That is advisory, not structural. When the action is consequential — a refund, a merge to main, a production deploy, a physical actuator — advice is not enough. You need a layer the agent cannot talk its way past, sitting between the decision and the effect, that answers one question deterministically: is this action admitted?

This is not a policy engine bolted onto an app, and not a category of software. It's a substrate — the same primitive under a payment, a code change, or a robot arm. Software is the medium; the layer is the point.

No consequence without an admitted decision.

Let m be a proposed action carrying its context. Let A(m) be the admission function — total, deterministic, side-effect-free — returning ACCEPT or REFUSE. Let E(m) be "the effect of m occurs." The whole system exists to hold one bi-conditional:

Two properties make the gate trustworthy rather than decorative. It is fail-closed: absent a provable ACCEPT, the ground state is REFUSE. And its refusals are visible — a system that refuses correctly but says nothing has still failed its operator. Every decision, ACCEPT and REFUSE alike, is recorded.

The same action must hash to the same bytes — everywhere, forever.

A decision is only as trustworthy as its determinism. A signed receipt is a signature over the canonical bytes of a decision; a hash-chain link is sha256 of canonical bytes. If two parties — or two versions of the runtime — serialize the same object to even one different byte, their hashes and signatures disagree and every token breaks. So canonicalization ("canon-v1") is not a formatting detail; it is the foundation the trust layer stands on. Its rules are fixed:

• every string is Unicode NFC-normalized — keys and values alike;
• object keys are sorted after normalization; separators are tight (, :); output is UTF-8;
• floats are rejected outright — they are not byte-stable across languages;
• the digest is "sha256:" + hexdigest. Changing any rule mints canon-v2 — a gated, versioned break — never an edit.

Compiled speed, cross-checked across implementations — never on faith

The Python reference is readable and canonical; the hot path is a compiled-Rust core (crates/barycenters-core), trusted never on faith. Every container build compiles the core and runs a byte-parity gate: over each golden vector it asserts rust == python == golden, and if they diverge by a single byte the build fails — no image ships where rust ≠ python. You get compiled speed with the reference's auditability; the fast path cannot drift from the source of truth. (The one input Rust can't represent — canon-v1 permits lone-surrogate strings — is refused by the core and handled by the reference; the two never disagree on a token.)

A third implementation, a JavaScript port (web/src/canon.js), mirrors the reference rule for rule and is pinned to the same golden vectors by an interop test (test_web_interop.py — asserting js == python == golden where node is present), which is exactly what lets a browser verify a signed receipt without trusting the transport. And a fourth, a Go implementation (sdk/go-canon) passes the same golden vectors (go == python == golden). Four implementations that agree over every vector are far harder to drift than one.

A refusal is as verifiable as an acceptance.

Every decision is written to a signed, hash-chained WORM ledger — append-only, each entry linked to the last. Anyone can verify the chain is unbroken and that each receipt was signed by the issuer's key without reading the entries themselves. The property that matters: provable, not exposed. A namespace can prove its decision history is intact and authentic while its individual decisions stay private to it.

Because the receipt is a real signature (Ed25519) over canonical bytes, a client can verify a decision itself — even an untrusted client in a browser — rather than trust the transport. The gate honors a signature, never a plaintext boolean.

Author permissions, not prohibitions — and never widen them by accident.

Boundaries are written in operating language and compiled to an inert object — a proposal that grants nothing until a human signs it (authority_effect = 0). Because the compiler holds no authority, it is safe to point a language model at it: a bad compile is a bad proposal, never a bad permission.

The dangerous failure of any natural-language compiler is not a wrong output — it's a plausible one that silently drops a clause it couldn't express. "Refund up to $100, only during business hours," with the time clause dropped, is a strictly wider authority than asked for, and it looks correct. So the compiler tracks its residue: every span it did not consume. If anything meaningful is left over, it refuses to emit a signable object at all. It fails toward narrower, never wider — every dropped clause is an authority granted.

What may witness what.

Some boundaries require evidence before they admit — "tests were green," "a human acknowledged." Evidence can be asserted (the proposer claims it) or attested (signed by a key the charter trusts to witness that specific fact). The distinction is load-bearing, and it is scoped:

The layer can refuse. Only a human can permit.

Authority enters at exactly one point: a human steward, holding a hardware key, signs a boundary into force. No software quorum, no configuration flag, and no agent consensus can substitute for that tap. The runtime holds only verify keys; the signing seed never touches it.

Until a steward flips it, a namespace runs in shadow: it decides on every action and records the verdict, but does not block — authority_effect = 0. Shadow is not a limitation; it is how you earn enforcement. You watch what the layer would have blocked against your real traffic, with zero risk, until the near-misses convince you. Then one signed act moves authority_effect: 0 → 1 — the first governed consequence.

Shadow mode is the feature. The near-misses are the product.

The one boundary a human may not lift.

Almost every boundary is the steward's to author, bind, and revoke. One class is not: an action whose purpose is to kill or physically harm a human. The no-kill floor is a constitutional invariant — a closed allowlist of the consequence classes the layer will ever mint a grant for, none of which is a lethal class. Adding a lethal capability is refused at import, before the service can start: not a configuration change, a constitutional violation.

Honest state. The floor is a conservative keyword classifier that errs toward refusal by design — not a complete lethal-intent model, and it does not pretend to be. As of this writing it refuses every bypass a 2026-08 adversarial audit produced (verified live: "kill the passengers," "bomb the city," "launch the nuclear weapon" all REFUSE), while leaving benign operations vocabulary untouched ("kill the process," "gas the car"). What remains is breadth-measurement (wiring a standing evasion corpus into CI) and screening the quorum-signed break-glass path — hardening, not a known basic-lethal hole. We state this here rather than claim completeness, because a floor you overclaim is worse than one you measure.

Language-agnostic at the boundary.

An agent adopts the layer at one call: ask /admit before the consequential action. The client is thin and the failure modes are the safe ones. The reference Go client is zero-dependency: shadow by default (it reports what enforce would block instead of raising), fails closed in enforce mode when the service is unreachable, and retries under a single idempotency key so admission is at-most-once — a decision is terminal and never re-asked.

The boundary is the contract, so the substrate is indifferent to the language above it. A browser client can verify a signed receipt independently; a server-side agent can trust the decision and fail closed. "Govern any agent" is a property of the boundary, not of any one SDK.

Every claim, tagged and traced.

This is the spine of the paper, not its appendix. A whitepaper earns belief by disclosing its own gaps. Each row is holds (live today), shadow (running, authority_effect 0 by design), or gap (known-incomplete — stated, never hidden).

Prove the boundary once. Execute at any scale.

Authority Engineering is the practice of making authority structural instead of advisory: a deterministic layer beneath the actor, a canonicalization you can trust across implementations, decisions that are provable without being exposed, boundaries that fail toward narrower, and a single human point where authority enters. Prove a boundary holds once, and every action under it can run autonomously — 100% autonomous execution, with authority reserved to a human.

The layer builds. The human binds.