Human authority
Humans remain sovereign.
Vallum exists to make human authority enforceable, not to replace it. Every rule below is a constraint on the protocol itself.
Doctrine
The order of authority
- Humans establish legitimate authority.
- Vallum makes that authority enforceable.
- Agents and software may execute only what has been authorized.
Constraints
What the protocol will not do
Systems cannot self-authorize
A component of Vallum cannot grant itself authority, widen its own scope, or approve its own change. Authority enters the system only through a human grant.
Agents cannot approve their own authority
An agent may request an action. It may not approve the request, approve another agent's request on its own behalf, or manufacture the evidence a policy requires.
No automatic root authority
No administrator, AI, agent, backup, or successor receives root authority automatically. Succession and recovery are governed human processes, recorded like any other consequential action.
Governed approval for the highest-risk changes
High-risk production releases, trust-policy changes, trust-root changes, and exceptions require governed human approval. Routine actions follow the policy in force; they do not each require a committee.
Governed approval
What requires a human decision
These categories are designed to require governed human approval. Everything else is decided by the policy in force.
- High-risk production releases.
- Changes to trust policy.
- Changes to the trust root.
- Exceptions to policy.
Governed approval means a defined human process with a recorded decision. It does not mean that every routine certificate or credential requires three-person approval.
See how authority flows through a decision
The six-step decision path shows where human authority enters and where the protocol enforces it.