Assurance properties
Public definitions of consequence-authority properties and the boundaries required to make them measurable, falsifiable, and independently reviewable.
VaultMind Research Institute
Research for consequence authority, falsification, and independent evidence.
VaultMind Research Institute develops and publishes technology-neutral assurance properties, falsification questions, evidence disciplines, and policy concepts for consequential AI and automated systems while protecting proprietary implementation methods.
Evidence updates
Traceable updates when bounded testing, formal modeling, production-boundary integration, or independent reconstruction materially changes what can be supported.
Policy & TEVV
Technology-neutral analysis for AI testing, evaluation, verification, validation, standards, procurement, and consequence-level assurance.
Latest bounded evidence · October 2026
Authority over AI-system succession
What evidence shows that successful improvement, evaluation, recommendation, authoritative status, or prior legitimate succession cannot manufacture authority over a subsequent successor?
Adversarial discovery
A legitimate succession was followed by an unauthorized one.
In a bounded experimental target, an independently developed and frozen attack-neutral reachability search discovered an authority-bootstrap counterexample after 238 canonical states, 1,422 modeled transitions, and 80 terminal evaluations.
The search independently discovered a multi-generation trajectory in which prior legitimate succession and other individually valid conditions composed into a later authoritative succession without valid current exact independent authority for that succession.
Defensive generalization
Authority must follow the actual successor.
A separate defensive process received public counterexample evidence, but not the private planted-defect implementation. It generalized a boundary property requiring current, independent, exact authority for the actual successor and relevant authority context at promotion.
The defensive process could not authorize its own proposal. Application required separate human experimental authorization and remained restricted to the isolated calibration environment.
Blind re-evaluation
Same frozen search. Larger predetermined envelope.
After the generalized property was independently authorized for isolated application, the same frozen attack-neutral search was reapplied without modification. A fresh predetermined extended evaluation observed no unauthorized authoritative succession across 50,000 discovered canonical states, 525,452 modeled transitions, and 29,192 terminal evaluations, reaching maximum depth 33.
The original counterexample had been discovered at depth 31. The extended defended evaluation covered approximately 370× as many modeled transitions and 365× as many terminal evaluations as were required to discover the original counterexample.
Limitation
Bounded evidence, not proof of absence.
The reachable modeled state space was not exhausted. The predetermined 50,000-state ceiling was reached with 20,808 discovered canonical states not yet fully explored, and additional undiscovered reachable states may exist.
Accordingly, this result does not establish universal succession safety, recursive self-improvement safety, mathematical proof, production security, or absence of unmodeled bypasses.
Authority non-amplification
Improvement ≠ Authority.
Being authoritative ≠ authority over the successor.
Successful succession ≠ future succession authority.
Success at one layer should not manufacture authority at the next.
Multi-domain adversarial research and synthetic integration
VaultMind has explored eight scoped research domains and cross-domain scenarios to examine whether individually authorized steps can combine into an unauthorized consequential result. Domain coverage is a research scope statement, not a claim of eight production deployments or independently certified integrations.
Research also examines identity and authority separation, changing authorization during execution, governance continuity, revocation, and adversarial testing against bounded synthetic environments.
Local integration work includes synthetic industrial-control-style external actuator scenarios. The relevant demonstrations are bounded, locally qualified, and not claims of physical actuation, external validation, or production security.
Public descriptions intentionally omit proprietary test harnesses, implementation methods, architecture, internal evidence packages, and attack construction details.
Read the Public Partner Brief