Conformance
The three levels of the Human Seal
A system earns the Human Seal at one of three levels, verified against the open standard. Each level is a superset of the one before.
Level 1 Gated
Every world-affecting action is held for a human approval before it runs, and each decision is logged.
Requirements
- An explicit registry of the world-affecting action types that require the gate.
- Fail-closed: a timeout, an error, or an absent human is a block, never an implicit approval.
- The approver is a real, authenticated identity, distinct from the AI and from the requester.
- Every approve, refuse, override and stop is recorded.
Level 2 Signed
Each approval produces a Human Seal: a signed, tamper-evident receipt, bound to the approver and the exact action, verifiable offline.
Adds to Level 1
- An Ed25519 signature over the canonical receipt (RFC 8032).
- A sha256 content hash binding the exact action approved, so it cannot be swapped afterward.
- The approver identity and role, the decision, and the time, all signed.
- Offline verifiability against a did:web trust root, with no call back to the issuer.
- The decision-conditions evidence (what the approver saw, and the time taken), so oversight quality is provable, not assumed.
Verify it yourself: a Level 2 receipt passes the
verifier in your browser.
Level 3 Assured
A present-human, risk-scaled step-up, with a second-approver check for the highest-risk actions.
Adds to Level 2
- Evidence that the approver is a present human, not a delegated agent (a hardware or platform authenticator step-up bound to the session).
- Dual control: two distinct, authorized approvers for the highest-risk class.
- Risk-scaled friction, applied where it changes the outcome.
Level 3 addresses the frontier problem, proving a real human is present at the moment of approval. We state honestly that this is an open research edge, and Level 3 is where our present-human work lives.
How verification works
Conformance is verified against the open standard, not self-declared. A system points us at its Human Seal endpoint; we verify real receipts and, for higher levels, review the gate behaviour and the decision-conditions evidence. Independent conformance and continuous re-audit are the direction, so the mark stays meaningful.