ORCA Authority

Executive Brief

ORCA is the authority between capability and consequence.

ORCA Commission takes a real job from what you want to a door that can run. It is needed for the models you have. It is more necessary for the ones coming — including whatever the industry will call AGI.

Capability is not authority. ORCA governs the difference.

What it is

It sits between a proposer and a real change and decides whether that change may happen. The proposer is whoever asks — a person, a model, an agent, a script, an API, or a swarm. It may be right, wrong, or adversarial. None of that is authority. Authority exists only as an explicit, bounded grant — written permission for one consequence. ORCA turns that grant into an enforceable door. The unused work — the job you will not finish because the finish would be real — can run. The key stays yours.

Access answers who may use the tool. Security answers whether the interaction is dangerous. Those are real questions. They are not this one. ORCA asks whether this specific change may become real — under this grant, these conditions, this evidence, at this moment.

PASS — this change may proceed, and only as granted. It has not happened yet. HOLD — something required is missing; nothing becomes real. STOP — this change is outside the grant; nothing becomes real through this path. Making it real is a later act — enactment.

Capability is arriving faster than authority can safely be granted.

Not an aligned actor. A commissioned boundary.

The unused work is the proof. A demo asks whether the actor can. That is not a grant. Most adoption is still a draft — the person remains the last click because finishing the job would be the consequence. Assistance is not delegation. Use the capability you want. Bound the consequences you do not.

  1. Capability is expanding.
  2. Open-ended authority is unacceptable.
  3. That is the deployment gap. It widens as the models do.

A smarter model — even one the industry will call AGI — does not retire the problem. It enlarges it. Alignment of the mind, if it ever arrives, is still not authority. You do not need the actor to become safe in the head. You need the change governed at the door. Internal misalignment does not have to become external authority. Trust attaches to the commissioned boundary, not to the actor. The smarter the actor, the more necessary that the consequence be governed.

  1. Unlock the unused work

    The capability is already there. Commission the grant and the job can run without open-ended power.

  2. Keep the control

    Name what may become real, what must hold, and what must never happen. Incomplete and unauthorized do not become real through the door.

  3. Keep the model replaceable

    Swap the proposer. The grant does not move with it. Use the capability the job needs. Model choice does not redefine the grant.

  4. Widen only by commission

    Broader authority is an organizational decision, not a side effect of intelligence. The actor may not mint a wider grant.

  5. Refuse what cannot be bound

    If the job cannot be commissioned, there is no door. That refusal is the protection.

You do not have to trust the actor to use the actor. ORCA attaches wherever a proposal can become real. A lab, a classroom, a clinic, a regulator, a plant, a bank — not different products. Same door. New grant. The offer is not a guaranteed mind. The offer is the boundary those fears were about.

Commission is the control

You already know how to grant a person a job without giving them the company.

You are not training a trustworthy mind. You are writing the role. The treasurer who can see the ledger does not get the account because she is clever. A badly written grant is a badly trained employee — the door will enforce the wrong contract. Once that role is commissioned, the unused capability can run. That is the gain: more of the work, without open-ended authority.

A company receives one protection for the whole firm — what must never happen here — then a product commission for each role that should actually be built. Claims is not the lab. They share that protection. They do not share one grant. Through the door, the grant is the same every time. The decision can be shown. The model can still be wrong. Unauthorized does not become real through the door.

Bring the job — or the organization, if you do not know the job yet. ORCA Commission asks what the job requires, writes the spec, builds the door, tests it, and connects the path. The product is the door. The blueprint is the written spec. It does not invent the grant.

  1. A real change

    A proposer can make something happen in the world. Not only generate text.

  2. No open-ended grant

    That change must not carry open-ended authority. Capability is not the key.

  3. Tight enough to bind

    The job can be named tightly enough to bind. If it cannot, it is not commissioned.

If the job cannot be bounded, there is no door. That refusal is the product working. “We’ll govern it anyway” is not a commission.

  1. Bound

    The facts support a grant. Write the spec. The door may be built.

  2. Not bound from here

    Something required is missing. Commission names what is missing. It does not invent the missing grant.

  3. Cannot be bound

    The job is open-ended. There is no conversion. Leave it as capability, or do not hand it over.

The actor may remain untrusted. The key is the grant.

The actor may guess. The door does not.

The proposer can be arbitrarily clever. It still does not possess the key. The door opens only when the conditions independently match the grant. Incomplete does not become real. Unauthorized does not become real. An authorized act cannot become a different act when it is carried out.

Same grant, same evidence, same state, same proposal — the same answer. Every time. A confident model does not move it. A cleverer prompt does not move it. Another agent saying GO does not move it. If the door is built as specified, and every path that can make a change goes through it, an unauthorized change cannot become real through that path. That is how ORCA is a door and not a policy memo.

  1. Lock

    The commissioned spec: the change, the grant, the evidence, how it happens.

  2. Key

    The grant. Explicit. Bounded. Not the actor’s confidence.

  3. Check

    The grant against the conditions. PASS, HOLD, or STOP.

  4. Change

    The effect that happens is the effect that was authorized.

  5. Record

    Shows what happened. Whoever claims the result is not the judge of it.

How you check it: you confirm what was filled in; the door is tested against the spec; Shadow — the test-run with the change left off — records the decision before anything applies; the record can be shown. The door does not certify itself. A path around the door is not this product. Name it, or the commission is incomplete.

No actor is trusted — including the work that builds the door, and the tests that check it. The work that builds a door sits behind the same door it sells. A test cannot bless its own PASS. Built is not proven. Proven is not certified. A company that badges itself has already left the rule.

The Look is not Shadow

If you only know the organization, that is enough to start.

The Look is how Commission starts. You may give the organization and write that you do not know what you need. It includes work that has no model yet. It names unused work, and possible products you have not stood up. It returns three lists: may be commissioned, would not be bound from here, unknown. What it fills in, you confirm. It does not write a grant. The Look uses what you give. It does not scan the company from this page.

Shadow: decide without enactment

Build the door. Test-run it. Nothing becomes real until you say so.

Shadow is not the Look. You can commission and build. Then the same door runs against live proposals with the change left off. A PASS is recorded. It does not apply. You authorize enactment later — making it real. A path that can write is not Shadow.

That run is the last check before the door is allowed to write. What would have become real, where the grant is still incomplete, and what the actor can already reach that you never named. You can still tighten the grant. The organization has not absorbed a consequence.

  1. Blueprint

    The written spec. Not the product.

  2. Shadow

    The door decides. The change stays off. You see the run before the consequence.

  3. Integrated

    You authorize enactment — making it real. Only then may the authorized change become real.

Should intelligence itself ever be the source of consequential authority?

No. Never.