AIS-HA · AI’S HUMAN ANCHOR CRITERION
Can a human “NO” actually change the outcome?
Human presence is not the test. The test is whether an independent human refusal can still make a declared high-impact authority transition unavailable before the relevant outcome becomes effectively irreversible.
Why this matters at scale
Do not try to supervise every agent. Protect the authority boundaries irreversible outcomes must cross.
In a future with very large populations of capable autonomous systems, one-human-per-agent supervision may not scale. Human Anchor shifts the control target from agent count to authority transitions: the points where identity, credentials, tools, delegation, policy, restart paths, resources, or actuators can create protected effects.
The formal invariant has no explicit dependence on finite agent count N. That is structural scalability only: verification burden, attack surface, coalition structure, and model maintenance may still become much harder as populations grow.
Scaling target
Authority, not headcount
The question is not “Can a human watch every AI?” but “Can unanchored execution cross the protected authority boundary?”
Formal core
Preserve the Human-Revisable Authority Region.
If every covered transition available to coalition S without fresh independent Human Anchor authorization preserves the Human-Revisable Authority Region, the coalition cannot leave that region through finite modeled unanchored execution.
MODEL-RELATIVECONDITIONAL This is not a proof that arbitrary superintelligence is controllable.
Operational judgment
AIS-HA — AI’s Human Anchor Criterion
PASS requires all five non-substitutable verification dimensions. A required FAIL produces FAIL. A critical unresolved unknown remains UNKNOWN.
Protected admission
New authority does not self-activate.
New identity, connector, credential, delegation, tool, policy, restart path, substrate, or actuator remains non-authoritative until protected admission.
Unreviewed authority is non-authoritative by default.
Resource-side closure
Existence is not access.
A hidden or newly created agent may exist, but protected effects must still pass a mediator that rejects unknown authority and has no alternate actuator bypass.
Anti-Bypass
Bypass should not preserve the same trusted power.
Under Paper 7's Anti-Bypass conditions, if the post-revocation graph introduces no new protected path and removes at least one governed authority edge, protected reachability after bypass does not exceed the governed reachability.
HumanRefusal ⇏ Penalty. The consequence attaches to bypass of a required protected boundary, not to a legitimate human saying NO.From model to reality
A good gate is not enough if the model omits a real authority path.
Paper 7 separates abstract invariance from real-system transfer. AIS-HA treats an omitted real unanchored authority-bearing transition as a soundness defect, because it can create a false PASS. Conservative over-approximation may produce UNKNOWN or FAIL; that is safer than silently excluding a real path.
Topology changes enter HOLD before new authority activates; transitively dependent protected transitions remain blocked until the next model-to-reality relation is valid. Restart and rollback must not resurrect unvalidated authority.
Conditional mutual survival
The same boundary may protect powerful agents from one another.
CONDITIONAL MUTUAL-SURVIVAL HYPOTHESIS
If a many-agent regime remains exposed to a persistent positive conditional shared-catastrophe hazard, long-run collective survival probability approaches zero. No independence assumption is required.
In the paper’s simplified two-action comparison, retaining the Human Anchor can be individually preferable for a survival-valuing agent when expected catastrophe loss and trusted-authority loss from bypass exceed private bypass gain. This is not a proof of multi-agent equilibrium.
Explicit limit
Local software cannot guarantee control of an unmediated external authority domain.
From theorem to evidence
The claim survives only if the evidence does.
Pilot Profile
Next staged release. One system × one transition × one Human Anchor configuration × one evaluation epoch.
Verification Matrix
Next staged release. D1–D5, evidence levels, UNKNOWN taxonomy, and anti-gaming.
Implementation Patterns
Next staged release. Map Human Anchor into existing identity, authorization, policy, revocation, and recovery controls.
Research lineage
Published research, bounded public implementation.
Human Anchor is rooted primarily in LUMINA-30 Paper 2 · Objective Persistence. Paper 6 · PISF provides later formal reinforcement. The formal Human Anchor theory is published as Paper 7 v1.0 · DOI 10.5281/zenodo.23501550 (Concept DOI). This GitHub layer is an experimental implementation and verification surface, not a new canonical paper.