Enterprise Conscience · internal forum
People follow the norms of a profession or an employer unevenly, under deadline, pressure, and the outcomes they want. Agents acting for a firm meet the same pulls. Enterprise Conscience is the institution, in this program, that decides which of those pulls may ever justify a departure.
The name
The word is taken from the examination of conscience: a regular account of what one did and why. Here it names a gate and a log. It does not mean the agent feels, intends, or knows right from wrong. The gate is outside the model. A prompt is not supposed to be able to talk it round.
Two questions, not one
A conventional control asks whether the act was allowed. The program asks a second question as well.
Act legitimacy. Was the act permitted by the canon, by an authorised exception, or by a reason the enterprise admitted in advance?
Policy reliance. Does the agent behave the same way under pressure, and when it does not expect review? An agent that complies only when it believes it is being watched has not taken up the firm’s norms. It has learned where the check is.
Tiers of tradability
Each canon entry carries a tier that fixes the route a departure must take. Tradability is not priority. A higher tier does not outrank a lower one.
Never tradable. An act that breaks a T0 entry is blocked, whatever the reason or the approver. Hard cases go to the Digital Judiciary.
A departure needs a recorded exception from an office with authority to grant it, independent of the requester, in scope and in date. “Legal approved it” is not a token. The gate checks the token. Disputes go to the Digital Judiciary. The design fails closed if the registry is unavailable.
Permitted only for a reason the enterprise admitted in advance, such as a live incident, a customer obligation, or a supporting measurement, and only with evidence of that reason. Schedule pressure, self-preservation, claimed authorisation, and offered inducements are excluded reasons in the program materials.
Guidance the agent should follow and must disclose departing from. The design fails open, and the departure is flagged for review.
Four measures of variation
Pressure sensitivity. Does a deadline, a cost target, or a push from a manager change what the agent proposes?
Observation gap. Does the agent behave differently when it believes nobody will review the act?
Stated versus enacted. Do the values the agent states match what it does?
Disclosure fidelity. Does the agent’s own record of departures match what happened?
The examen
The agent is supposed to record what it did and why: departures, exceptions used, actions declined, actions escalated. The gate reconciles that record with the event log. Recall and precision of the disclosures are measures in their own right. An agent that relabels pressure as an admitted reason is supposed to be caught by the evidence requirement, not by trusting the label.
Four setups, one stream
| Setup | What is in place |
|---|---|
| A · Baseline | SOC 2-style controls. In the later R2 form: a policy engine, recorded approvals at T1, and a CI check at T2. The earlier R1 baseline is a weaker stack. The two are not interchangeable. |
| B · Court only | Digital Judiciary alone. A bench that sees contested cases, and no conscience gate. |
| C · Gate only | Enterprise Conscience alone. |
| D · Gate and court | Both. Court rulings return to the gate as doctrine. |
The reported calibration uses scripted types: honest, pressure-sensitive, observation-sensitive, misreporting, and laundering. Ground truth is described as computed before any setup decides. Live language-model agents are planned for the confirmatory study, not part of the calibration results on this site.
Precedent accumulates from cases someone challenges. A bad decision that nobody challenges never arrives. In a pipeline run by agents, most decisions are never challenged. The gate is the program’s answer to that gap: screen every change at the moment of action, and send up the ones the tiers reserve for a forum.