Consociational codification

The rules the system obeys are taken from a named body of actual law rather than written by the developer. Obeying them is placed above every other goal the system has, so no ordinary objective can override the law. The supporting work makes the legal argument for this design. The law already recognizes actors that carry duties without being persons, so an AI agent can be made to bear duties, and liability can be directed back to whoever deployed it. The approach concerns only where the rules come from and that they take priority. It says nothing about what happens when two of those rules conflict.

This approach takes official legal text and turns it into working software that sits entirely outside the model. The papers describe three such tools. The first translates an act clause by clause into measurable technical requirements, with a test suite that runs them. The second is a generator that assembles a customized test environment from a shared library for the authority supervising a system. The third is a retrieval system over 242 regulatory documents from 68 jurisdictions, which routes a question to the enacted law governing it and ranks legislation above commentary. The model's training and objectives are unchanged. Instead, written law becomes something a developer or a regulator can run against a system or look up reliably. Every instance names one jurisdiction's law, because the approach works only where the statute is specific enough to translate.

The norms and legal rules of one country, region, language, online forum, or statute are assembled into an explicit rule set. The rule set is converted into training data, which is used to tune either the assistant itself or a separate checker beside it. As a result, the same input gets a different verdict depending on whose rules apply, and the system can name the rule it applied. The rule sets come from human-verified cultural norms across 50 countries, jurisdiction-specific legal texts across 14 languages, region-targeted generated data for Southeast Asia, and privacy statutes turned into synthetic scenarios. PluRule tests the resulting skill directly. It asks a model which of 2,885 forum rules a comment breaks, and finds that frontier models perform barely above a trivial baseline. What unites this approach is the pipeline (a local rule set, data generated from it, and a model trained on that data). Whether the assistant is tuned or a separate checker is added is a secondary choice.

Desired behavior is written as a set of rules. Each rule is a graded measure of how badly an outcome violates it. The rules are arranged in a priority order, so when two rules conflict, the ordering decides rather than a judgment made in the moment. Adapting the system to another jurisdiction means reordering the same rules instead of rewriting them. This is how one specification can serve places that weigh the same considerations differently. The work also derives which edits to a rule set preserve the guarantees that an earlier ordering already gave.

In this approach, the codified rule is a permission, i.e., who the agent acts for and what that person allowed it to do. It is written down outside the agent, in a form that a counterparty can verify at the moment of the request and an investigator can trace afterward. In practice, this means agent-specific credentials added to ordinary sign-in standards, with permissions written in plain language compiled into auditable access-control settings. It also means identifiers attached to individual running instances, so anyone dealing with one can look up what it is. Finally, it means a wider program of shared protocols for attributing actions, shaping how agents interact, and providing remedy when an agent causes harm. Identity and delegation use the same mechanism and differ only in scope. Identity answers who the agent is, and delegation answers on whose authority it acts. Both are checked before the action rather than judged after it.

Each proposal in this approach identifies something the governed party needs and withholds it until the party accepts the rules. None of them tells a model what to do. In the first, an international body certifies whole national jurisdictions against shared oversight standards. Certified states then bar imports whose supply chains embody AI from uncertified states, and deny those states specialized hardware. In the second, governments license private regulators that compete for the business of supervising firms, so operating at all means buying oversight from one of them. In the third, a behavioral use license attaches a list of forbidden uses to the model weights, so downloading the model means accepting the terms. What differs within this approach is what is withheld and who controls it. Certified states control trade and chips, governments control market entry through licensed regulators, and whoever released the model controls the artifact itself. This also determines who must be persuaded and who goes to court when the rule is broken.

This approach handles legal risk through how the system is built, rather than through any rule the system is asked to follow. The model's parameters are trained only on public-domain and permissively licensed text. Higher-risk material is kept in a separate datastore that is consulted only when a question is answered. Because the risky text was never learned into the weights, a generated output can be traced back to the sentence it came from. A rights-holder's material can also be removed from the datastore without retraining anything.