Stopping AI Hallucinations and Unsafe Acts from Becoming Real-World Consequences (DAS Protocols) Independent
Balasore Odisha India info@sangamdas.com
Security Independent Submission AI governance candidate-act finality hallucination prevention execution-consequence boundary finality sink non-completability DAS Protocols agentic AI safety The internet has protocols for moving data, securing channels, naming hosts, and delegating identity. It has no protocol for the moment a machine-generated instruction becomes a real-world act. As AI systems begin to move money, change databases, reconfigure networks, send communications, and control physical systems, that missing boundary becomes a structural risk. Today an AI can hallucinate a fact, cite a stale source, invent a tool argument, or propose an unsafe agentic step — and still reach an effectuation interface. Model approval is not output approval. Workflow approval is not consequence approval. Moderation, access control, TEEs, simulation, and post-hoc audit all leave the final transition from computation to consequence under-protected. This document specifies the DAS Protocols Candidate-Act Finality architecture. Every effect-capable AI output is first converted into a non-effective Candidate Act. The Candidate Act stays non-effective until a Protected Enforcement Domain has validated output, provenance, factual support, consequence, jurisdiction, epoch, and sink predicates. Only then is a scoped non-bearer capability or Execution Handle released and verified at a Finality Sink. In advanced forms the Finality Sink is cryptographically unable to complete the act unless the handle supplies the missing execution material. The architecture supports graduated and escalated conditional finality so that elevated-risk but necessary acts can still proceed under stricter controls. The document elaborates the problem space, compares the approach with representative existing techniques, describes the base and advanced finality paths, and provides JSON Schema definitions for the core protected objects. Related Indian provisional applications and PCT filings are listed in the final appendix.
Introduction
The Missing Protocol Layer of the Internet The internet was built with protocols governing how data moves — TCP/IP for transmission, TLS for confidentiality, DNS for naming, OAuth for delegated identity. Each protocol solved a specific boundary problem. What no existing protocol addresses is the boundary at which a computational output becomes an externally effective act. As artificial-intelligence systems assume increasing operational authority — executing payments, mutating databases, controlling infrastructure, issuing communications, managing supply chains, and directing physical systems — the absence of a finality protocol at the computation-to-consequence boundary becomes a structural gap in internet architecture. Existing protocols govern the transmission of instructions; none governs whether a computationally generated instruction has satisfied the machine-verifiable predicates required to become a consequence. The disclosed architecture addresses this gap by introducing a protected finality layer positioned at the output-to-consequence boundary — a protocol- level enforcement mechanism that does for artificial-intelligence-generated acts what TLS did for data in transit and what OAuth did for delegated access: it converts an uncontrolled technical boundary into a machine-verifiable, cryptographically enforced, and sink-verified governance checkpoint through which no artificial-intelligence-generated output may pass into external consequence without satisfying the required finality predicates.
Scope and Relationship to the Broader DAS Protocols Family This document describes a focused embodiment of the broader DAS Protocols execution-finality architecture. It is technically related to the body of work disclosed across multiple Indian provisional applications and PCT international applications, including the Mothership application PCT/IB2026/055615. Full identification of related filings appears in Appendix A.
Problem Space
Technical Field This disclosure relates to artificial-intelligence governance, hallucination- resistant artificial-intelligence control, autonomous-agent execution control, protected execution finality, machine-verifiable compliance, cryptographic capability release, hardware-rooted execution control, secure distributed computing, trusted enforcement domains, and technical systems for controlling the boundary at which computational outputs become externally effective acts. More particularly, this disclosure relates to systems and methods in which an artificial-intelligence-generated output is treated as a non-effective Candidate Act and is prevented from becoming an external consequence unless a protected finality pipeline validates output-level, provenance-level, factual-support-level, consequence-level, jurisdiction-level, epoch-level, and sink-level predicates. Advanced embodiments further provide non-completability in which a Finality Sink is technically unable to complete a Candidate Act unless a protected Execution Handle or other sink-bound capability enables completion.
Background and Core Technical Problems Artificial-intelligence systems increasingly generate outputs that are not merely informational. Modern systems — autonomous agents, enterprise copilots, orchestration systems, cloud-management systems, software-development agents, database agents, financial agents, telecom controllers, robotic systems, and decision-support systems — may produce outputs that trigger tool calls, payments, data exports, database commits, memory writes, model updates, communications, software deployments, network-configuration changes, settlement events, legal commitments, physical commands, or other externally effective acts. Existing artificial-intelligence governance approaches commonly focus on model training, alignment, prompt filtering, output moderation, identity checks, access control, policy review, ordinary human approval, logging, monitoring, or post-hoc audit. These approaches may reduce risk, but they do not reliably control the precise technical boundary at which an artificial-intelligence-generated output becomes an external consequence. A specific technical problem arises because an artificial-intelligence model may be approved, a workflow may be approved, a prompt policy may be approved, a tool policy may be approved, and observed runtime behavior may remain within an expected envelope, yet the specific generated output may still be incorrect, unsupported, stale, unsafe, confidential, technically undesired, jurisdictionally improper, or otherwise unsuitable for effectuation. Thus: approval of the model is not approval of the output. Approval of the workflow is not approval of the consequence. Approval of runtime behavior is not approval of the specific act becoming externally effective. Additional problems include:
  • bypass or separation of moderation/policy layers from the actual effectuation interface;
  • state drift and time-of-check-to-time-of-use risk between validation and execution;
  • binary allow-or-deny outcomes that are impractical for elevated-risk but necessary acts;
  • software-only enforcement that can be bypassed by alternate paths to effectuation.
The technical problem is therefore not merely whether an artificial-intelligence system was allowed to generate an output. The technical problem is whether the generated output should be permitted to cross the machine boundary from computation into consequence, under current protected state conditions, and under what scope, safeguards, and sink-verifiable authority.
Differences from Existing and Prior Technical Approaches
Difference from AI Moderation and Output Filtering Existing safety systems often focus on prompt filtering, response moderation, toxicity classification, refusal policies, output scoring, content filtering, or guardrail models. Such systems may classify or suppress certain generated content, but they do not necessarily control the final machine boundary where an AI- generated output becomes an external consequence. The disclosed architecture converts the AI-generated output into a Candidate Act and holds it in a non-effective state. The Candidate Act cannot become externally effective merely because a moderation layer permitted the text or a model generated the output. It must satisfy protected finality predicates before a scoped non-bearer capability or Execution Handle is released and verified by the Finality Sink. The invention does not merely moderate output; it governs whether the output may become consequence.
Difference from Identity, Access-Control, and API Authorization Identity and access-control systems answer the question: “Who or what is allowed to request an operation?” The disclosed architecture answers a different technical question: “Whether this specific AI-generated Candidate Act may become this specific external consequence at this specific Finality Sink under current protected state conditions.” A user, model, service, or agent may be authenticated and authorized, yet the specific Candidate Act may still be blocked if it lacks factual support, exceeds the Result-Consequence Acceptance Envelope, relies on stale provenance, conflicts with jurisdiction, fails consequence simulation, uses a stale policy or revocation epoch, or is not accepted by the Finality Sink. Identity or access authority is not treated as execution authority.
Difference from Ordinary Bearer Tokens and Permission Tokens Ordinary permission or bearer tokens may permit access when presented by a holder and may be misused if copied, stolen, forwarded, or replayed. The disclosed scoped non-bearer finality capability is different: possession of the capability data alone is insufficient to cause effectuation. The capability may be bound to the Candidate Act hash, Finality Sink identity, permitted recipient, purpose, jurisdiction, data class, consequence type, nonce, expiration, policy epoch, revocation epoch, Result-Consequence Acceptance Envelope, validation receipt, and sink verification context. In advanced embodiments the Execution Handle may also supply or activate missing execution material required by the Finality Sink.
Difference from Policy Engines and Gatekeeper Systems Policy engines may return allow-or-deny decisions that remain separated from the actual effectuation interface. If downstream software can still execute the act, the policy decision may be bypassed, ignored, or stale. The disclosed architecture requires the finality requirement to follow the Candidate Act to the Finality Sink. In advanced non-completability embodiments the sink is technically unable to complete the Candidate Act unless protected finality validation releases the missing execution material. The invention is therefore a sink-bound finality- control system, not merely a policy decision system.
Difference from Confidential Computing or Trusted Execution Alone Trusted execution environments may protect computation, secrets, or data in use. The disclosed architecture may use such components, but the invention is not merely the use of a trusted environment. The protected domain is used to enforce a specific output-to-consequence finality sequence: validate the Candidate Act, bind evidence, evaluate consequence, record validation evidence, release a scoped capability or Execution Handle, and prevent effectuation unless the Finality Sink verifies the required authority.
Difference from Logging, Monitoring, and Post-Hoc Audit Logging and audit systems record what happened after an action occurred. They do not necessarily prevent an improper act from becoming externally effective. In the disclosed architecture the Candidate Act remains non-effective before effectuation. Validation occurs before or atomically with capability release. The validation receipt participates in the protected finality transaction that binds validation evidence to release authority.
Difference from Ordinary Human Approval Ordinary human approval (click, email, chat, workflow prompt) may be stale, replayed, spoofed, unbound to the actual consequence, or separated from the Finality Sink. The disclosed architecture may require a Protected Human Approval Finality Token bound to the Candidate Act, output content, predicted consequence, approving role, authenticated user presence, approval time, policy epoch, revocation epoch, and Finality Sink identity. Human approval is converted into a protected, act-specific finality predicate.
Difference from Simulation or Digital-Twin Systems Alone Simulation systems may estimate the effect of a proposed action but remain advisory. The disclosed architecture uses consequence simulation as a pre- effectuation predicate. The simulation result may be bound to the Candidate Act, Result-Consequence Acceptance Envelope, validation receipt, scoped capability, Execution Handle, and Finality Sink verification context. Simulation becomes part of a machine-verifiable finality condition for effectuation.
Difference from Binary Allow-or-Deny Systems Binary allow-or-deny structures are often impractical for elevated-risk but necessary acts. The disclosed architecture supports graduated finality: a Candidate Act may be allowed, denied, quarantined, routed for review, redacted, delayed, sandboxed, reduced in scope, made reversible, executed as a canary, or classified as escalated but still allowable. In Escalated Conditional Finality Mode additional controls (protected human approval, multi-party approval, shortened expiration, reduced value, stricter scope, enhanced monitoring) may be applied while the Candidate Act remains non-effective until those controls succeed.
Difference from Validate-Once-Execute-Later Systems Systems that validate at one time and execute later are exposed to state drift. The disclosed architecture requires current-state finality. In some embodiments validation, consequence simulation, policy-epoch and revocation-epoch verification, sink attestation, nonce generation, monotonic counter advancement, validation- receipt generation, and capability or Execution Handle release occur within a protected atomic transaction. The Finality Sink accepts the capability only if current state remains cryptographically congruent with the state bound during validation. Historical approval is insufficient for current effectuation.
Summary of Differences Existing systems may authorize, moderate, simulate, or audit. The disclosed architecture prevents an artificial-intelligence-generated Candidate Act from becoming consequence unless protected finality succeeds at the sink boundary. Core sequence (base path):
Summary of the Invention The disclosed invention provides a hallucination-resistant output-to-consequence finality architecture for artificial-intelligence-generated acts. The core rule is: An artificial-intelligence-generated output is not authority to act. The output is converted into a Candidate Act and placed in a non-effective state. The Candidate Act remains non-effective until a Protected Enforcement Domain validates required finality predicates and the applicable Finality Sink verifies a scoped capability or Execution Handle. The invention includes a base inventive path, a graduated/escalated conditional finality path, and an advanced cryptographic execution-dependency non-completability path.
Base Output-to-Consequence Finality Path Every effect-capable AI-generated output is treated as a Candidate Act (message, recommendation, command, tool call, data disclosure, payment instruction, network-configuration change, database mutation, memory write, model update, physical actuation, settlement, or other effect-capable operation). The Candidate Act is held in a non-effective state. Key steps include:
  1. Candidate Act Formation — convert the AI output into a structured Candidate Act and place it in a non-effective state.
  2. HCAD Generation — generate a Hash-Linked Candidate Act Descriptor binding the act to output hash, originating system, ALF/RBD/OPC identifiers, policy/revocation epochs, Finality Sink identity, recipient, purpose, jurisdiction, risk class, timestamp, and nonce.
  3. ALF Validation — confirm that the Candidate Act was generated under an approved computational logic configuration (process-integrity predicate, not final authority to act).
  4. RBD Matching — compare observed runtime behavior with the ALF-bound approved behavioral envelope.
  5. OPC Validation — validate the Output Provenance Capsule for sources, retrieval records, tool outputs, timestamps, confidence indicators, limitation flags, and permitted-use constraints.
  6. FCU Verification — for hallucination-sensitive outputs, extract and verify Factual Claim Units against permitted evidence, freshness, confidence, and scope.
  7. RCAE Generation — generate or retrieve a Result-Consequence Acceptance Envelope defining the permitted consequence boundary.
  8. Consequence Simulation — determine what the Candidate Act would cause if effectuated by the applicable Finality Sink; bind the simulation result to the protected finality state.
  9. Graduated / Escalated Finality Decision — allow, deny, quarantine, redact, delay, sandbox, reduce scope, or escalate with additional safeguards.
  10. Scoped Non-Bearer Capability or Execution Handle Release — only after successful validation and (where required) receipt commitment.
  11. Finality Sink Verification — the sink verifies the capability/handle before effectuation; in advanced embodiments the sink lacks completion material until the handle supplies it.
Advanced Non-Completability Path In advanced embodiments the Finality Sink is technically unable to complete the Candidate Act unless protected finality validation releases, reconstructs, unseals, combines, or activates missing execution material via an Execution Handle. The sequence is strengthened to: A copied or stolen artifact therefore cannot operate as generic permission to act.
JSON Schema for Core Protected Objects Illustrative JSON Schema (draft 2020-12) definitions for key protected objects. Implementations may extend or map these schemas while preserving the required binding and non-bearer properties.
Candidate Act
Hash-Linked Candidate Act Descriptor (HCAD)
Scoped Non-Bearer Finality Capability / Execution Handle
Security Considerations The architecture assumes that the Protected Enforcement Domain and the Finality Sink (or their critical sub-components) remain uncompromised under the applicable threat model. Simultaneous compromise of every protected domain and every alternate effectuation path falls outside the claimed assurance. Implementations MUST enforce fail-closed behaviour for missing, stale, ambiguous, inconsistent, expired, or unverifiable protected state. Possession of an HCAD, capability, or Execution Handle MUST NOT be treated as sufficient authority without verifying the bound Candidate Act, epochs, sink identity, and other required conditions. Consequence simulation SHOULD be treated as a protected pre-effectuation predicate, not as an advisory second opinion. Escalated Conditional Finality Mode SHOULD be used for elevated-risk but necessary acts rather than relaxing core finality requirements.
IANA Considerations This document has no IANA actions.
Conclusion An artificial-intelligence-generated output is not authority to act. By converting every effect-capable output into a non-effective Candidate Act, validating machine- verifiable finality predicates, binding validation evidence to a scoped non-bearer capability or Execution Handle, and requiring Finality Sink verification (with optional cryptographic non-completability), the architecture prevents hallucinations, unsupported outputs, stale results, and unsafe agentic acts from automatically becoming external consequences. Existing systems may authorize, moderate, simulate, or audit. This architecture prevents consequence unless protected finality succeeds at the sink boundary.
Normative References Informative References THE DAS PROTOCOLS Applicant
Acknowledgements This document is part of the broader DAS Protocols body of work.
Appendix A. Intellectual Property Disclosure — Related Applications The present document is technically related to subject matter disclosed in one or more of the following applications. This statement is provided for architectural and transparency context. Any claim of priority is made only to the extent that the respective application is validly and expressly identified in the official filing record of a corresponding patent application. Identification of an application in this appendix is not intended, by itself, to create, add, correct, or modify a priority claim.
A.1. Related Indian Provisional Applications The present work is technically aligned with the Applicant’s broader body of work developed across the following Indian provisional patent applications:
  1. Indian Patent Application No. 202531123959, filed 9 December 2025;
  2. Indian Patent Application No. 202531123977, filed 9 December 2025;
  3. Indian Patent Application No. 202531125643, filed 12 December 2025;
  4. Indian Patent Application No. 202531129538, filed 20 December 2025;
  5. Indian Patent Application No. 202531130168, filed 22 December 2025;
  6. Indian Patent Application No. 202531130665, filed 23 December 2025;
  7. Indian Patent Application No. 202631000572, filed 3 January 2026;
  8. Indian Patent Application No. 202631001586, filed 7 January 2026;
  9. Indian Patent Application No. 202631002990, filed 12 January 2026;
  10. Indian Patent Application No. 202631004331, filed 16 January 2026;
  11. Indian Patent Application No. 202631005583, filed 20 January 2026;
  12. Indian Patent Application No. 202631005645, filed 20 January 2026;
  13. Indian Patent Application No. 202631006616, filed 22 January 2026;
  14. Indian Patent Application No. 202631007467, filed 26 January 2026;
  15. Indian Patent Application No. 202631009579, filed 30 January 2026;
  16. Indian Patent Application No. 202631011216, filed 3 February 2026;
  17. Indian Patent Application No. 202631011630, filed 3 February 2026;
  18. Indian Patent Application No. 202631016797, filed 16 February 2026;
  19. Indian Patent Application No. 202631018571, filed 18 February 2026;
  20. Indian Patent Application No. 202631024957, filed 3 March 2026;
  21. Indian Patent Application No. 202631030760, filed 14 March 2026;
  22. Indian Patent Application No. 202631034260, filed 21 March 2026;
  23. Indian Patent Application No. 202631035846, filed 24 March 2026;
  24. Indian Patent Application No. 202631038227, filed 27 March 2026;
  25. Indian Patent Application No. 202631041923, filed 1 April 2026;
  26. Indian Patent Application No. 202631043195, filed 4 April 2026;
  27. Indian Patent Application No. 202631043507, filed 6 April 2026;
  28. Indian Patent Application No. 202631046689, filed 11 April 2026;
  29. Indian Patent Application No. 202631046739, filed 12 April 2026;
  30. Indian Patent Application No. 202631047382, filed 14 April 2026;
  31. Indian Patent Application No. 202631049021, filed 17 April 2026; and
  32. Indian Patent Application No. 202631051652, filed 23 April 2026.
A.2. Related International (PCT) Applications The present document is also technically related to subject matter disclosed in one or more of the following international applications:
  1. PCT/IB2026/053385, filed 7 April 2026;
  2. PCT/IB2026/054453, filed 5 May 2026;
  3. PCT/IB2026/055615, filed 4 June 2026 (the “Mothership Application” / “DAS Protocols Mothership”);
  4. PCT/IB2026/055760, filed 7 June 2026;
  5. PCT/IB2026/055870, filed 10 June 2026;
  6. PCT/IB2026/056058, filed 13 June 2026;
  7. PCT/IB2026/056353, filed 22 June 2026;
  8. PCT/IB2026/056771, filed 1 July 2026;
  9. PCT/IB2026/056809, filed 1 July 2026;
  10. PCT/IB2026/056941, filed 6 July 2026; and
  11. PCT/IB2026/057198, filed 12 July 2026.
The foregoing applications may disclose related, complementary, overlapping, upstream, downstream, domain-specific, or implementation-specific aspects of protected execution governance, non-bearer authority, protected validation evidence, technical non-completability, mandatory mediation, artificial- intelligence governance, and execution-finality enforcement.
A.3. Relationship to the Mothership Application (PCT/IB2026/055615) International Application No. PCT/IB2026/055615, filed 4 June 2026, discloses a broader execution-finality architecture. The present disclosure develops a focused embodiment directed at preventing AI-generated hallucinations, unsupported outputs, stale outputs, and unsafe agentic acts from becoming external consequences through Candidate-Act Finality, Consequence Simulation, Escalated Conditional Finality, and Cryptographic Execution-Dependency Non-Completability.