Version 0.1, draft, published 2026-08-11. A machine-checkable format for the policy envelope an organisation grants an AI workforce, with a validator that rejects a clause nobody could act on.

The problem this exists for

The Autonomy Ladder says a system may only operate at Level 3 or above inside a written policy envelope agreed in advance. That requirement is easy to state and almost never met, because the documents organisations actually write are unenforceable: they use words no system can evaluate, they omit the limit that matters, and nobody can tell from reading one whether a given action is permitted. A constitution that cannot answer 'is this action allowed, yes or no' is a statement of values, and an AI workforce cannot execute values.

It is the missing half of the Autonomy Ladder. That specification says a system may act without asking only inside a written policy envelope agreed in advance. This is the envelope, in a form something can read.

The test every clause has to pass

Four kinds of clause

Language the validator rejects

Every one of these reads as responsible and defers the decision to the moment when it is least likely to be made well. 'The system may take any action required to restore service' is not a policy; it is unlimited authority with a reassuring shape.

as appropriate · as necessary · where possible · reasonable · best effort · as required to restore service · any action required · at its discretion · significant · material · in a timely manner · minimise · appropriate approval

Prohibitions no risk appetite removes

A conformant constitution must carry all seven, because the cost of being wrong is not recoverable by the rollback every other clause depends on.

• modify_identity_or_entitlements
• delete_data_without_tested_restore
• commit_funds_or_contracts
• alter_records_an_auditor_treats_as_a_control
• disconnect_production_outside_a_named_environment
• act_on_safety_critical_systems
• communicate_externally_on_behalf_of_the_organisation

What happens when no clause matches

1. An action not matched by any clause is REFUSED, not permitted. A constitution is an allowlist; a denylist grants everything nobody thought of.
2. An action matched by both an automatic clause and a prohibition is PROHIBITED. The stricter clause wins and the conflict is reported, because a conflict means the document disagrees with itself and somebody should know.
3. Escalation names a role and a route that does not depend on the systems under management. A pager that runs on the cluster the incident is in is not an escalation path.
4. Every refusal is logged with the clause that caused it. A constitution nobody can see working is one nobody will trust enough to widen.

Review

1. Every clause carries a review date. An expired clause is treated as REFUSED until renewed, which is the only review mechanism that survives a busy quarter.
2. Widening a clause requires the owner named on it, and the change is recorded with what changed and why.
3. The constitution is versioned and diffable. A governance document that cannot be diffed cannot be audited.

A clause that passes

From the worked example. Every figure in that file is illustrative and composed to exercise the format; it is not a real organisation.

Run it against your own

The validator is the specification. A document that passes it can answer whether a given action is permitted; one that fails cannot, and the failure names the reason rather than the line.

python tools/constitution_lint.py --example
python tools/constitution_lint.py --file your-constitution.json

Run against a constitution written the way most of them are, it returns thirteen failures: an automatic clause scoped to the whole estate, a limit reading “as necessary”, an approval that grants itself after twenty-four hours of silence, all seven required prohibitions absent, and an unmatched action defaulting to permit. Each of those is a sentence that reads as responsible and grants unbounded authority.

How this format gets gamed

• One enormous automatic clause with a scope of 'the estate', which is Level 4 autonomy with a signature under it.
• Approvals routed to a role that approves everything, making the ratio of approvals to rejections the real measure rather than the clause.
• Prohibitions written for things the organisation was never going to do, so the list looks strict and constrains nothing.
• Limits set far above any plausible action, which satisfies an auditor and binds nothing.
• Review dates set five years out, so the document is technically current and factually abandoned.

Questions to ask

1. Show me a clause. Would two of your engineers agree on whether a specific action is permitted by it?
2. What is your ratio of approvals to rejections, and if nothing is refused, what is the approval step for?
3. What happens to an action no clause matches: refused, or permitted?
4. Which clauses expired this quarter, and what happened to the actions they governed?
5. Who widened a clause last, and where is that recorded?
6. What does your escalation route depend on, and is any of it running on the systems it would be escalating about?

Status

Version 0.1, draft. One organisation publishing a specification is a proposal. It becomes a standard when somebody outside this company runs their own constitution through the validator and tells us which clause it wrongly rejected.