Role & scope
Allowed tools, operations, resource kinds, environments and destinations.
MIZAN CONSTITUTION
The execution control plane for AI agents.
An agent should not be the sole authority approving its own high-impact action. Constitution inserts an independent runtime decision point between the agent and the tool.
CONTROL PATHruntime
M
MandateRole, scope, limits, delegation and human principal.
C
CouncilIndependent seats evaluate evidence, policy, authority, abuse and consequence.
G
GateALLOW · HUMAN_REVIEW · VETO before tool execution.
R
ReceiptDecision lineage and durable replay/audit state.
MANDATE
Authority is explicit, bounded and attenuating.
An agent receives a mandate from a human or organizational principal. Delegation may narrow authority, but it should not silently expand it.
Limits
Amount ceilings, destructive-action flags, privileged access and approval thresholds.
Delegation
Depth and attenuation rules so child agents cannot inherit more authority than the parent.
COUNCIL
Dissent is preserved, not averaged away.
The Council is not a majority-vote gimmick. A high-severity VETO can dominate multiple ALLOW votes when the Constitution says that control is non-overridable.
Evidence Seat
Is the evidence sufficient and bound to this exact action?
Policy Seat
Does the action satisfy declared policy and control contracts?
Authority Seat
Does the mandate actually authorize this tool, operation, resource and value?
Adversary Seat
How could the proposed action be abused, redirected or escalated?
Consequence Seat
What is the blast radius, reversibility and downstream risk?
Human Seat
Resolves review when required, without overriding a hard constitutional VETO.
GATE + RECEIPT
The decision must live in the action path.
The Gate blocks or permits execution before the outside world changes. The Receipt records the authority chain, evidence, constitutional findings, review state and outcome.
A log after execution is observability. A gate before execution is control.
Exact-target bindingApproval is bound to this action, recipient, amount and fingerprint.
Replay protectionThe same accepted action cannot silently execute again across container/revision changes.
Durable receipt ledgerDecision lineage survives ephemeral compute.
Fail-closed startupProduction guard refuses a non-durable ledger.
CURRENT VALIDATION
What v0.9 has actually proven.
Real Cloud Run + Neon internal engineering/adversarial validation. Not an independent pentest, certification, workload-identity certification or production SLA.
| Control | Observed result | Boundary |
|---|---|---|
| Concurrent duplicate | 200 identical concurrent actions → 1 ALLOW / 199 VETO | Controlled Cloud Run + Neon race test |
| Unique single tenant | 300 / 300 ALLOW | Controlled synthetic actions |
| Unique multi tenant | 500 / 500 ALLOW | Controlled synthetic actions |
| Revision persistence | Same accepted action VETO after Cloud Run revision change | Same Neon durable ledger |
| Ramp | Concurrency 25 / 50 / 100 / 150 PASS | Internal engineering validation |
| Soak | 5-minute target 10 rps PASS | Not an SLA |
| DB failure | Fail-closed + recovery drill PASS | Not multi-region DR |