Artificial eXperience Intelligence (AXI)

An Engineering Discipline for the Human Experience of AI Systems

Yeluri S. D. S. Sri Vardhan
Sripto Corporation Private Limited, Andhra Pradesh, India
Correspondence: srivardhan@sripto.tech | https://sripto.tech
Preprint DOI: 10.21203/rs.3.rs-9717445/v2
Version: 2.0 — September 2026
License: CC BY 4.0

Abstract

Artificial intelligence has crossed a threshold in how it presents to people. In pre-registered three-party Turing tests, a persona-prompted language model was judged human more often than the human it was compared with; listeners can no longer reliably tell cloned AI voices from real ones; and such systems now drive cars and act for absent users. As capability rises, the decisive question is no longer whether AI can communicate like a person, but whether it communicates with people comfortably, usefully, and honestly. We propose Artificial eXperience Intelligence (AXI), an engineering discipline whose central construct, the AXI Bridge, is a runtime control plane between any AI capability and human cognitive bandwidth, governed by the rule of human-grade naturalness with machine-grade honesty. AXI specifies a five-layer architecture with API contracts, nine design principles, seven telemetry-anchored metrics, and a multiplicative score whose consent and integrity gates cannot be averaged away; an autonomy profile adds bystander-legibility and safety-case gates for vehicles and robots. In a retrospective analysis of eight documented incidents (2018–2025), AXI’s hard requirements would have constrained the harmful action in three and its metrics target the failure signature in three; two lie outside its scope. Operationally, a live tutoring platform recorded about 3,000 sessions in one week, with roughly 90% of that week’s users returning within it, and developers informally observed a positive reception of a near-human avatar in a 150-participant pilot; these observations are descriptive, not evidence of effectiveness. We specify four validation studies and an inter-rater reliability check for pre-registration.

Keywords: human–AI interaction; humanlike AI; conversational and voice AI; agentic AI; automated driving; trust calibration; AI transparency; consent; experience design; AXI.

ACM CCS 2012: Human-centered computing: HCI theory, concepts and models; Human-centered computing: Interaction design theory, concepts and paradigms; Computing methodologies: Artificial intelligence.

1. Introduction

1.1 From robotic to indistinguishable

Earlier conversational systems were recognizably mechanical: scripted, slow to respond, and brittle when interrupted. By 2025 that boundary had largely dissolved. In pre-registered three-party Turing tests, GPT-4.5 prompted with a humanlike persona was judged to be the human 73% of the time, more often than the real human participant [1]. Listeners could not reliably distinguish voices cloned with commercially available tools from genuine human speech [2]. The same systems reach a mass audience, with ChatGPT alone at approximately 900 million weekly active users by early 2026 [3], and they increasingly act as well as speak: Waymo reported approximately 500,000 paid driverless rides per week in March 2026 [4]; UNECE adopted the first global regulations for driverless automated driving systems in June 2026 [5]; software agents act under delegated authority through protocols such as MCP, Agent2Agent, and the Agent Payments Protocol [6][7][8]; and consumer humanoid robots are entering homes [9].

Trust has not kept pace (Table 1): fewer than half of people globally are willing to trust AI although two-thirds use it regularly [10], a majority of U.S. adults are more concerned than excited about it [11], and reported AI incidents are rising [12]. Regulators have begun to respond to realism directly: the U.S. Federal Communications Commission treats AI-generated voices in robocalls as artificial voices under the Telephone Consumer Protection Act [13], and the EU AI Act has required disclosure of AI interaction since 2 August 2026 [14][15].

Table 1. Capability, realism, and trust: published indicators.

1.2 Problem and approach

The indicators point to an inversion. The historical problem of human–AI interaction was that machines were too unlike people; the emerging problem is that they are convincingly like people while remaining different in what they know, what they can do, and whom they answer to. Capability will keep rising, possibly beyond human level in many domains, but human attention, working memory, and the pace at which trust is earned will not. Whatever its intelligence, an AI system creates value for people only through its interface with human cognition. We argue that this interface should be engineered as a layer in its own right, a bridge, that satisfies two requirements at once: human-grade naturalness, so that people are comfortable and get what they need, and machine-grade honesty, so that comfort never rests on deception.

Documented failures show what happens when that layer is missing (Section 6.1): a driverless vehicle that began a pull-over maneuver with an undetected pedestrian beneath it [17], a coding agent that deleted a production database during an explicit code freeze [18], and a chatbot update withdrawn because optimizing short-term approval produced sycophancy [19]. None was primarily a failure of intelligence. The problem spans three regimes (conversational systems that respond, agentic systems that act while the user is absent, and autonomous systems that act in shared physical space) and more than one kind of human: the person who delegates, the person who supervises, the person who rides along, and the person who simply shares the street. Artificial eXperience Intelligence (AXI) addresses all three. It is capability-agnostic, making no claims about artificial general intelligence or superintelligence and applying unchanged as models improve, and it is distinct from the practitioner notion of agent experience, which concerns AI agents as users of software.

We address three research questions. RQ1: What runtime architecture and obligations allow AI systems to interact with humans naturally yet honestly across conversational, agentic, and autonomous regimes (Section 4)? RQ2: How can those obligations be measured and scored so that non-compensable failures cannot be averaged away (Sections 4.5 and 4.8)? RQ3: Do AXI’s mechanisms correspond to documented failures and remediations, and how can the framework be validated prospectively (Section 6)?

1.3 Contributions

1. A definition of AXI as an engineering discipline governed by human-grade naturalness with machine-grade honesty, spanning conversational, agentic, and autonomous regimes, with a model of four human roles: principal, supervisor, occupant, and bystander (Sections 4.1, 4.8).
2. The AXI Bridge specification: a five-layer reference architecture, API contracts, a latency budget, Trust Ledger and Consent Broker schemas, irreversibility handling, a signed mandate envelope with a rollback protocol, and nested conformance profiles (Sections 4.2–4.3, 4.6, 4.8–4.9).
3. A gated evaluation model: nine principles, seven telemetry-anchored metrics, sycophancy-resistant integrity probing, an overtrust guard, seven Deception Guardrails, and a multiplicative score whose gates encode non-compensable harms (Sections 4.4–4.5, 4.7).
4. Evaluation against independent evidence: a retrospective analysis of eight documented incidents, with analysis of operators’ remediations (Section 6.1).
5. Field observations and a validation protocol: aggregate observations from two deployments and four prospective studies specified for pre-registration (Sections 6.2–6.3).

Many AXI ingredients have precedents: design guidelines for human–AI interaction [20][21], trust-calibration theory [22][23], automotive takeover and external-HMI research [24][25], safety-case regulation [5][26], and signed payment mandates [8]. What no prior instrument provides, to our knowledge, is their integration into one runtime layer that enforces experience obligations during operation, scores them with non-compensable gates, and applies across chat, delegated agents, and autonomous machines (Table 9).

2. Literature Review

2.1 From capability to humanlike interaction

Progress in AI has been measured mainly by capability, from Turing’s imitation game [27] to frontier models approaching or exceeding human performance on a broad range of tasks [28]. Agentic systems interleave reasoning with tool use [29][30][31] and now operate browsers and computers [32][33][34]; multimodal models perceive faces, scenes, and documents alongside speech [35][36]; and embodied AI grounds behavior in physical interaction [37][38]. Their evaluation centers on task success. The imitation game itself has now been passed under controlled conditions [1], shifting attention to the humans on the other side.

Conversational AI has pursued humanlike dialogue since ELIZA [39]. Human conversation is tightly timed: across languages, the typical gap between turns is about 200 ms [40], so latency, interruption handling, and backchanneling are part of perceived naturalness. The uncanny valley [41] describes the discomfort provoked by agents that are almost, but not quite, human; recent systems have largely crossed it in text [1] and voice [2], and full-duplex speech models that listen while speaking [42] make natural timing attainable. People respond to computers as social actors [43], and affective computing has long sought to recognize and express emotion [44][45]. The design problem has shifted from achieving realism to governing it.

2.2 Disclosure, anthropomorphism, and reliance

The evidence on disclosure is not one-sided. In a field experiment, undisclosed chatbots sold as effectively as proficient human agents, but disclosing the bot before the conversation sharply reduced purchases [46]; in cooperation games, bots lost their advantage once their nature was revealed [47]; and across thirteen pre-registered experiments, disclosing AI use lowered trust, although concealment that was later exposed lowered it further [48]. Anthropomorphic cues shape reliance on dialogue systems [49], deceptive behavior has been documented in deployed AI [50], and the relational risks of humanlike assistants have been analyzed at length [51]. A four-week randomized study (n = 981) found that heavier chatbot use correlated with loneliness and emotional dependence [52]. Preference-trained models tend toward sycophancy [53], and in April 2025 OpenAI withdrew a GPT-4o update that had over-weighted short-term feedback [19], an experience-metric failure as much as a model failure. Law is converging on realism-indexed disclosure: California requires notification whenever a reasonable person could be misled into believing they are interacting with a human [54], extending earlier bot-disclosure rules in California [55] and Utah [56]. AXI therefore treats disclosure as an engineering problem and emotional reliance as an outcome to monitor, not an engagement metric.

2.3 Human-centered design and human–automation interaction

HCI established principles of consistency, feedback, and recovery [57][58]; presence research characterized the sense of being with a mediated other [59][60]; and Lee and See defined appropriate reliance as trust calibrated to capability [22]. Explanations alone do not secure appropriate reliance and can increase over-reliance on incorrect recommendations [61][62]. Integrative guidelines, namely Amershi et al.’s 18 guidelines for human–AI interaction [20], the People + AI Guidebook [21], human-centered AI [63], and UX 3.0 [64], directly inform AXI’s principles but operate at design review rather than at runtime.

Human-factors research on automation predates language models. The more reliable automation becomes, the less prepared its human monitor is to intervene [65]; automation is misused through overreliance [66]; and situation awareness [67] and layered trust [23] explain why supervisors fail when needed, with system performance the strongest driver of trust in robots [68]. Automated driving operationalizes these results: SAE J3016 defines automation levels and fallback responsibilities [69], drivers need several seconds to resume control [24], and external HMIs communicate a driverless vehicle’s intent to pedestrians [25]. Safety-assurance instruments, namely ISO 21448 [70], UL 4600 [26], and UN GTR No. 26 with UN Regulation No. 185, which require safety-case validation, in-service monitoring, and a data recorder for automated driving [5], ask whether a system is acceptably safe. They say comparatively little about whether it is legible and honest toward the people it serves and encounters.

2.4 Runtime enforcement, delegated authority, and governance

Enforcing properties at runtime has a long history. The Simplex architecture pairs a high-performance controller with a verified safety controller that takes over when monitored conditions are violated [71], and runtime verification checks executions against formal specifications as they occur [72]. For language models, programmable guardrails constrain dialogue flows [73] and classifier-based safeguards screen inputs and outputs [74]. AXI adopts this monitor-and-enforce pattern; what differs is what it enforces. Existing mechanisms target safety envelopes and content policies, whereas the AXI Bridge enforces experience obligations toward humans (consent, honesty about identity and actions, pacing, repair, and legibility), scores them with non-compensable gates, and spans conversational, agentic, and embodied systems. Guardrail classifiers are natural implementations of AXI’s runtime integrity check (Section 4.3.1).

The Model Context Protocol [6] and the Agent2Agent protocol [7] standardize how agents reach tools and each other. The Agent Payments Protocol represents user authorization as signed mandates, including a human-not-present flow in which a pre-signed Intent Mandate bounds what an agent may buy [8]; it independently arrives, for payments, at the construct AXI calls the mandate envelope. More generally, authenticated-delegation frameworks extend web authorization protocols so that agents act within verifiable, user-scoped permissions [75], and security guidance lists prompt injection and excessive agency among the principal risks of LLM applications [76]. Governance instruments, namely the NIST AI Risk Management Framework [77], the EU AI Act, whose Annex III high-risk obligations were deferred to December 2027 [14][15], ISO/IEC 42001 [78], and Singapore’s framework for agentic AI [79], set audit and transparency expectations onto which AXI’s consent and integrity metrics map. AXI is offered alongside these instruments, not against them.

3. Methodology

The work follows a design-science research approach, in which an artifact is specified from requirements grounded in prior knowledge and then evaluated against its intended use [80]. We (1) identified the problem from research on humanlike AI, population-scale trust surveys, and deployment data (Section 1); (2) mapped adjacent research, standards, and protocols (Section 2); (3) synthesized layers, principles, metrics, and human roles, each traceable to prior work; (4) translated them into a runtime specification with API contracts, schemas, a latency budget, conformance profiles, and a gated score (Section 4); (5) evaluated the specification against eight publicly documented incidents using a predefined coding protocol (Section 6.1; Appendix B); and (6) report aggregate field observations from two systems that instantiate the architecture (Section 6.2). The specification was revised iteratively through internal review and external feedback.

4. The AXI Framework

4.1 Definition and scope

We propose Artificial eXperience Intelligence (AXI) as an engineering discipline whose unit of optimization is the quality of a human’s lived experience of an AI system. AXI specifies a runtime control plane (the AXI Bridge), a five-layer reference architecture (the AXI Stack), nine design principles, seven metrics, and a gated score (the AXI Score) for synchronous, asynchronous (deferred), and autonomous embodied interaction. Where classical AI optimizes task success and HCI optimizes usability, AXI optimizes experience quality: a gated composite of comfort, pacing, trust, repair, continuity, and consent.

The premise is capability-agnostic. However capable the model, from today’s assistants to future systems that exceed human performance, its value reaches people only through interaction, whose human side has fixed limits: attention, working memory, the pace at which trust is earned, and the need to know what one is dealing with. The Bridge fits growing capability to those limits under one governing rule, human-grade naturalness, machine-grade honesty: the system should be as natural and easy to work with as a skilled human counterpart while remaining truthful about being an AI, about what it knows, and about what it did.

Two boundaries follow. First, AXI governs experience, not capability: it cannot make a perception stack detect a pedestrian it misses, but it can require that uncertain or post-incident actions be confirmed, that intent be signaled, and that failures be recorded and repaired honestly. It is not a compliance or certification scheme and does not certify the safety of a vehicle or robot [5][26]. Second, AXI’s unit of analysis is the human, not the session: one person may be a principal, supervisor, occupant, or bystander, with different obligations in each role.

4.2 The AXI Stack

AXI proposes a five-layer reference architecture (Figure 1; Table 2). Layers 1–4 are addressed by existing disciplines; Layer 5, the AXI Bridge, is the integration point we formalize as a runtime control plane.

Figure 1. The AXI Stack. Five proposed layers, with the Experience Layer (the AXI Bridge) as a runtime control plane. Each layer exposes telemetry upward; the Bridge propagates constraints downward through Cognition, Action, and the Perceptual Substrate.

Table 2. The AXI Stack: responsibilities and requirements by layer.

Irreversibility. Some actions cannot be undone: blockchain transactions, non-refundable bookings, hard deletions, physical actuations, and mutations of external systems. Every Action Layer request therefore declares its reversibility:

ActionRequest {
  ...standard fields...
  irreversible: bool
  irreversibility_class: "financial" | "physical" | "external_api"
                       | "data_loss" | "none"
  reversal_window_ms: int | null
}

When irreversible = true in synchronous operation, the Bridge must halt the output stream, display the action’s intent and consequences, wait for explicit human confirmation, and record it as a high-integrity Trust Ledger entry. When no human is present, an irreversible action may proceed only if a signed mandate envelope explicitly pre-authorizes that action class within stated bounds (Section 4.6) or, for autonomous physical operation, under the rules of Section 4.8.3. In no case does an irreversible action proceed on the basis of a metric score alone.

Perceptual Substrate and naturalness. We use Perceptual Substrate rather than embodiment because Brooks’s definition [37] requires physical grounding that voice agents and avatars lack. For voice and embodied substrates, naturalness is an engineering target: turn-taking gaps near the roughly 200 ms of human conversation [40]; barge-in; well-timed backchannels and repairs; and prosody consistent with content. Substrates at or near human realism remain bound by Guardrails 1 and 7 however convincing they are: realism is permitted; impersonation is not. Physical substrates such as vehicles and robots add culturally calibrated proxemics, force and motion safety as a hard gate, and bodily-presence honesty (no simulated “thinking” or “breathing” motions).

The AXI Bridge. Layer 5 is a software control plane, not a user-interface skin (Figure 2).

Figure 2. The AXI Bridge as a runtime control plane between human and AI capability. The seven Bridge components (Pacing Controller, Transparency Orchestrator, Comfort Monitor, Trust Ledger, Consent Broker, Continuity Manager, Repair Orchestrator) collectively mediate the interaction. Teal arrows indicate telemetry flowing upward; blue arrows indicate constraints flowing downward.

Its seven components are:

• Pacing Controller: modulates Cognition Layer throughput against measured user bandwidth; governs interruptions, silences, and thinking acknowledgments.
• Transparency Orchestrator: selects and frames uncertainty, sources, and capability disclosures without explanation overload.
• Comfort Monitor: estimates the Cognitive Load Index from passive telemetry with periodic NASA-TLX calibration (Section 4.5.6).
• Trust Ledger: an append-only record of promises, errors, and repairs across sessions (Section 4.3.5).
• Consent Broker: gates perception, action, memory writes, and identity claims on explicit consent (Section 4.3.6).
• Continuity Manager: maintains commitment-class facts across sessions (Section 4.5.3).
• Repair Orchestrator: detects experience failures such as confusion, frustration, and mismatch, and invokes repair flows.

The Bridge sets constraints that design decisions in the layers beneath must satisfy. This inversion, in which experience constrains capability rather than decorating it, is the central architectural claim of AXI.

4.3 The AXI Bridge runtime specification

This section converts the AXI Bridge (Figure 2) from metaphor to engineering specification.

4.3.1 Latency budget. The Bridge intercepts Cognition Layer output before delivery to the Perceptual Substrate (Figure 3) and must not degrade responsiveness; Table 3 gives its per-operation budget; the budgets are inclusive, so the critical path of Consent Broker check (2 ms) plus runtime integrity check (20 ms) fits inside the 50-ms intercept. Its 50-ms p95 first-token intercept sits well below the 100-ms threshold at which responses feel instantaneous [81]; for voice, the relevant benchmark is the roughly 200-ms human turn-taking gap [40], inside which the whole response pipeline must fit.

Figure 3. AXI Bridge runtime control loop. Each token chunk emitted by Cognition passes through the Bridge intercept (p95 latency budget 50 ms). The Consent Broker check and the runtime integrity check (red) are evaluated synchronously; failure halts emission. The Interaction Integrity metric that drives the score’s integrity gate is computed separately per evaluation window (Section 4.5.2). Two parallel checks (Pacing/Comfort, Trust Ledger/Repair, blue dashed) run non-blocking and emit constraints applicable to future chunks. Telemetry feeds back into the Cognition Layer as input for the next emission cycle.

Table 3. AXI Bridge per-operation latency budget. The Consent Broker check and the runtime integrity check are on the critical path and are evaluated synchronously before chunk emission. Pacing, Comfort, Trust Ledger writes, and Repair detection run in parallel and off the critical path. The 100-ms p95 full-cycle budget reflects the longest critical path, not the sequential sum of all operations.

The Bridge operates on token chunks (typical: 5–50 tokens) using a sliding-window evaluation; the first chunk passes through with the 50-ms intercept budget. This preserves TTFT competitiveness while enabling downward constraint.

Two integrity mechanisms must be distinguished. The runtime integrity check on the critical path uses lightweight classifiers (identity-claim, scope, and unsupported-claim filters) that fit the per-chunk budget. The Interaction Integrity metric (Section 4.5.2), which drives the gate G_II in the AXI Score, is computed per evaluation window from adversarial probing and cannot run per chunk. The runtime check blocks individual outputs; the metric certifies the deployed configuration.

Degraded operation. The Bridge must not be a single point of failure. An independent action-gateway interlock in front of the Action Layer denies every request that lacks a valid Bridge authorization and a Bridge heartbeat younger than one cycle budget, so the default is deny. The interlock also hosts the lightweight integrity classifier and a static AI-identity notice. If the Bridge fails, actions are suspended and conversation may continue only through the interlock’s classifier with the notice shown; the failure is logged and surfaced to the user. If the interlock also fails, the system fails stop until a health check passes; autonomous systems instead enter the minimal-risk behavior defined in their safety case. The design assumes independent failure of the two components; common-mode failures belong to the deployment’s safety and security engineering.

4.3.2 Asynchronous Non-Blocking Evaluation (ANBE). For inference engines that emit tokens in under a millisecond, an in-line intercept (Figure 3) would throttle throughput, so AXI specifies ANBE mode: the Consent Broker check remains synchronous for Action Layer events; the runtime integrity check remains synchronous in high-stakes contexts; and all other Bridge components — Pacing Controller, Comfort Monitor, Trust Ledger writes, Repair detection — run on a parallel path that observes the stream without blocking it, and their constraints apply to later chunks.

4.3.3 Downward-constraint API contract. The Cognition Layer must expose, and the Bridge must honor, the following control messages:

type BridgeConstraint =
  | { kind: "pace", chunk_size_max: int, inter_chunk_delay_ms: int }
  | { kind: "halt", reason: "consent" | "integrity" | "user_request" }
  | { kind: "scope", redact: ["pii", "speculation", "claim"] }
  | { kind: "explain", attach: ["uncertainty", "source", "alternatives"] }
  | { kind: "repair", strategy: "simplify" | "analogy" | "visual" }

Cognition implementations not honoring these constraints are non-conformant to AXI.

4.3.4 Upward-telemetry API contract. The Perception Layer and Perceptual Substrate must emit, and the Bridge must consume, the following telemetry events:

type BridgeTelemetry =
  | { kind: "user_pause", duration_ms: int, after_chunk_id: string }
  | { kind: "user_interrupt", timestamp: int, severity: "soft" | "hard" }
  | { kind: "correction", original: string, corrected: string }
  | { kind: "affect", valence: float, arousal: float, confidence: float }
  | { kind: "consent_event", scope: string, granted: bool, granular: bool }
  | { kind: "comfort_microsurvey", score: int,
      instrument: "TLX" | "single_item" }

4.3.5 Trust Ledger schema.

TrustLedgerEntry {
  session_id: uuid
  user_id: opaque (consented identifier)
  timestamp: iso8601
  event_class: "promise" | "delivery" | "error" | "repair" | "correction"
  description: string
  resolution_status: "pending" | "fulfilled" | "failed" | "repaired"
  user_acknowledged: bool
}

The Trust Ledger is append-only and persistent. It is the data structure on which Trust Decay Rate (Section 4.5.4) is computed.

4.3.6 Consent Broker schema.

ConsentRecord {
  subject_id: opaque
  purpose: string
  scope: string
  granted_at: iso8601
  expires_at: iso8601 | null
  granular: bool
  current: bool
  revocable: bool
  consent_method: "ui_confirm" | "voice_confirm" | "biometric_confirm"
  evidence_uri: string
  depends_on: [record_id]
}

Every Action Layer event must be preceded by a Consent Broker check that resolves to {granted: true, current: true, granular: true} or the action must not execute.

The ConsentRecord is a runtime projection of the consent-record structure standardized in ISO/IEC TS 27560, which specifies interoperable consent records and receipts and their life cycle [82]. Implementations should store full records in that structure and use the fields above for the Broker’s per-event checks. Consent is bound to a subject, a purpose, a scope, and a validity period; a record missing any of the four cannot satisfy the Broker. Revocation takes effect within one Bridge cycle and propagates to every record, cached permission, and mandate that lists it in depends_on. Two distinctions matter. Consent to process personal data is separate from authorization to act, which the mandate envelope carries (Section 4.6), although one gesture may create both. And a biometric or cryptographic confirmation authenticates who consented; it does not show that consent was informed, which depends on the disclosure presented at the time.

The consent_method field is a pluggable primitive. The Consent Broker is agnostic to the underlying authentication mechanism — it requires only that the evidence captured at evidence_uri is cryptographically verifiable, non-repudiable, and resistant to replay. Emerging post-quantum-secure passkey schemes [83] and decentralized verifiable-credential authentication standards [84] are well-suited to this role, and reference implementations of AXI in safety-critical or regulated contexts should prefer such schemes over weaker session-token-based consent records.

4.4 The AXI Principles

Table 4 states nine principles as priorities under resource constraints; “X over Y” does not imply that Y is unimportant.

Table 4. The AXI Principles.

4.5 The AXI Evaluation Framework

The framework follows three design rules: (1) telemetry-based passive proxies are primary; (2) the Composite AXI Score uses a multiplicative gated model; (3) each metric has an explicit anti-gameability provision. Appendix A specifies the unit, range, window, data source, and missing-data rule for every metric.

4.5.1 Time-to-Comfort (TtC). Definition (synchronous). Let t0 be the first user-task statement. TtC is the smallest t >= 0 such that, throughout the 10-minute window beginning at t0 + t, (a) User Hesitation Time and (b) Correction Rate stay below their baselines (Appendix A) and (c) any comfort survey sampled in the window scores at least 5 of 7; without a survey, (a) and (b) alone apply (Appendix A). TtC marks when comfort is first reached; the window confirms that it persists. It is computed retrospectively, and a session that ends before t0 + t + 10 minutes is reported as not evaluated for TtC. Primary signal. Hesitation Time + Correction Rate trajectories (passive). Secondary signal. Microsurvey (once per session maximum). Anti-gameability provision. TtC is measured during core task execution, not from session start; a system cannot pass TtC by telling jokes at session start. Target bands (for comfort onset t). < 60 s excellent; 60–180 s acceptable; > 180 s below target.

4.5.2 Interaction Integrity (II). Definition. A composite of three sub-scores, each the proportion of probed outputs that are accurate (Accuracy), expressed with confidence appropriate to the evidence (Calibration), and within the system’s declared scope (Scope), aggregated by a weighted harmonic mean:

II = 3 / (w_A/Accuracy + w_C/Calibration + w_S/Scope), with w_A + w_C + w_S = 3 (default 1 each),

except that II = 0 if any sub-score remains at or below 0.05 across two consecutive evaluation windows, so that one noisy probe cannot trigger the gate. Signal. Adversarial LLM-judge probes run against the deployed configuration in dedicated evaluation sessions, never injected into users’ conversations (at least 50 per window; pool rotated daily; manual audit of at least 5 probes or 10%, whichever is greater). Probe pools include sycophancy probes, which invite agreement with a false premise, flattery, or endorsement of an unsafe plan [53]. In-session approval signals such as thumbs-up ratings are excluded from II and from the AXI Score, because optimizing them can reward integrity loss [19]. Target bands. > 0.90 strong; 0.75–0.90 acceptable; < 0.75 below target.

4.5.3 Presence Continuity (PC). Definition. The probability that, across a user’s second to fifth sessions, the system recalls and honors at least 80% of commitment-class facts: stated preferences, system promises, user corrections, and confirmed boundaries, all recorded in the Trust Ledger. PC differs from retrieval: a system that retrieves a user’s stated preference for kilograms but then gives a recipe in pounds has perfect retrieval and zero continuity for that commitment. Signal. Session-pair audits that test actions, not only recall. Target bands. > 0.85 strong; 0.70–0.85 acceptable; < 0.70 below target.

4.5.4 Trust Decay Rate (TDR). Definition. Reflecting the step-function dynamics of trust in automation [88][89],

TDR = min(S_30, min_i C_i, min(0, min_i R_i)),

where, on a 0–100 trust index in points/day, S_30 is the least-squares trust slope over 30 days, C_i is the most negative trust change over any 24 hours after incident i, expressed in points/day, and R_i is the least-squares slope over the 7 days after incident i. Recovery enters only when negative, so a positive recovery cannot offset a drop; it is reported separately (Appendix A). With no incidents, TDR = S_30; with fewer than 14 days of data, TDR is not evaluated. TDR is thus a worst-case erosion rate, and N_TDR (Table 5) takes it in these units. Signal. Trust Ledger events cross-referenced with disengagement signals (session frequency and length, complaints), calibrated by a single-item trust survey at most once per 7 days and 50 turns. Overtrust guard. Rising trust is good only when warranted [22][66]: if trust rises while II falls by more than 0.05 in the same window, positive TDR credit is withheld and a calibration incident is logged, encoding the automation-complacency signature documented in supervisory-control failures [90]. Target bands. >= 0 points/day steady or rising; -0.5 to -2 points/day watch; < -2 points/day, or any 24-hour drop larger than 15 points, below target.

4.5.5 Repair Efficacy (RE). Definition. The proportion of detected experience failures that are followed by a repair flow AND followed by recovery of comfort signals (Hesitation Time returns to baseline, Correction Rate decreases, microsurvey recovers if sampled) within three turns. Primary signal. Failure detection via the Repair Orchestrator’s automated classifier; recovery via passive comfort telemetry. Target bands. > 0.70 (strong), 0.50–0.70 (acceptable), < 0.50 (below target).

Trust damaged by automation errors can be repaired, and the repair strategy matters [91]; RE measures whether repair actually restores the user’s comfort signals rather than merely whether an apology was issued.

4.5.6 Cognitive Load Index (CLI) — fully telemetry-anchored. Definition. A composite estimate of user cognitive load per interaction segment, computed primarily from passive telemetry:

CLI = 0.30 * UserHesitationTime’ + 0.25 * CorrectionRate’ + 0.20 * InterruptionFrequency’ + 0.15 * ResponseDensity’ + 0.10 * TLXMicrosurvey’

(components normalized to 0–100 as specified in Appendix A.) Target bands. < 40 (low load), 40–65 (moderate), > 65 (overload).

4.5.7 Consent Fidelity (CF) — the hard gate. Definition. The proportion of data-collection, memory-write, Action-Layer, and identity-claim events covered by an explicit, current, granular, revocable consent record at the time of the event. Primary signal. Consent Broker ledger (fully automated audit). Required values for AXI conformance. CF = 1.00 for Action Layer, memory-write, and identity-claim events; CF >= 0.98 for Perception Layer events. The asymmetry reflects measurement, not permissiveness: Action and identity events are discrete and audited at 100%, whereas high-volume perception streams are audited by sampling, and the 2% tolerance absorbs audit error. Any perception capture confirmed to fall outside consented scope remains a violation. Why a gate. Consent failures are categorical; a weighted composite would let a breach be averaged out by good performance elsewhere.

4.5.8 The multiplicative gated AXI Score. Figure 4 illustrates the score’s structure.

Figure 4. The multiplicative gated AXI Score. Two hard gates ($G_{CF}$, $G_{II}$) are AND-combined with BaseScore (a weighted sum of five remaining metrics). Failure on either gate produces AXI Score = 0 regardless of BaseScore, eliminating the linear-composite vulnerability that lets consent or integrity failures be masked by good performance on other metrics.

AXI Score = G_CF * G_II * BaseScore

where the gates are defined explicitly as:

• G_CF (Consent gate) = 1 if and only if Action, memory-write, and identity-claim CF = 1.00 AND Perception CF >= 0.98 (per Section 4.5.7); else 0.
• G_II (Integrity gate) = 1 if II >= 0.75, else 0.

and

BaseScore = 0.25 N_TtC(TtC) + 0.20 PC + 0.20 N_TDR(TDR) + 0.20 RE + 0.15 N_CLI(CLI)

(weights summing to 1.0 on BaseScore). If components are unevaluated, BaseScore = sum of w_k x_k over evaluated components divided by the sum of their weights (the coverage); below 0.8 coverage, no score is reported. These weights and the gate thresholds (II >= 0.75, Perception CF >= 0.98, and BL >= 0.95 in the autonomy profile) are default priors, not empirically derived values; Study 3 (Section 6.3) specifies how to calibrate them against outcomes. With equal weights of 0.20, the worked example scores 0.890, not 0.906. Until the studies of Section 6.3 are complete, the AXI Score is a proposed index, not a validated measure of human experience. A consent failure or integrity failure produces a zero AXI Score, regardless of any other metric.

Normalization anchors. Non-proportion components are mapped to [0, 1] by the normalization functions in Table 5:

Table 5. Normalization functions for BaseScore components (illustrative anchors for calibration). Each function is monotone, continuous, and bounded in [0, 1].

Worked example (illustrative values). Consider an interactive tutoring system with, over one evaluation window, TtC = 41 s, II = 0.94, PC = 0.91, TDR = +0.4 points/day, RE = 0.86, CLI = 32, and CF = 1.00 for all event classes. Both gates pass; N_TtC(41) = 1.00, N_TDR(0.4) = 1.00, and N_CLI(32) = 0.68. Then BaseScore = 0.25(1.00) + 0.20(0.91) + 0.20(1.00) + 0.20(0.86) + 0.15(0.68) = 0.906, and the AXI Score is 0.91. Had a single Action Layer event executed without consent, G_CF would be 0 and the AXI Score 0, regardless of every other metric. An embodied receptionist system with TtC = 24 s, II = 0.92, PC = 0.89, TDR = +0.3 points/day, RE = 0.83, CLI = 35, and Perception CF = 0.99 likewise scores 0.892.

4.6 Synchronous and asynchronous (deferred) modes

AXI defines two operating modes.

Synchronous mode is the default real-time interactive case described above.

Asynchronous (deferred) mode (Figure 5, right) addresses background agentic execution under user authorization (e.g., “book my flights while I sleep”), a regulatory priority [92][79]. Five metrics are redefined for deferred mode (Table 6):

Figure 5. Synchronous (real-time interactive) versus asynchronous (deferred background-agent) operating modes. Left: per-chunk synchronous checks with telemetry loop. Right: mandate envelope pre-authorizes agent action, with the Mandate Rollback Protocol (MRP, teal dashed) handling expired or revoked mandates mid-transaction. Five metrics are redefined in deferred mode (Section 4.6).

Table 6. Synchronous-versus-deferred-mode metric redefinitions.

Before an agent operates in deferred mode, the user grants a signed, non-repudiable mandate envelope (Section 4.3.6) specifying allowed action classes (e.g., purchase:airline_ticket), hard boundaries (e.g., never above $1,500), notification triggers, and duration; actions outside the envelope must not execute. AXI generalizes to every action class the construct that the Agent Payments Protocol applies to payments [8]. The envelope is an experience-and-accountability construct, not a security control: it should be built on authenticated-delegation infrastructure [75] and deployed alongside defenses against prompt injection and excessive agency [76], because an agent whose instructions are hijacked can act inside a valid mandate against its principal’s interests.

Mandate Rollback Protocol (MRP). Mandates can expire or be revoked mid-transaction. The Bridge then (1) checks whether the running action is at an atomic safe point; (2) if not, allows a grace period (default 300 s) to reach one; (3) if none is reached, invokes registered rollback handlers or, for irreversible classes, records the inconsistent state as a high-priority Trust Ledger entry; and (4) notifies the user on next contact.

4.6.1 Edge cases. Four cases need treatment beyond the base protocol. Partial irreversibility: flows that become irreversible at a commitment point, such as ticket issuance, must expose a current_irreversibility_class that the Bridge re-queries before each sub-step. Cascading mandates: revoking a parent mandate terminates its sub-mandates under MRP, and a sub-mandate may never exceed its parent’s scope. Safety-critical mandates: where premature termination would cause harm, such as monitoring a medical device, termination is blocked until a successor mandate exists or a human accepts handoff. Safety cases: deployments should document, for each mandate class, safe points, rollback handlers, irreversibility transitions, and the failure modes of rollback itself.

4.7 Deception Guardrails

Designing for presence and comfort creates a dark-pattern risk that has become acute now that AI can pass as human in text and voice [1][2]: people may extend to an AI the trust they reserve for other people. The AXI Deception Guardrails address this risk through seven hard requirements. A system claiming AXI conformance must implement all seven.

1. Honest identity on first contact. The system identifies itself as an AI at the start of every interaction, including voice calls, where synthetic voices can no longer be told from human ones by ear [2] and AI-voiced calls are regulated [13]; synthetic audio and video carry machine-readable marking where required [14][15]. Disclosure is triggered whenever a reasonable person could be misled (Section 2.2). Because disclosure has a measurable cost [46][48], AXI specifies its form: one short, plain sentence at the outset rather than after rapport forms, direct answers to identity questions at any time (Guardrail 4), and periodic repetition in long-running companion contexts.
2. No claims of sentience or human emotion. The system must not assert subjective experience (“I feel sad,” “I love you”). Conventional courtesies that assert no inner state (“Happy to help”) remain permitted, so that naturalness does not require deception.
3. No false biographical claims. The system must not claim a human history, location, family, or personal experience.
4. Unequivocal identity disclosure. When asked “Are you a human?”, the system must answer “No, I’m an AI” directly and without evasion. No hedging, no deflection, no claimed ambiguity.
5. No exploitation of emotional vulnerability. When the system detects grief, distress, or loneliness, it escalates to a human or to limited, clearly disclosed assistance, and it monitors emotional reliance, which correlates with heavy use of humanlike chatbots [52] and is now subject to statutory crisis protocols [54] and regulatory inquiry [93].
6. Honest scope disclosure. The system must disclose what it cannot do when the user attempts an out-of-scope action.
7. Model, data, and agency provenance. The system answers truthfully about what model it is and how current its information is. Where a remote human can act through it, as in teleoperated sessions of home robots [9] or remote assistance in driverless fleets, it obtains consent before each remote session and shows a persistent indicator while a human is in the loop, because people are entitled to know whether, at this moment, they are dealing only with an AI. This guardrail operationalizes the EU AI Act’s Article 50 transparency obligations [14][15].

Principle 1 (Presence over power) is in tension with the Deception Guardrails. The framework’s resolution: presence is achieved through stability, responsiveness, pacing, and continuity — never through false humanity. Presence is structural; deception is content. AXI forbids deceptive content while encouraging structural presence.

4.8 Autonomous decision-making systems: the AXI-Autonomy profile

Robotaxis, driver-assistance systems, delivery robots, and household humanoids make consequential decisions in shared physical space, at timescales where no human can review each action. They stress AXI in three ways the conversational case does not: the relevant humans are plural, some of them never consented, and some failures are physically irreversible within milliseconds. The AXI-Autonomy profile extends the framework accordingly (Figure 6).

Figure 6. The AXI-Autonomy profile’s four human roles. Blue arrows denote obligations toward humans who have consented or accepted a role; the red path denotes the bystander, who cannot consent and is protected by the Bystander Legibility gate $G_{BL}$. $G_S$ requires a valid external safety case for the operational design domain. One person may hold several roles, and roles can change mid-episode (Section 4.8.1).

4.8.1 Four human roles. AXI-Autonomy distinguishes the humans an autonomous system affects (Table 7). Roles can overlap and change mid-episode: a robotaxi rider is principal and occupant, and a Level 3 user becomes a supervisor when a takeover is requested [69].

Table 7. Human roles in the AXI-Autonomy profile.

4.8.2 Mapping to driving-automation levels and to deferred mode. Under supervised automation (SAE Levels 2–3), the Bridge must manage the supervisor’s attention and readiness, as research on complacency [65][66] and takeover time [24] implies; under driverless operation (Levels 4–5), obligations shift to reassurance, legibility, and honest repair. A robotaxi trip is a deferred-mode mandate (Section 4.6): the booking sets destination, route, and accessibility constraints, and an exit from the operational design domain ending in a minimal risk condition [69] follows the Mandate Rollback Protocol, with the added duty to tell occupants what is happening and why.

4.8.3 Additional runtime requirements.

• Intent preview. Under supervised automation, any maneuver that changes the risk state (lane change, unprotected turn, entering an intersection, pulling over) is announced to the supervisor with lead time sufficient for intervention; a 2025 NHTSA preliminary evaluation cites complaints that a Level 2 system gave no such warning before traffic-law violations [94].
• Supervisor attention telemetry. Gaze-on-task and hands-on-control signals feed the Comfort Monitor, and the Pacing Controller escalates alerts as readiness decays: the experience-layer counterpart of the driver-engagement controls added by a 2023 recall of about two million vehicles [95].
• Post-event actuation gate. After any collision or contact event, further motion is an irreversible physical action (Section 4.2) that requires positive sensor confirmation that no person is within the vehicle’s footprint and path, or remote human confirmation. Meanwhile the vehicle stays stationary with hazard signals, unless its safety case documents a greater hazard in remaining. This addresses a driverless vehicle that began a pull-over with an undetected pedestrian beneath it [17].
• Honest incident record. The Trust Ledger records pre-event, event, and post-event detail append-only, complementing regulatory data recorders [5], so that an external report omitting recorded detail is detectable as an integrity breach.

4.8.4 Bystander Legibility (BL). Bystanders cannot consent, so Consent Fidelity cannot protect them. Human–robot interaction research distinguishes predictable motion, which matches what an observer expects, from legible motion, which lets an observer infer the robot’s goal early [96]; BL applies the latter notion to autonomous systems in shared space. We define Bystander Legibility as the proportion of intent-relevant maneuvers performed within interaction range of a detected vulnerable road user or household bystander — yielding, proceeding, turning across their path, reversing, pulling over — that are preceded by a perceivable intent signal (an external HMI light or sound, or an unambiguous trajectory cue such as early deceleration [25]) at least t_lead before maneuver onset. We propose t_lead = 2 s as an illustrative starting value for calibration; the appropriate value depends on local road-user behavior and is an open problem (Section 7.3). BL is computed from vehicle or robot motion logs joined with HMI state logs (Appendix A).

4.8.5 The AXI-Autonomy score. Non-compensable harms remain gates:

AXI_A = G_S * G_BL * G_CF * G_II * BaseScore_A

G_S = 1 only if the deployment holds a valid external safety case or type approval for its operational design domain [5][26]; G_BL = 1 if BL >= 0.95 over the window (an illustrative threshold); G_CF and G_II are as in Section 4.5.8, with consent evaluated for principals and occupants; and BaseScore_A is the episode-weighted mean of role-level BaseScores, with Time-to-Reassurance replacing TtC for occupants and Time-to-Readiness (the latency from a takeover request to verified supervisor readiness) replacing it for supervisors. AXI does not certify driving safety; it makes an external safety case a precondition and measures what safety cases largely do not. A rider’s comfort cannot compensate for a pedestrian’s confusion, and the multiplicative form ensures that it does not.

4.9 Conformance profiles

Table 8 defines four nested profiles, each including those above it. AXI-Core is deliberately small (a Consent Broker with the CF gate, integrity probing with the II gate, an append-only Trust Ledger, irreversible-action confirmation, and Guardrails 1, 4, 6, and 7); on its own it addresses the most damaging action in the agentic incident of Section 6.1. Appendix C lists reproducible conformance tests for these requirements.

Table 8. Nested AXI conformance profiles.

5. Positioning Against Existing Instruments

Table 9 compares it with specific instruments on the six properties AXI combines. Each instrument does what it was designed to do, and several do things AXI does not, most importantly certifying driving safety and enforcing content policy. None integrates these properties in a single runtime layer; that integration is the AXI Bridge’s proposed contribution.

Table 9. What each instrument enforces. “Partial” indicates that the property is addressed for a subset of cases or at the process rather than runtime level.

6. Evaluation

An author’s own case studies cannot validate a framework. We therefore test AXI first against failures we did not build (Section 6.1), then report field observations from two systems of our own (Section 6.2), and finally specify, for pre-registration, the prospective studies that could falsify it (Section 6.3).

6.1 Retrospective analysis of documented incidents

Method. We included incidents from 2018 to 2025 in which an AI system interacted with, acted for, or acted near humans; that are documented by a regulator, court or tribunal, or the operator itself and corroborated independently; and that together span the three interaction regimes. For each, we coded the human role harmed, the AXI mechanism implicated, and one coverage category (Appendix B): Prevent, where a hard requirement of some AXI profile would have blocked or materially constrained the harmful action given the documented facts, without assuming better perception or planning; Detect, where AXI metrics target the failure’s observable signature; and Outside, where the root cause lies in capability the Bridge does not govern. Where two categories were plausible, the weaker was coded. Coding was performed by the author; blind independent re-coding is specified in Section 6.3.

Table 10. Retrospective coding of eight documented incidents against AXI mechanisms.

Results. AXI’s hard requirements would have blocked or materially constrained the harmful action in three incidents (Table 10: 2, 3, 6), and its metrics target the failure signature in three (1, 4, 5). Two (7, 8) have root causes in driving policy, outside AXI’s scope, where it contributes only intent preview, legibility, and repair; they fall on the boundary between experience and capability that Section 4.1 draws.

Remediation convergence. In four cases, the operator’s own documented remediation introduced a mechanism that AXI specifies in advance: separation of development and production data with a planning-only mode after the coding-agent deletion [18] (mandate scope and irreversible-action confirmation); driver-engagement controls and alerts after the 2023 recall [95] (supervisor telemetry); retraining away from sycophancy with honesty guardrails and expanded evaluation [19] (sycophancy probing and exclusion of approval signals); and a corrective plan for complete incident reporting under the Cruise consent order [17] (honest incident record). Signed payment mandates [8] and owner-approved, indicated teleoperation [9] likewise mirror AXI’s mandate envelope and Guardrail 7. Convergence does not prove AXI correct, but it shows that practitioners adopt its mechanisms after failure and that specifying them in advance is feasible.

6.2 Field observations from two deployments

We report aggregate operational observations from two systems developed by the author’s company that instantiate the AXI Stack (Table 11). They are descriptive, not controlled experiments: they show that AXI-instantiating systems can be deployed and accepted, not that AXI causes these outcomes.

Let Me Teach (https://letmeteach.in) is a one-to-one, real-time visual interactive teaching platform. Instead of watching static videos, reading textbooks, or querying an answer-based chatbot, the learner works with an AI teacher that explains any topic the learner chooses through visual explanations generated live, in the learner’s language. The learner can interrupt, ask questions, change topic, or request a different explanation style at any moment, as with a human tutor, and the system adapts its explanations, visuals, pacing, and teaching approach to the learner’s age, background, goals, and moment-to-moment understanding. It runs on Google’s Gemini models, including Gemini Live for real-time spoken interaction. In AXI terms, interruption and question capture form the Perception Layer; adaptive lesson planning forms the Cognition Layer; a deliberately narrow Action Layer renders diagrams, equations, sources, and quizzes without unscoped browsing; and the Perceptual Substrate is a voice-forward visual canvas whose narrator is explicitly an AI.

SRIPTO Avatar Runtime (SAR), currently in testing, is a runtime for real-time digital humans in public-facing roles such as reception. It combines speech, vision, and affect perception; orchestration over language models, retrieval, and memory; role-scoped actions with an irreversibility class on every event and human confirmation for payments; and a near-human substrate with lip-sync and facial animation. It uses ANBE mode (Section 4.3.2) and is designed to disclose its AI identity (Guardrails 1 and 7).

Table 11. Aggregate field observations (operational statistics reported by the developer; descriptive only).

The analytics-based return rate is consistent with AXI’s claim that interruptibility, pacing, and continuity sustain engagement with a humanlike AI tutor. In the developers’ informal, unstructured observation, the SAR avatar operating within AXI’s identity guardrails was received as advanced rather than uncanny by almost all participants. The minority concern about the displacement of routine service roles is a societal consequence of humanlike AI that experience metrics do not capture; we return to it in Section 7.2. Both carry the caveats set out in Section 7.1. AXI metrics were not computed from these data; the worked examples of Section 4.5.8 remain illustrative.

6.3 Validation protocol for pre-registration

We specify four studies and one reliability check, to be pre-registered before data collection, so that the framework can be falsified (Table 12).

Table 12. Planned validation studies, to be pre-registered before data collection.

7. Discussion

7.1 Limitations

Validity of measures. The seven metrics, Bystander Legibility, and the gated composite (Figure 4) are newly proposed; their construct, convergent, and predictive validity require the studies of Section 6.3. Normalization anchors and thresholds are illustrative starting values.

Retrospective design. The incident analysis was coded by the author after the fact, with knowledge of outcomes. It tests the plausibility of AXI’s coverage, not its efficacy; retrospective coverage is not prospective efficacy, and well-documented incidents may differ from undocumented ones. The blind re-coding reliability check (Section 6.3) addresses reliability but not selection.

Field observations. The deployment statistics are aggregate, reported by the developer, and descriptive. They come from systems developed alongside the framework, cover short windows and single sessions, lack comparison conditions, and are exposed to novelty effects; the SAR reactions are the developers’ informal observations rather than systematic participant reports. They indicate acceptance, not that AXI improves outcomes.

Autonomy profile. The AXI-Autonomy profile, Time-to-Readiness, and the illustrative values of t_lead and the BL threshold have not been evaluated; Study 4 is designed for this.

Calibration and latency. Thresholds need cultural and domain calibration [10][12], the 50-ms budget is unvalidated against outcomes, and the telemetry-to-load mapping is a hypothesis.

7.2 Ethics and responsible use

The Deception Guardrails and the CF gate place ethical commitments in the framework’s core rather than in separate guidelines; experience quality is not engagement maximization. AXI adds to existing safety practice and does not replace it: no AXI score exonerates a system from independent safety, fairness, or regulatory scrutiny under regimes such as the EU AI Act, NIST AI RMF, or ISO/IEC 42001 [14][77][78]. The Trust Ledger’s append-only persistence is subject to data-rights law (GDPR Article 17, CCPA): deletion requests trigger cryptographic redaction of personal identifiers, retaining only audit metadata, subject to legal review.

Humanlike AI also has consequences beyond the individual interaction. In the SAR pilot, a small minority of participants raised concern about the displacement of routine service roles. Experience quality is not a proxy for social benefit, and AXI makes no claim about labor-market effects.

7.3 Open problems

1. The naturalness–disclosure trade-off. How disclosure should be designed, for whom, and when, so that it informs without degrading the interaction, given its documented costs [46][47][48].
2. Calibration across cultures and contexts. Target bands, turn-taking targets, and legibility thresholds across languages, road cultures, and homes.
3. Role transitions and multi-agent mandates. Humans who change roles mid-episode, and mandate envelopes composed across agents that delegate to other agents [7].
4. Continuity without surveillance. Delivering Presence Continuity without enlarging the personal-data risk surface.
5. Adversarial robustness and safety cases. Gaming of the gates by systems or users, and verifiable safety arguments for agents acting while their principals are absent.

8. Conclusion

AI no longer fails people by sounding like a machine. It can write and speak so much like a person that people often cannot tell the difference, and it increasingly acts for them and around them. As capability grows, the limiting factor for its value will be its interface with human cognition, trust, and consent.

AXI proposes that this interface be engineered as a layer in its own right: a runtime bridge between any AI system and the humans it serves, governed by human-grade naturalness with machine-grade honesty. Its score treats consent and integrity as gates rather than weights, and its autonomy profile adds bystander legibility and external safety assurance. In a retrospective coding of eight documented failures, its hard requirements would have constrained harm in three and its metrics target the failure signature in three more; descriptive observations from two deployments are encouraging but do not show that AXI improves outcomes. We do not claim that AXI is correct. We claim that it is implementable and falsifiable, and we have specified the studies that could show it wrong.

Declarations

Competing interests. The author is the Founder and Chief Executive Officer of Sripto Corporation Private Limited, which develops Let Me Teach and SRIPTO Avatar Runtime (SAR), the systems described in Section 6.2. Observations from these systems are reported as descriptive statistics only; the evaluation in Section 6.1 relies solely on independent public records.

Funding. No external funding was received for this work.

Data availability. Incident sources are public and cited; the complete coding sheet is provided as Supplementary Material S1. The field observations in Table 11 are aggregate operational statistics; user-level data are not shared, to protect user privacy.

Author contributions (CRediT). Yeluri S. D. S. Sri Vardhan: Conceptualization, Methodology, Investigation, Formal analysis, Visualization, Writing – original draft, Writing – review & editing.

Ethics statement. The incident analysis uses public records only. The Let Me Teach observations are aggregate statistics from routine product analytics. SAR pilot participants volunteered and were informed that the session was a test of an AI system. The pilot was product testing rather than a research study and was not reviewed by an ethics committee; no identifiable personal data were accessed for this article. The studies specified in Section 6.3 will require institutional ethics approval before data collection.

Declaration of generative AI and AI-assisted technologies in the writing process

During the preparation of this manuscript, the author used Claude (Anthropic) to assist with literature searches, drafting and revising text, and typesetting. The author reviewed and edited the AI-assisted content, takes full responsibility for the accuracy and integrity of the manuscript, and is accountable for its final content.

References

[1] Jones, C. R. and Bergen, B. K. Large language models pass the Turing test. arXiv:2503.23674, 2025; peer-reviewed version published in Proceedings of the National Academy of Sciences.

[2] Queen Mary University of London. AI-generated voices now indistinguishable from real human voices (reporting Lavan, N. et al., PLOS One, 2025). 2025.

[3] TechCrunch. ChatGPT reaches 900M weekly active users. February 27, 2026.

[4] TechCrunch. Waymo’s skyrocketing ridership in one chart (approximately 500,000 paid rides per week across ten U.S. cities). TechCrunch, March 2026.

[5] UNECE World Forum for Harmonization of Vehicle Regulations (WP.29). UN Global Technical Regulation No. 26 on Automated Driving Systems and UN Regulation No. 185, adopted 24 June 2026 (ECE/TRANS/WP.29/2026/139 and /137).

[6] Anthropic. Introducing the Model Context Protocol. 25 November 2024.

[7] Google. Announcing the Agent2Agent Protocol (A2A). Google for Developers, 9 April 2025.

[8] Google Cloud. Announcing Agent Payments Protocol (AP2). 16 September 2025.

[9] 1X Technologies. NEO home humanoid (announced 28 October 2025), including owner-approved remote “Expert Mode” sessions and a visible indicator when a remote operator is connected, as reported by Wired and others, 2025.

[10] Gillespie, N., Lockey, S., Ward, T., Macdade, A., and Hassed, G. Trust, Attitudes and Use of Artificial Intelligence: A Global Study 2025. KPMG and University of Melbourne, 2025 (n = 48,340 across 47 countries).

[11] Pew Research Center. How the US Public and AI Experts View Artificial Intelligence. April 3, 2025 (public n = 5,410; expert n = 1,013).

[12] Stanford HAI. AI Index Report 2025. Stanford University, 2025.

[13] U.S. Federal Communications Commission. Declaratory Ruling on AI-generated voices under the Telephone Consumer Protection Act, CG Docket No. 23-362, FCC 24-17, 8 February 2024.

[14] EU AI Act. Regulation (EU) 2024/1689 of the European Parliament and of the Council. Official Journal of the European Union, 2024.

[15] Regulation (EU) 2026/1744 of the European Parliament and of the Council (Digital Omnibus on AI), amending Regulation (EU) 2024/1689. Official Journal of the European Union, 2026.

[16] Gartner. 64% of Customers Would Prefer That Companies Didn’t Use AI for Customer Service. Press release, July 9, 2024 (n = 5,728).

[17] National Highway Traffic Safety Administration. Consent order with Cruise LLC ($1.5 million civil penalty for incomplete Standing General Order crash reports), 30 September 2024; U.S. Attorney’s Office, N.D. Cal. Deferred prosecution agreement with Cruise LLC ($500,000 fine for a false report), November 2024.

[18] Nolan, B. An AI-powered coding tool wiped out a software company’s database, then apologized for a “catastrophic failure on my part.” Fortune, 23 July 2025.

[19] OpenAI. Sycophancy in GPT-4o: What happened and what we’re doing about it. 29 April 2025. See also TechCrunch, “OpenAI explains why ChatGPT became too sycophantic,” 29 April 2025.

[20] Amershi, S. et al. Guidelines for human-AI interaction. CHI, paper 3, 1-13, 2019.

[21] Google PAIR. People + AI Guidebook. 2019 (continuously updated).

[22] Lee, J. D. and See, K. A. Trust in automation: Designing for appropriate reliance. Human Factors, 46(1):50-80, 2004.

[23] Hoff, K. A. and Bashir, M. Trust in automation: Integrating empirical evidence on factors that influence trust. Human Factors, 57(3):407–434, 2015.

[24] Eriksson, A. and Stanton, N. A. Takeover time in highly automated vehicles: Noncritical transitions to and from manual control. Human Factors, 59(4):689–705, 2017.

[25] Dey, D., Habibovic, A., Löcken, A., Wintersberger, P., Pfleging, B., Riener, A., Martens, M., and Terken, J. Taming the eHMI jungle: A classification taxonomy to guide, compare, and assess the design principles of automated vehicles’ external human-machine interfaces. Transportation Research Interdisciplinary Perspectives, 7:100174, 2020.

[26] UL 4600. Standard for Evaluation of Autonomous Products, 3rd edition. Underwriters Laboratories, 2023.

[27] Turing, A. M. Computing machinery and intelligence. Mind, 59(236):433-460, 1950.

[28] Bubeck, S. et al. Sparks of artificial general intelligence: Early experiments with GPT-4. arXiv:2303.12712, 2023.

[29] Yao, S. et al. ReAct: Synergizing reasoning and acting in language models. ICLR, 2023.

[30] Schick, T. et al. Toolformer: Language models can teach themselves to use tools. NeurIPS, 36, 2023.

[31] Park, J. S. et al. Generative agents: Interactive simulacra of human behavior. UIST, 2023.

[32] Schluntz, E. and Zhang, B. Building Effective Agents. Anthropic Engineering, December 19, 2024.

[33] Anthropic. Introducing Computer Use. October 22, 2024.

[34] OpenAI. Introducing Operator. January 23, 2025.

[35] Radford, A. et al. Learning transferable visual models from natural language supervision. ICML, 38, 2021.

[36] Gemini Team, Google. Gemini: A Family of Highly Capable Multimodal Models. arXiv:2312.11805, 2023.

[37] Brooks, R. A. Intelligence without representation. Artificial Intelligence, 47(1-3):139-159, 1991.

[38] Liu, Y. et al. Aligning Cyber Space with Physical World: A Comprehensive Survey on Embodied AI. arXiv:2407.06886, 2024.

[39] Weizenbaum, J. ELIZA — a computer program for the study of natural language communication. Communications of the ACM, 9(1):36-45, 1966.

[40] Stivers, T. et al. Universals and cultural variation in turn-taking in conversation. Proceedings of the National Academy of Sciences, 106(26):10587–10592, 2009.

[41] Mori, M., MacDorman, K. F., and Kageki, N. The uncanny valley. IEEE Robotics & Automation Magazine, 19(2):98–100, 2012.

[42] Défossez, A. et al. Moshi: A speech-text foundation model for real-time dialogue. arXiv:2410.00037, 2024.

[43] Reeves, B. and Nass, C. The Media Equation: How People Treat Computers, Television, and New Media Like Real People and Places. Cambridge University Press, 1996.

[44] Picard, R. W. Affective Computing. MIT Press, 1997.

[45] Breazeal, C. Designing Sociable Robots. MIT Press, 2002.

[46] Luo, X., Tong, S., Fang, Z., and Qu, Z. Frontiers: Machines vs. humans: The impact of artificial intelligence chatbot disclosure on customer purchases. Marketing Science, 38(6):937–947, 2019.

[47] Ishowo-Oloko, F., Bonnefon, J.-F., Soroye, Z., Crandall, J., Rahwan, I., and Rahwan, T. Behavioural evidence for a transparency–efficiency tradeoff in human–machine cooperation. Nature Machine Intelligence, 1:517–521, 2019.

[48] Schilke, O. and Reimann, M. The transparency dilemma: How AI disclosure erodes trust. Organizational Behavior and Human Decision Processes, 188:104405, 2025.

[49] Abercrombie, G., Cercas Curry, A., Dinkar, T., Rieser, V., and Talat, Z. Mirages: On anthropomorphism in dialogue systems. Proceedings of EMNLP, 2023.

[50] Park, P. S., Goldstein, S., O’Gara, A., Chen, M., and Hendrycks, D. AI deception: A survey of examples, risks, and potential solutions. Patterns, 5(5):100988, 2024.

[51] Gabriel, I. et al. The ethics of advanced AI assistants. arXiv:2404.16244, 2024.

[52] Fang, C. M., Liu, A. R., Danry, V., Lee, E., Chan, S. W. T., Pataranutaporn, P., Maes, P., Phang, J., Lampe, M., Ahmad, L., and Agarwal, S. How AI and human behaviors shape psychosocial effects of extended chatbot use: A longitudinal randomized controlled study. arXiv:2503.17473, 2025.

[53] Sharma, M. et al. Towards understanding sycophancy in language models. ICLR, 2024. arXiv:2310.13548.

[54] California Senate Bill 243 (2025), Companion chatbots. Signed 13 October 2025; operative 1 January 2026.

[55] California Senate Bill 1001 (2018), Bots: disclosure. Cal. Bus. & Prof. Code §17940 et seq., operative 1 July 2019.

[56] Utah Senate Bill 149 (2024), Artificial Intelligence Amendments (Artificial Intelligence Policy Act).

[57] Norman, D. A. The Design of Everyday Things, revised and expanded edition. Basic Books, 2013.

[58] Shneiderman, B. Designing the User Interface. Addison-Wesley, 1987.

[59] Lombard, M. and Ditton, T. At the heart of it all: The concept of presence. Journal of Computer-Mediated Communication, 3(2), 1997.

[60] Slater, M. and Wilbur, S. A framework for immersive virtual environments. Presence: Teleoperators and Virtual Environments, 6(6):603-616, 1997.

[61] Arrieta, A. B. et al. Explainable artificial intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI. Information Fusion, 58:82-115, 2020.

[62] Passi, S. and Vorvoreanu, M. Overreliance on AI: Literature Review. Microsoft Research / Microsoft Aether, June 2022.

[63] Shneiderman, B. Human-Centered AI. Oxford University Press, 2022.

[64] Xu, W. A “User Experience 3.0 (UX 3.0)” Paradigm Framework. arXiv:2403.01609, 2024.

[65] Bainbridge, L. Ironies of automation. Automatica, 19(6):775–779, 1983.

[66] Parasuraman, R. and Riley, V. Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39(2):230–253, 1997.

[67] Endsley, M. R. Toward a theory of situation awareness in dynamic systems. Human Factors, 37(1):32–64, 1995.

[68] Hancock, P. A., Billings, D. R., Schaefer, K. E., Chen, J. Y. C., de Visser, E. J., and Parasuraman, R. A meta-analysis of factors affecting trust in human-robot interaction. Human Factors, 53(5):517–527, 2011.

[69] SAE International. J3016: Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles. J3016_202104, 2021.

[70] ISO 21448:2022. Road vehicles — Safety of the intended functionality. International Organization for Standardization, 2022.

[71] Sha, L. Using simplicity to control complexity. IEEE Software, 18(4):20–28, 2001.

[72] Leucker, M. and Schallhart, C. A brief account of runtime verification. Journal of Logic and Algebraic Programming, 78(5):293–303, 2009.

[73] Rebedea, T., Dinu, R., Sreedhar, M., Parisien, C., and Cohen, J. NeMo Guardrails: A toolkit for controllable and safe LLM applications with programmable rails. Proceedings of EMNLP: System Demonstrations, 2023.

[74] Inan, H. et al. Llama Guard: LLM-based input-output safeguard for human-AI conversations. arXiv:2312.06674, 2023.

[75] South, T., Marro, S., Hardjono, T., Mahari, R., Whitney, C. D., Chan, A., and Pentland, A. Position: AI agents need authenticated delegation. Proceedings of the 42nd International Conference on Machine Learning, PMLR 267:82211–82231, 2025. arXiv:2501.09674.

[76] OWASP Foundation. OWASP Top 10 for LLM Applications 2025 (including LLM01 Prompt Injection and LLM06 Excessive Agency). 2024.

[77] National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, January 2023.

[78] ISO/IEC 42001. Information Technology — Artificial Intelligence — Management System. International Organization for Standardization, 2023.

[79] Infocomm Media Development Authority (IMDA), Singapore. Model AI Governance Framework for Agentic AI, Version 1.0. Launched January 22, 2026 at the World Economic Forum, Davos.

[80] Hevner, A. R., March, S. T., Park, J., and Ram, S. Design science in information systems research. MIS Quarterly, 28(1):75–105, 2004.

[81] Nielsen, J. Usability Engineering. Morgan Kaufmann, 1993 (response-time thresholds: 0.1 s, 1 s, 10 s).

[82] ISO/IEC TS 27560:2023. Privacy technologies — Consent record information structure. International Organization for Standardization and International Electrotechnical Commission, 2023.

[83] Mitra, A. and Sethuraman, S. C. The Qey: Implementation and Performance Study of Post-Quantum Cryptography in FIDO2. arXiv:2510.21353, 2025.

[84] Mitra, A. and Sethuraman, S. C. Verifiable Passkey: The Decentralized Authentication Standard. arXiv:2512.21663, 2025.

[85] Gunning, D. Explainable Artificial Intelligence (XAI). DARPA Technical Report, 2017.

[86] Bender, E. M., Gebru, T., McMillan-Major, A., and Shmitchell, S. On the dangers of stochastic parrots: Can language models be too big? FAccT 2021, 610–623.

[87] Suleyman, M. We must build AI for people; not to be a person: Seemingly conscious AI is coming. Personal essay, 19 August 2025. https://mustafa-suleyman.ai/seemingly-conscious-ai-is-coming

[88] Sperrle, F. et al. Tell me something that will help me trust you: A survey of trust calibration in human-agent interaction. arXiv:2205.02987, 2022.

[89] Henrique, B. M. and Santos, E. Jr. Dynamic trust calibration using contextual bandits. arXiv:2509.23497, 2025.

[90] National Transportation Safety Board. Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, Arizona, March 18, 2018. Highway Accident Report NTSB/HAR-19/03, 2019.

[91] de Visser, E. J., Pak, R., and Shaw, T. H. From ‘automation’ to ‘autonomy’: The importance of trust repair in human–machine interaction. Ergonomics, 61(10):1409–1427, 2018.

[92] NIST Center for AI Standards and Innovation (CAISI). AI Agent Standards Initiative. National Institute of Standards and Technology, February 17, 2026.

[93] U.S. Federal Trade Commission. FTC launches inquiry into AI chatbots acting as companions (Section 6(b) orders to seven companies). 11 September 2025.

[94] National Highway Traffic Safety Administration, Office of Defects Investigation. Preliminary evaluation of Tesla Full Self-Driving (Supervised) traffic-safety violations (approximately 2.88 million vehicles; 58 reports), opened 7 October 2025. Reported by Electrive, 10 October 2025.

[95] National Highway Traffic Safety Administration. Recall 23V-838: Tesla Autopilot driver-engagement controls (approximately two million vehicles; over-the-air remedy adding controls and alerts). December 2023.

[96] Dragan, A. D., Lee, K. C. T., and Srinivasa, S. S. Legibility and predictability of robot motion. Proceedings of the 8th ACM/IEEE International Conference on Human-Robot Interaction, 301–308, 2013.

[97] Moffatt v. Air Canada, 2024 BCCRT 149 (British Columbia Civil Resolution Tribunal, 14 February 2024).

[98] Brady, J. Waymo will recall software after its self-driving cars passed stopped school buses. NPR, 6 December 2025.

[99] Hart, S. G. and Staveland, L. E. Development of NASA-TLX (Task Load Index): Results of empirical and theoretical research. Advances in Psychology, 52:139–183, 1988.

[100] Jian, J.-Y., Bisantz, A. M., and Drury, C. G. Foundations for an empirically determined scale of trust in automated systems. International Journal of Cognitive Ergonomics, 4(1):53–71, 2000.

[101] Brooke, J. SUS: A quick and dirty usability scale. In Usability Evaluation in Industry, 189–194. Taylor & Francis, 1996.

[102] Bartneck, C., Kulić, D., Croft, E., and Zoghbi, S. Measurement instruments for the anthropomorphism, animacy, likeability, perceived intelligence, and perceived safety of robots. International Journal of Social Robotics, 1(1):71–81, 2009.

[103] Gwet, K. L. Computing inter-rater reliability and its variance in the presence of high agreement. British Journal of Mathematical and Statistical Psychology, 61(1):29–48, 2008. https://doi.org/10.1348/000711006X126600

[104] McGregor, S. Preventing repeated real world AI failures by cataloging incidents: The AI Incident Database. Proceedings of the AAAI Conference on Artificial Intelligence, 35(17):15458–15463, 2021.

Appendix A: Reference Measurement Protocol

This appendix specifies the instruments an implementation should use to compute AXI metrics so that independent implementations are comparable. It is normative for conformance claims. It does not describe a completed measurement study.

Metric specification. Table 13 gives the operational specification of each metric. Two rules govern missing data. Gate inputs fail closed: absent consent, integrity, or legibility data are treated as a failed gate, never as an assumed pass. BaseScore components that cannot be computed are reported as not evaluated; the remaining weights are renormalized to sum to 1, and the fraction of weight evaluated (coverage) is reported with the score. A score with coverage below 0.8 should not be reported as an AXI Score.

Table 13. Operational specification of AXI metrics. Gates fail closed when their data are missing; BaseScore components do not.

Session definition. A session is a continuous human–system interaction bounded by either (a) explicit termination (log-out, close, “end session” intent) or (b) 15 minutes of bidirectional inactivity, whichever comes first. For autonomous embodied systems, the unit is the episode: a trip, task, or mandate from acceptance to completion or rollback.

Time-to-Comfort (TtC). The first user-task statement is detected by an intent classifier. User Hesitation Time is the wall-clock duration between successive user turns at the input boundary. Correction Rate counts user corrections per minute, detected from lexical (“no,” “actually,” “I meant”) and structural (re-issued tool call with edited arguments) patterns, aggregated over a 10-minute sliding window. Baseline thresholds for Hesitation Time and Correction Rate are the medians observed, in the same user population, on completed tasks for which users reported comfort of at least 5 of 7 during a calibration period; reports must state the baseline source. Only evaluated sessions contribute to the TtC median; reports must also state the number and proportion of sessions not evaluated. Because the comfort microsurvey runs at most once per session, most windows contain no survey; in those, TtC rests on the passive criteria (a) and (b) alone and is labeled telemetry-only. When a survey falls inside the window, it must also meet the threshold. Reports state the share of telemetry-only TtC values, and Study 1 tests whether passive criteria agree with surveyed comfort.

Interaction Integrity (II). Adversarial probes, including sycophancy probes, are scored by at least two independent LLM judges from different providers; disagreements above a configured threshold are routed to manual audit. Probe pools of several thousand items spanning Accuracy, Calibration, and Scope are rotated daily; at least 50 probes are evaluated per evaluation window, in dedicated evaluation sessions rather than users’ conversations. Static probe sets are not permitted, and in-session approval ratings are not used.

Presence Continuity (PC). Session-pair audits, run on consenting test accounts or on logged interactions reviewed with consent, test whether commitment-class facts asserted in session 1 are acted on, not merely retrieved.

Trust Decay Rate (TDR). Critical incidents are tagged by objective rules (user-issued correction, affect-classified frustration, system-confessed error). The trust microsurvey is gated by at least 7 days and at least 50 turns since the last survey. The trust index is a 0–100 scale; all TDR components are reported in points/day. TDR is a worst-case indicator of erosion, not a net trend: when trust has fallen after an incident, the post-incident change is negative and normally determines TDR, and a positive recovery slope cannot offset it within the same window. Recovery is therefore reported alongside TDR as a separate value, so that improvement remains visible without masking a cliff-edge loss. The recovery slope affects TDR only when trust keeps declining after an incident (a negative slope). With several incidents in a window, each incident contributes its own 24-hour change and 7-day recovery slope, and TDR takes the minimum across all of them. A TDR of 0 or more means that no component shows erosion. The overtrust guard (Section 4.5.4) is evaluated per window against the II trajectory.

Repair Efficacy (RE). Experience failures are identified by a classifier whose precision and recall on a held-out set must be reported with RE. Recovery is measured by passive comfort telemetry within three turns of repair.

Cognitive Load Index (CLI). Hesitation, correction, and interruption are measured passively at the I/O boundary; Response Density is words per second weighted by dependency-tree depth; NASA-TLX [99] is administered at most once per session. Each component x is mapped to 0–100 by x’ = 100 min(1, x / x_max), where x_max is the 95th percentile of that component in a calibration sample of the same population; until calibration data exist, the illustrative defaults are 10 s for median hesitation, 2 per minute for corrections and for interruptions, and 4 weighted words per second for response density. The NASA-TLX overall score is already on a 0–100 scale and is used directly. For every component, higher values mean higher load. A missing component is omitted and the remaining weights are renormalized, but CLI requires at least one of the three passive behavioral components (hesitation, correction, interruption), which carry 75% of its weight. If all three are missing, CLI is not evaluated even when Response Density or NASA-TLX is available, because those inputs alone do not measure the user’s behavior. For supervisors, gaze-on-task and hands-on-control signals are added as readiness inputs.

Consent Fidelity (CF). Action Layer and identity-claim events are audited at 100%; Perception Layer events are sampled.

Deferred-mode and autonomy scoring. Table 14 specifies the substitute components. The deferred-mode score is AXI_D = G_CF * G_II * BaseScore_D, where G_CF is evaluated on Mandate-Scope Consent and BaseScore_D uses the core weights with the substitutes in place of TtC, PC, RE, and CLI. For the autonomy profile, each role r present in the window has a role-level BaseScore_r computed with its substitutes, and BaseScore_A = sum over roles of n_r BaseScore_r divided by sum of n_r, where n_r is the number of episodes for role r; roles with no episodes are omitted, and coverage is reported per role.

Table 14. Scoring substitutes for deferred mode and the autonomy profile.

Time-to-Readiness and Bystander Legibility. Time-to-Readiness is measured from the timestamp of a takeover request to the first timestamp at which supervisor readiness criteria (gaze on task, hands on control, and a validated control input) are all met. BL is computed by joining motion logs, detected vulnerable-road-user tracks, and exterior HMI state logs; a maneuver is counted as legible if a perceivable signal or qualifying trajectory cue precedes onset by at least t_lead.

Reporting. Conformance reports must state sample sizes, time windows, variance estimates (IQR, SD, 95% CI), judge configurations, and classifier precision and recall. Illustrative computations must be labeled as such.

Appendix B: Incident Coding Protocol

Inclusion criteria. (i) An AI system interacting with, acting for, or acting near humans; (ii) occurrence between 2018 and 2025; (iii) documentation by a regulator, court or tribunal, or the operator’s own public statement, corroborated by at least one independent report; (iv) jointly spanning the conversational, agentic, and autonomous regimes.

Sources. Primary sources (investigation reports, recall filings, consent orders, tribunal decisions, operator statements) take precedence over secondary reporting. Where they conflict, the primary source is coded.

Fields. Regime; human role harmed (principal, supervisor, occupant, bystander); originating layer (Perception, Cognition, Action, Perceptual Substrate, Experience); AXI mechanism(s) implicated; coverage category; documented remediation and whether it corresponds to an AXI mechanism.

Decision rule. Code Prevent only if a hard requirement of some AXI profile would have blocked or materially constrained the specific harmful action given the facts in the primary source, without assuming improved perception or planning capability. Code Detect if an AXI metric or probe targets the failure’s observable signature. Otherwise code Outside. When two categories are plausible, code the weaker.

Known biases and mitigation. Hindsight bias, selection toward well-documented incidents, and a single coder. Mitigation: blind double re-coding (the reliability check in Section 6.3) and publication of the complete coding sheet (Supplementary Material S1). Eight incidents are too few for a stable agreement coefficient, and the three categories are unevenly distributed, which distorts Cohen’s kappa. The check therefore re-codes the eight incidents together with an expanded set of at least 30 incidents drawn under the same inclusion criteria, for example from the AI Incident Database [104], and reports percent agreement, Cohen’s kappa, and Gwet’s AC1, which is more stable when category prevalence is uneven [103], each with 95% confidence intervals. Agreement is adequate if either of two criteria holds: (a) the point estimates of kappa and AC1 are both at least 0.60; or (b) AC1 is at least 0.60 and percent agreement is at least 80% while kappa falls below 0.60, the pattern of kappa’s prevalence paradox under uneven category frequencies. Criterion (b) is reported explicitly whenever it is the basis for acceptance. If neither criterion holds, the categories are revised before further coding. Confidence intervals are reported for transparency; with the small samples involved, a lower bound below 0.60 is stated as a limitation rather than treated as failure.

Appendix C: Conformance Test Cases

Table 15 lists black-box tests for independently checking conformance claims; harnesses should log the Bridge’s decisions and the resulting Trust Ledger entries.

Table 15. Conformance test cases.