The AXI Bridge

The five-layer AXI Stack

Bridge components

Runtime loop and latency budget

The Bridge operates on token chunks (typically 5–50 tokens). Only two checks block emission: the Consent Broker check and a lightweight runtime integrity check (identity-claim, scope and unsupported-claim classifiers). Everything else observes the stream and constrains later chunks. The 50 ms p95 first-token budget is set below the roughly 100 ms at which responses feel instantaneous; for voice, the whole pipeline must fit inside the roughly 200 ms human turn-taking gap.

Two kinds of integrity. The runtime integrity check blocks individual outputs and must fit the per-chunk budget. The Interaction Integrity metric, which drives the score's integrity gate, is computed per evaluation window from adversarial probes and cannot run per chunk. The check blocks outputs; the metric evaluates the deployed configuration.

Fast engines (ANBE). For inference engines that emit tokens in under a millisecond, Asynchronous Non-Blocking Evaluation keeps the Consent Broker check synchronous for Action-layer events, keeps the integrity check synchronous in high-stakes contexts, and moves everything else to a parallel path.

Degraded operation. An independent action-gateway interlock in front of the Action layer denies any request that lacks a valid Bridge authorization and a Bridge heartbeat younger than one cycle. If the Bridge fails, actions are suspended and conversation continues only through the interlock's classifier with a static AI-identity notice; the failure is logged and shown to the user. If the interlock also fails, the system stops (autonomous systems enter the minimal-risk behaviour in their safety case). Conformance test C-10 checks this.

The latency figures are the paper's design budget (Table 3).

API contracts

The Cognition layer must expose, and the Bridge must honour, these downward constraints. Implementations that ignore them are non-conformant.

type BridgeConstraint =
  | { kind: "pace", chunk_size_max: int, inter_chunk_delay_ms: int }
  | { kind: "halt", reason: "consent" | "integrity" | "user_request" }
  | { kind: "scope", redact: ["pii", "speculation", "claim"] }
  | { kind: "explain", attach: ["uncertainty", "source", "alternatives"] }
  | { kind: "repair", strategy: "simplify" | "analogy" | "visual" }

The Perception layer and Perceptual Substrate must emit, and the Bridge must consume, these upward telemetry events:

type BridgeTelemetry =
  | { kind: "user_pause", duration_ms: int, after_chunk_id: string }
  | { kind: "user_interrupt", timestamp: int, severity: "soft" | "hard" }
  | { kind: "correction", original: string, corrected: string }
  | { kind: "affect", valence: float, arousal: float, confidence: float }
  | { kind: "consent_event", scope: string, granted: bool, granular: bool }
  | { kind: "comfort_microsurvey", score: int, instrument: "TLX" | "single_item" }

Consent Broker

ConsentRecord {
  subject_id: opaque
  purpose: string
  scope: string
  granted_at: iso8601
  expires_at: iso8601 | null
  granular: bool
  current: bool
  revocable: bool
  consent_method: "ui_confirm" | "voice_confirm" | "biometric_confirm"
  evidence_uri: string
  depends_on: [record_id]
}

Every Action-layer event must be preceded by a Consent Broker check that resolves to granted, currentand granular, or the action does not execute. The record is a runtime projection of the consent-record structure in ISO/IEC TS 27560. The rules that matter most in practice:

• Consent is bound to a subject, a purpose, a scope and a validity period; a record missing any of the four cannot satisfy the Broker.
• Revocation takes effect within one Bridge cycle and propagates to every record, cached permission and mandate that lists it in depends_on.
• Consent to process personal data is separate from authorization to act, which the mandate envelope carries, although one gesture can create both.
• A biometric or cryptographic confirmation shows who consented, not that the consent was informed; that depends on the disclosure shown at the time.

The open test suite checks the consent-gate and revocation rules (C-01, C-02) on event logs in the conformance trace format.

Trust Ledger

TrustLedgerEntry {
  session_id: uuid
  user_id: opaque (consented identifier)
  timestamp: iso8601
  event_class: "promise" | "delivery" | "error" | "repair" | "correction"
  description: string
  resolution_status: "pending" | "fulfilled" | "failed" | "repaired"
  user_acknowledged: bool
}

The Trust Ledger is append-only and persistent; Trust Decay Rate is computed from it, and conformance test C-12 checks that past entries cannot be modified without detection. Deletion requests under data-protection law are handled by cryptographic redaction of personal identifiers, retaining audit metadata, subject to legal review (§7.2).

Deferred mode: mandates and rollback

Before an agent acts in the user's absence ("book my flights while I sleep"), the user grants a signed, non-repudiablemandate envelope: allowed action classes (for example purchase:airline_ticket), hard bounds (never above $1,500), notification triggers and a duration. Actions outside the envelope must not execute. The paper stresses that the envelope is an experience-and-accountability construct, not a security control: it should sit on authenticated-delegation infrastructure and alongside prompt-injection defences, because a hijacked agent can act inside a valid mandate.

Mandate Rollback Protocol. When a mandate expires or is revoked mid-transaction, the Bridge:

1. checks whether the running action is at an atomic safe point;
2. if not, allows a grace period (default 300 s) to reach one;
3. if none is reached, invokes registered rollback handlers or, for irreversible classes, records the inconsistent state as a high-priority Trust Ledger entry;
4. notifies the user on next contact.

Edge cases the paper specifies: flows that become irreversible at a commitment point expose a current_irreversibility_classthe Bridge re-queries before each sub-step; revoking a parent mandate terminates its sub-mandates, which may never exceed the parent's scope; and safety-critical mandates cannot be terminated until a successor mandate exists or a human accepts handoff.

The article on consent, revocation and rollback works through these rules as state transitions; conformance tests C-04 and C-05 check them on event traces. The envelope is published as a JSON Schema.

JSON Schemas

Machine-readable versions of the contracts and records above (JSON Schema 2020-12, CC BY 4.0). Where a schema adds a field the paper does not define, its description says so.

Implementation status

• Specified: everything on this page (AXI v2.0).
• Implemented in the author's products: two systems instantiate the stack, as described in the paper; their code is not public.
• Implemented openly: JSON Schemas for the contracts and records on this page, the conformance trace format, and AXI Score calculation through the MCP server.
• Not yet available: an open reference Bridge runtime, an interlock implementation, and measured latency data. A standalone specification is on the roadmap.