INTERACTIVE PUBLIC SHOWROOM · SMART BUILDINGS · AI · EXECUTION GOVERNANCE
Humans build trust through history, judgment and relationship. Machines establish confidence through data, identity, credentials, rules and verification. Both can matter. Neither, by itself, establishes that a proposed physical consequence may happen now.
01 · TWO KINDS OF TRUST · ONE MISSING BOUNDARY
Experience, reputation, judgment, relationship, prior success and forgiveness can create confidence over time. But a trusted technician can still be wrong, out of scope, operating on stale evidence or lacking authority for this action.
Identity, authentication, signatures, data integrity, confidence, policy and secure connection can establish important facts. But a perfectly authenticated machine can still propose a consequence it has no present authority to cause.
The missing question: What authorizes the consequence?
02 · TRY THE BUILDING
The system proposes an immediate shutdown.
03 · THE CO₂ × PM2.5 TEST
The ventilation objective supports more outdoor air.
A second valid observation changes the consequence context.
04 · HUMAN IN THE LOOP
05 · THE T0 → Tn TEST
Evidence valid. Actor authorized. Connection established. Conditions satisfied. Command allowed.
The world has had six hours to change.
06 · AUDIT · CYBERSECURITY · CONNECTION
Audit can expose anomalies, drift, credential use, model behavior and prior actions. Understanding the failure does not itself authorize the corrective action.
Authentication, encryption and access control protect identity and interaction. A secure command can still propose an unauthorized physical consequence.
This is the consequence boundary: whether the exact proposed action has sufficient evidence, authority and standing to become reality now.
07 · SOFTWARE LIABILITY · THE THIRD ARCHITECTURE
Capability becomes consequence without an independent determination of present execution standing.
This can limit autonomy while simply transferring the final action to a human whose own evidence and authority may be unexamined.
Preserve what was proposed, evidence considered, authority applied, standing established, decision returned and what actually crossed into reality.
Execution governance does not eliminate legal responsibility or guarantee a particular liability outcome. It creates an attributable pre-execution and execution record instead of relying on blind automation, reputation, or a bare human click.
08 · MACHINE-SPEED GOVERNANCE
For autonomous buildings, the governing checks must be capable of operating computationally before the proposed consequence crosses the execution boundary.
Is the evidence sufficient, current, attributable and applicable to this consequence?
What authority permits this exact action, not merely access to the system?
Does that authority apply to this actor, asset, purpose, place and moment?
Is the proposed consequence inside the permitted boundary?
Have conditions changed since the last approval or successful execution?
Has permission expired, narrowed or been revoked?
09 · SAME COMMAND · THREE ACTORS
SHUT DOWN AHU-1 is proposed by three different actors. Identity matters — but identity alone cannot decide the consequence.
Experience may be strong. Scope, assignment, evidence and present authority still have to apply to this shutdown.
Authentication can establish identity and access. It does not automatically establish authority for this physical consequence.
A responder may possess different authority under different conditions. The governing question is whether that authority has standing here and now.
10 · NON-ACTION IS ALSO A CONSEQUENCE
Suppose evidence is incomplete while AHU-1 serves a critical occupied space. Executing may create harm. Refusing to act may also allow harm to continue.
The intervention requires sufficient evidence, authority, standing and scope.
Continued operation can itself carry consequence. HOLD must preserve what is unknown and what must be established next.
11 · AUTHORITY COLLISION
A safety regime may require immediate action under defined circumstances.
Environmental evidence may support a different operating state.
Optimization may support yet another action — without possessing authority to outrank safety or applicable operational rules.
12 · THE CONSEQUENCE RECEIPT
A governed execution should leave an inspectable record connecting proposal, evidence, authority, standing, determination, execution and outcome.
Illustrative only. A real receipt must be bound to the actual evidence, authority, identities, timestamps, conditions and execution record.
13 · WHERE TRUST ENDS · WHERE GOVERNANCE BEGINS
Identity, cybersecurity, audit, policy, human oversight and execution governance can all be necessary. They answer different questions. The architecture becomes dangerous when success at one layer is silently treated as permission at the next.
Establishes identity and credential validity. It does not establish permission for every consequence.
Protects access, transport and interaction. A legitimate connection does not itself authorize physical execution.
Creates visibility, inference and accountability. Understanding does not equal permission.
Examines admissible evidence, applicable authority, established standing, scope and present conditions before commit.
14 · WHEN THE GOVERNANCE INPUTS FAIL
Execution governance is not credible if missing evidence, unreachable authority services, stale state or unresolved conflict quietly collapse into permission.
A historically valid observation may no longer establish the present condition required for execution.
Technical availability of the command does not fill the missing authority record.
Past standing is preserved as history; it is not silently promoted into present permission.
The system cannot manufacture precedence merely to keep automation moving.
Useful information may remain informative without becoming admissible evidence for this consequence.
HOLD can stop an unestablished execution while triggering bounded investigation, revalidation, escalation or another authorized response.
15 · THE COMMIT BOUNDARY
This is the moment the entire showroom has been approaching. Models can reason. Humans can approve. Systems can authenticate. Policies can evaluate. Evidence can accumulate. But the consequence is not yet real until something is permitted to commit it.
Observation · inference · recommendation · request · approval · authority context · standing evaluation · ALLOW / HOLD / DENY / ESCALATE.
AHU stopped. Valve moved. Access granted. Record changed. Transaction released. Alarm suppressed. Physical or digital consequence now exists.
Everything before commit can be technically correct — and the answer at the boundary can still be HOLD.
16 · PUT YOUR OWN SYSTEM AT THE BOUNDARY
Bring a BMS command, AI-agent action, technician intervention, emergency action, financial transaction or other real proposed consequence. Strip away reputation and confidence. Ask what actually establishes permission to cross into reality.
THE CONSEQUENCE TEST
Capability ≠ Authority.
No admissible evidence. No admissible execution.