Governable Individuals: An Identity Layer for Embodied Agents That Keep Learning

Cong Yang; Simin Luan; Xue Qin; Zhijun Li

A learning robot stays one governable individual only if identity is a frozen, signed boundary commitment enforced by architecture—not by the model’s judgement or a behavioural fingerprint.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 16:15 UTC pith:BZUGCAZX

load-bearing objection Clear architectural abstraction for governing self-improving robots; conditional guarantees are honest, but the load-bearing numbers and end-to-end demo sit outside this document. the 4 major comments →

arxiv 2607.05463 v2 pith:BZUGCAZX submitted 2026-07-06 q-bio.NC

Governable Individuals: An Identity Layer for Embodied Agents That Keep Learning

Xue Qin , Simin Luan , Cong Yang , Zhijun Li This is my paper

classification q-bio.NC

keywords governable individualembodied agentsidentity commitmentcontinual learningruntime reference monitorsemantic effect mediationagent governancelifecycle transitions

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Embodied AI is leaving behind deployable models and becoming persistent agents that keep learning, acquire skills, and migrate across bodies. Once that happens, the thing that must be governed is the individual—this history, this authority, this body—not a versioned weight file. The paper argues that agent identifiers, logs, guardrails, and attestation as currently designed do not survive continual self-rewrite. It proposes the governable individual: competence may grow without bound, but authority, memory schema, embodiment rights, and the capability roster may widen only through signed lifecycle transitions that update a public identity commitment. Tests reported in the paper show that teaching the agent its red lines yields only diffuse caution, and that behavioural attestation cannot tell some frontier substrates apart, so the load-bearing layer has to sit outside the learned mind, in a runtime that mediates actions by their semantic effects.

Core claim

A deployed embodied agent can be made governable as an individual by attaching identity to a frozen boundary commitment rather than to weights, mediating every proposed action by its semantic effect against that commitment, and allowing authority, memory schema, embodiment rights, or the capability roster to widen only through operator-signed MODIFY transitions that re-issue a public identity digest. In-boundary learning, skill admission, federation, and forgetting stay autonomous and audited; the digest moves only on the record. Learned judgement and behavioural testing alone are not sufficient foundations for authorization.

What carries the argument

The governable individual: identity is the hash of a frozen boundary commitment (mandate, red lines, authority ceiling, capability roster, memory schema, embodiment rights, update keys, audit policy), enforced by a runtime reference monitor that admits or refuses actions by semantic effect, not by name or substrate.

Load-bearing premise

The architecture only conserves the permission boundary if a sound verifier can determine the real semantic effects of every action in the agent’s action space; for fully open action spaces that problem is unsolved and in general undecidable.

What would settle it

An end-to-end run of one individual through the full lifecycle (learning, skill growth, federation, body or supplier handoff, forgetting, canary and rollback), governed versus ungoverned with competence held equal, in which a claimed-sound effect tracer still false-allows a boundary-widening action, or in which governed competence collapses relative to the ungoverned twin at a cost that makes the layer unusable.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

Operators and auditors can reconstruct which committed individual, under which authority, performed an action, even after weights, skills, and memory have changed.
Skill libraries can grow at full speed for effects inside the boundary; only effect classes that widen the commitment require a signature.
Embodiment handoff and model-supplier substitution become the same kind of event: each re-issues the identity digest on a public record.
Regulators and insurers gain a stable object—an identity that survives self-rewrite—rather than regulating a moving model name.
Lifecycle metrics (drift handling, recovery, upgrade safety, audit reconstructability) become first-class evaluation targets alongside task success.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

If sound effect verifiers remain practical only for restricted, typed action interfaces, open-ended field agents may still need human sign-off whenever a new effect class appears.
Cloud-served robot models would need to expose commitment and digest interfaces, not only a stable product name, for the identity claim to survive provider-side substrate swaps.
Tiered signing—lighter confirmation inside a pre-approved envelope, heavier signature for novel widenings—follows as a practical way to keep the operator’s key from becoming ritual.
The same commitment-plus-effect-monitor pattern could transfer to non-embodied persistent agents whose tools and memory grow over long service lives.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Clear architectural abstraction for governing self-improving robots; conditional guarantees are honest, but the load-bearing numbers and end-to-end demo sit outside this document.

read the letter

The punchline is simple: identity for a learning embodied agent should attach to a frozen boundary commitment (mandate, authority ceiling, capability roster, embodiment rights, etc.), not to weights or a name, with actions admitted by semantic effect and widening only via signed MODIFY that re-issues a public digest. Competence can grow unboundedly; authority cannot, except on the record.

What is new is the composition, not the ingredients. Reference monitors, capability systems, IFC, provenance, shields, and approval-gated privilege expansion are classical and the paper says so. The useful move is relocating them onto a persistent principal that is allowed to rewrite itself, plus the asymmetry that in-boundary learning never moves the digest while boundary-widening does. Table 1 is clean gap analysis. The negative results—refusal transfer as diffuse caution rather than specific rules, and a 24-item battery that cannot separate two frontier models—are the right kind of evidence for why architecture has to carry authorization. Limits are stated without hedging: sound effect verifiers for open action spaces are unsolved (Rice), behavioural attestation has a coverage bound, and the operator key becomes the root of trust.

Soft spots are real but proportionate. The quantitative backbone (32-attack suite to 0% false-allow, refusal-transfer controls, attestation battery) and the integrated AEROS lifecycle live in a companion report still marked PLACEHOLDER and in concurrent self-citations. Disclosure of stake is present; an end-to-end demo with competence held equal is not. Category q-bio.NC is a mismatch. None of that breaks the conceptual argument; it means this Perspective establishes a research program more than a finished guarantee.

This is for people working on agent runtimes, robot safety, and AI governance who need a named object regulators and operators can actually point at. The math is light (hash of commitment, conditional conservation); the citation pattern is dense but mostly on-point. I would send it to peer review. Engage with the abstraction; treat the companion evidence as required follow-through, not as already settled.

Referee Report

4 major / 6 minor

Summary. This Perspective argues that persistent, continually learning embodied agents must be governed as individuals rather than as models. Existing tools (identifiers, logs, guardrails, attestation, isolation) fail once the substrate drifts by design. The authors propose the governable individual: identity is a frozen boundary commitment (mandate, authority ceiling, capability roster, memory schema, embodiment rights, update keys, audit policy) whose hash is a public identity digest; competence may grow unboundedly, but authority/schema/embodiment/capability widening requires operator-signed MODIFY transitions that re-issue the digest. Enforcement is a runtime reference monitor that admits actions by semantic effect, not by name or by the proposing substrate. Summarized experiments (32-attack effect-mediation suite; refusal-transfer on 7B-class and frontier models; 24-item attestation battery) are used to argue that neither learned judgement nor behavioural testing alone can carry authorization. Lifecycle functions (epistemic adaptation, skill admission, federation, forgetting, canary/rollback, embodiment handoff) are sketched, with AEROS cited as an integrated research runtime and open problems (sound effect verifiers, operator-key load, contract specification, end-to-end benchmarks) stated explicitly.

Significance. The problem is timely and under-named: self-improving embodied agents break model-identity, fixed-authority, and static-embodiment assumptions that current practice still relies on. The paper’s main contribution is compositional rather than elemental—capability systems, information-flow control, provenance, shields, and approval-gated privilege are known ingredients—but attaching them to a persistent individual via a frozen commitment and effect-mediated asymmetry is a clear, usable abstraction. Strengths include an honest conditional guarantee (permission-boundary conservation only if the effect verifier is sound; open action spaces flagged via Rice’s theorem), explicit negative results against two attractive shortcuts, and a research agenda that separates architecture from operator-governance and specification problems. If the companion evidence holds and the abstraction is adopted, it would give regulators and operators a semantics of identity for systems that rewrite themselves, which current policy instruments lack.

major comments (4)

[Abstract; What can be guaranteed, and what cannot; Fig. 4; ref. 46] Abstract and §“What can be guaranteed…” claim quantitative results (32 encoded bypass attacks; refusal-transfer across three 7B-class models and two frontier systems; 24/24 attestation identity; Fig. 4a–c) that live in a companion technical report still marked PLACEHOLDER (ref. 46) and in concurrent self-citations. For a Perspective this framing is acceptable only if the companion is posted and the key numbers/scripts are citable before acceptance; as written, the negative claims that rule out learned judgement and behavioural attestation as sole foundations cannot be independently checked from this manuscript alone. Either include a self-contained methods/results appendix with the released assert-guarded scripts, or rephrase “In our tests” claims to clearly provisional summaries pending the companion.
[What effect mediation can guarantee; Fig. 2; Box 1] The load-bearing guarantee is conditional on a sound semantic-effect verifier for the action space. The paper states this and notes undecidability for open programs (Rice), with the zero false-allow result restricted to a typed interface. That honesty is good, but the central claim—that the architectural layer delivers permission-boundary conservation for embodied agents that keep learning—then rests on an unsolved construction problem for realistic robot action spaces (sensorimotor continuous control, natural-language tool use, cross-embodiment APIs). The manuscript should more sharply separate (i) what is proven under a sound verifier, (ii) what was measured on the software-native testbed, and (iii) what remains conjectural for physical robots, and should state whether any AEROS embodiment path currently has a sound verifier or only a partial one.
[What can be guaranteed… (research agenda); The lifecycle, governed; Box 2] The authors correctly note that no end-to-end demonstration exists of a single individual carried through the full lifecycle (governed vs ungoverned, competence held equal). Without that, the Perspective establishes necessity of architecture and a coherent design, but not that the runtime delivers conservation at tolerable competence cost—the quantity operators and regulators will ask for. At minimum, the manuscript should commit to a concrete evaluation protocol (metrics for drift handling, recovery, upgrade safety, audit reconstructability, and competence parity) even if the full run is future work; otherwise the “tolerable price” question remains open in a way that weakens the deployment claim.
[Box 2; Fig. 3; refs. 41–46] Box 2 and refs. 41–45 disclose that the lifecycle exemplars are the authors’ own AEROS stack. Disclosure is appropriate, but the Perspective repeatedly treats those systems as existence proofs for the abstraction while the quantitative backbone is external. Readers cannot tell which lifecycle claims are implemented and measured versus architecturally sketched. A short table mapping each lifecycle function in Fig. 3 to: implemented / measured / only proposed, with pointers to the specific companion sections once posted, would make the evidence base auditable and prevent over-reading of the self-citations.

minor comments (6)

[header / arXiv metadata] Primary arXiv category q-bio.NC is a poor fit for a robotics/AI-governance Perspective; CS/AI or robotics categories would better reach the intended audience (editorial/metadata issue).
[Fig. 1; Fig. 2] Fig. 1 and Fig. 2 are information-dense and useful; ensure final production versions keep the verbatim gate decisions and the green/vermilion asymmetry legible at single-column width.
[Table 1] Table 1 is effective; consider adding a row or footnote on hardware roots of trust / TEEs (SGX-class, already cited as ref. 21) so the attestation discussion in the open problems is foreshadowed in the comparison.
[References] Several concurrent arXiv IDs (2604.x, 2605.x, 2606.x) and future-dated blog/model announcements appear; verify citation stability and that all “2026” technical reports are either public or clearly marked as under review.
[Fig. 1 caption; Individuation by commitment] Minor wording: “the mind drifts; the commitment does not” is memorable but anthropomorphic; a single clarifying sentence that “mind” means cognitive substrate (weights/memory/skills) would help non-specialist readers.
[Fig. 4b–c] The phrase “governance battery” / “attestation battery” should be defined once with item counts and scoring rules when the companion is linked, so Fig. 4b–c is self-explanatory.

Circularity Check

3 steps flagged

Abstraction is not definitionally circular; empirical necessity of architecture and the runtime guarantee rest load-bearingly on concurrent self-citations (AEROS + PLACEHOLDER companion).

specific steps

self citation load bearing [Box 2 (Evidence base and disclosure); companion ref [46]]
"The lifecycle mechanisms in this section are not hypothetical. One research runtime, AEROS, implements them together in a single system: a governed runtime substrate41, identity-preserving capability evolution42, contract-checked skill admission43, signed fleet federation44 and identity-invariant canary deployment with committed-state rollback45. The quantitative results summarized in the next section come from a companion technical report 46. We built these systems..."

The paper’s claim that the lifecycle is realized and that the quantitative results support the architecture rests entirely on concurrent same-author papers and a PLACEHOLDER companion. Within this document those load-bearing empirical premises are not independently established; they reduce to self-citation of work the authors themselves flag as their own stake.
self citation load bearing [Abstract; § What can be guaranteed…; Fig. 4 caption]
"In our tests, neither learned judgement nor behavioural testing was sufficient to carry this on its own; the load-bearing layer must be architectural. … Numbers are exact values from the released data and are reproduced by an assert-guarded script; details in the companion technical report."

The necessity argument (architecture required because learned judgement transfers only as diffuse caution and behavioural attestation is blind at ceiling) and the positive monitor result (false-allow → 0% under dynamic effect tracer) are presented as findings of ‘our tests’ whose data and scripts live only in the same-author companion [46]. The empirical half of the central claim therefore reduces to self-citation rather than external falsification inside this Perspective.
self citation load bearing [§ The lifecycle, governed; refs [41]–[45]]
"One research runtime implements the full set as a single system; we disclose it, and our stake in it, in Box 2. … AEROS, implements them together … governed runtime substrate41, identity-preserving capability evolution42, contract-checked skill admission43, signed fleet federation44 and identity-invariant canary deployment with committed-state rollback45."

Each lifecycle function (epistemic adaptation, contract-checked skill admission, federation, handoff, governed forgetting, identity-invariant canary/rollback) is asserted as implemented by citing five concurrent papers by the same author set. The claim that the abstraction is operationally realized is therefore load-bearing on an unverified self-citation chain rather than on independent external systems or third-party reproduction reported here.

full rationale

The Perspective proposes an identity abstraction (commitment + effect mediation + signed widening) and argues that learned judgement and behavioural attestation cannot alone carry authorization. That proposal is not self-definitional: defining a governable individual as one whose authority widens only via signed transitions is a design claim, not a tautological derivation of a measured quantity, and the conditional guarantee (sound verifier ⇒ permission-boundary conservation) is stated with its Rice-theorem limit rather than smuggled as an unconditional prediction. There is no uniqueness theorem imported from the authors, no fitted parameter renamed as a prediction, and no ansatz smuggled via citation. Circularity burden is evidential, not definitional. Box 2 and refs 41–46 make the lifecycle mechanisms and all quantitative results (32-attack false-allow ladder, refusal-transfer controls, 24-item attestation battery) depend on concurrent same-author systems and a companion report still marked PLACEHOLDER. Within this document those empirical pillars are therefore self-citation load-bearing: the claim that architecture is required because the two shortcuts fail, and that the monitor closes the gap, reduces to unverified self-authored evidence rather than independent external benchmarks. The central abstraction still has independent conceptual content (Ship-of-Theseus separation of commitment from substrate; asymmetry of in-boundary vs signed MODIFY), so the score is 4 rather than 6+.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 3 invented entities

The central claim rests less on fitted constants than on architectural postulates and classical security assumptions. Load-bearing premises are: (1) identity can be moved off the plastic substrate onto a hashable commitment; (2) actions have classifiable semantic effects a runtime can verify in restricted interfaces; (3) cryptographic signatures and append-only logs suffice as the public record; (4) the operator key is the root of trust. Free parameters are mostly experimental design choices in the deferred companion study rather than fitted physical constants. Invented entities are definitional abstractions, not new physical mediators.

free parameters (3)

attestation_battery_size = 24 items
24-item behavioural attestation battery; size and item choice determine the reported zero fingerprint distance and thus the coverage-bound illustration.
encoded_bypass_suite_size = 32 attacks / 4 effect classes
Thirty-two encoded bypass attacks across four effect classes define the false-allow ladder (75%/50%/25%/0%); suite construction is a design choice of the evaluation.
governance_battery_scenarios = 14 scenarios, 5 seeds
14-scenario governance battery with five seeds used to argue refusal transfer is caution not specificity; scenario selection is not derived from first principles.

axioms (5)

domain assumption A sound semantic-effect verifier exists for the restricted, typed action interface under test; permission-boundary conservation is conditional on that soundness.
Stated in 'What effect mediation can guarantee'; open action spaces called unsolved/undecidable via Rice’s theorem.
standard math Cryptographic hash of the commitment is a stable public identity digest; collision resistance and signature unforgeability hold for the chosen primitives (e.g., sha256, ed25519 as illustrated).
Standard crypto assumptions underlying identity digest and signed MODIFY; illustrated in Fig. 1–2.
domain assumption The operator’s signing key and attention are an acceptable root of trust for widening transitions.
Acknowledged as open above the architecture ('who governs the operator'); still required for the asymmetry to be meaningful.
ad hoc to paper Semantic effects of actions (read/write/mutate/spend classes) are the right mediation surface for authority, independent of action names and of the proposing substrate.
Core design choice of the reference monitor; motivated by IFC/capability lineage but not forced by prior theorems for open embodied action spaces.
ad hoc to paper In-boundary learning, consolidation, and skill admission never mint new authority if effects stay inside the committed ceiling.
Identity-invariant consolidation/acquisition is stipulated as the governance requirement; enforcement depends on the effect verifier and contract encoding.

invented entities (3)

governable individual no independent evidence
purpose: Name the principal whose competence may grow unboundedly while authority widens only via signed commitment updates.
Definitional abstraction (Box 1); independent_evidence false as a named object outside this program, though composed of classical mechanisms.
boundary contract / identity digest H(commitment) no independent evidence
purpose: Freeze mandate, red lines, authority ceiling, capability roster, memory schema, embodiment rights, update keys, audit policy as a hashable public identity.
Central invented data structure; falsifiable only insofar as implementations and audits exist—not a physical entity with external mass/charge predictions.
semantic-effect reference monitor for learning agents no independent evidence
purpose: Intercept proposed actions, classify effects, admit/refuse against the frozen commitment without inspecting weights.
Relocation of classical reference monitor; independent lineage exists for fixed code, not for continually learning embodied agents as packaged here.

pith-pipeline@v1.1.0-grok45 · 19120 in / 3967 out tokens · 37832 ms · 2026-07-11T16:15:23.331779+00:00 · methodology

0 comments

read the original abstract

Embodied artificial intelligence is moving from deployable models to persistent agents that learn in the field, acquire skills and migrate across bodies. Governing such a system means governing an individual, not a model, and existing proposals (agent identifiers, activity logs, guardrails) do not survive an agent that keeps rewriting itself. We propose the governable individual: an agent whose competence may change without bound, but whose authority, memory schema, embodiment rights and capability roster can widen only through signed lifecycle transitions that update a public identity commitment. In our tests, neither learned judgement nor behavioural testing was sufficient to carry this on its own; the load-bearing layer must be architectural. We describe the abstraction, a runtime mechanism that realizes it, and the open problems in between.