What a signed AI policy file can and can't do
A signed sovereignty.json is tamper-evident and portable. It is not, by itself, a security boundary. Here's the honest difference — and why that distinction matters.
The core promise
SovereignRoot makes a human policy tamper-evident and portable. When you generate a signed sovereignty.json, you get a document that:
- carries a cryptographic signature only your key can produce;
- is verifiable by any conforming runtime;
- survives model, vendor, prompt, memory and delegation changes;
- defines a ceiling on delegated authority — never a grant.
What it does NOT do
A signed policy file does not force a non-conforming AI to obey it. If a runtime simply ignores the file, or an agent can bypass the enforcement point, the policy is advisory — not hard enforcement.
Hard enforcement exists only when a trusted component that the agent cannot bypass verifies and evaluates the active root before execution.
The invariant
Effective authority = delegated authority ∩ SovereignRoot allowed authority
Decision precedence: DENY > REQUIRE_APPROVAL > ALLOW. A downstream grant can never override a root deny.
Why this honesty matters
Too many "AI safety" products overclaim. A file that merely sits in a prompt is not enforcement. Being clear about the boundary is what makes a policy format trustworthy — and it's the only way to build real adoption.