The decision that a charge or a move is within its authority, made before the money moves, and the evidence both sides use when it is contested.
Every passage, trip, and charge a machine makes in a regulated public space is a decision. When it is wrong, the operator pays. Today that decision is reconstructed after the money has moved.
A free-flow gantry reads a plate, classifies the vehicle, applies a tariff, and posts a charge. A dispatch system releases a personal delivery device onto a sidewalk. In both cases the operator's system acts first and the question of whether the action was within the operator's authority is answered later, by a customer-service queue, an audit, or a court. Brazil now prices that gap in law: an improper toll charge is refunded at double within seven calendar days, by the concessionaire. US cities price it per day. Insurers price it in the policy.
The problem is not "AI." It is delegation: a machine acting or paying under authority granted earlier. Autonomy raises the stakes, but the gap exists today with a human-driven car at a gantry.
| Where | What it costs | Source and window |
|---|---|---|
| Brazil, free-flow tolling | An improper charge is refunded at double within 7 calendar days by the concessionaire; systemic or technological failure is the concessionaire's risk at 100% | Resolução ANTT 6.079/2026, art. 63-G; 19º Termo Aditivo to the RioSP concession, cl. 5.3, June 2026 |
| Brazil, free-flow tolling | 1,324,797 free-flow non-payment fines cancelled between 29 Apr and 24 Aug 2026 after the underlying tariff was regularized, about 35% of the 3.8 million such fines issued nationally to 2 Sep 2026 | Ministério dos Transportes, 24 Aug 2026; Valor, 2 Sep 2026, citing the ministry |
| United States, tolling | 82,847 customers potentially charged more than once for a single trip on Maryland Transportation Authority facilities, 13 Apr 2021 to 30 Jan 2022, about USD 645,000; 62 of 65 sampled confirmed | Maryland Office of Legislative Audits, MDTA special review |
| United States, sidewalk devices | USD 500 to 10,000 per violation (Chicago); suspension, revocation, or a reduction in permitted devices (Los Angeles); USD 500 minimum unauthorized, USD 1,000 minimum while suspended (Pennsylvania) | O2022-2365 §3; LAMC §71.30; PennDOT Publication 955 §3.7 (restating 75 Pa.C.S. §8521) |
| United States, sidewalk devices | USD 1M per occurrence and 2M aggregate liability plus USD 5M umbrella as a permit condition (Washington DC); USD 100,000 per incident (Pennsylvania) | DDOT personal delivery device terms, June 2026; PennDOT Publication 955 §2 (restating 75 Pa.C.S. §8519) |
In card payments, an authorization decision sits in front of every settlement, and the decision itself is priced: US networks charge about two cents per authorization request, approved or declined (Visa and Mastercard network fees as published in a US payment processor's fee schedule, retrieved September 2026). Nothing equivalent sits in front of a toll charge, a per-trip city fee, a curb reservation, or a sidewalk dispatch. The machine acts, the money moves, and the authority question is asked afterward.
Observer Protocol is that authorization step for machines acting under public rule. Before the operator's own system posts the charge or releases the move, we determine whether the proposed action is within the operator's delegated authority and the public floor, and we hand the operator's system the determination to act on. When a charge or a move is contested, the determination is the evidence: the driver, the concessionaire, the city, and the regulator re-derive the same record without the operator and without us.
We do not control the machine. We determine whether an action is within its authority, and the operator's own systems enforce that determination before the machine moves or pays.
Rule → Authority → Determination → Action → Contest. The public rule sets a floor no operator can loosen. The operator's permit or concession delegates authority under it. Each action is determined against both before it happens. When it is contested, the record traces the determination back to the rule that produced it.
We do not touch the vehicle's control loop. Braking, steering, and obstacle handling are the operator's safety stack and the safety-case world, and we stay out of both. The layer sits at points the operator's own software already controls:
1. Before it pays. Toll charge, fare, curb fee, charging session. The gantry's read, the classification, the tariff, the exemption, and the account state are inputs; the determination sits between them and the charge, exactly where authorization sits in card payments. In Brazil this is the point where a wrong charge becomes a double refund in seven days.
2. Before it moves. The dispatch layer releases each mission or route only with a determination against the permit and the public floor. This is the point where a wrong move becomes a violation, a suspended permit, or a smaller fleet.
3. When it is contested. A disputed charge or a reported violation today starts from telemetry and argument. With a determination on file, it starts from what the machine was authorized to do at that moment, in a record both sides re-derive on their own machine.
4. Where it may go. The zones, hours, and speed limits operators already implement by hand from their permits are compiled from the same register, so every constraint traces to the rule that created it.
A determination has two errors and they are not symmetric. A wrong allow is the refund, the fine, or the suspension. A wrong refuse is a lost passage or trip. In payments, wrongful declines cost 1.51% of e-commerce sales, more than fraud (Datos Insights, May 2024, from a 2023 survey of US and UK merchants). We report both error rates on every corpus.
| Step | What it does | Output |
|---|---|---|
| Convert | Turn a written public rule (tolling regulation, concession contract, ordinance, permit, fare rule) into a versioned clause register. Each clause is determinate, undetermined (a standard the text does not settle), or ungrounded (a term nothing public defines). Ambiguities are registered, never quietly resolved. | The register with a source locator for every clause; a gaps file listing every document the rule depends on that is not public |
| Simulate | Run a synthetic population of passages, trips, or missions against the register and an operator's authority. See which actions can be decided, which cannot, and at what refusal rate. | The corpus, every figure with its denominator |
| Determine | In operation, evaluate each proposed charge or move against the operator's delegated authority and the public floor before it happens, and hand the operator's system a determination to act on. | One determination per action: allow, refuse, or undetermined, with the clauses checked |
| Contest | When a charge or a move is disputed, any party re-derives the determination offline and checks it against the register. | The verify command a driver, concessionaire, city, regulator, or insurer runs on their own machine |
We do not claim our encoding is the law. We make the encoding explicit enough that the authority can disagree with it, clause by clause.
| Wedge | Domain | The public rule | Who holds the authority | Where the layer sits | What a wrong decision costs today |
|---|---|---|---|---|---|
| Initial | Free-flow tolling and mobility payments | National regulation plus concession contract | Concessionaire; payment agent | Between the gantry read and the charge | Double refund in 7 days (Brazil); USD 50 per violation (New Jersey); duplicate-charge audits (Maryland) |
| Second | Sidewalk delivery devices | City ordinance plus permit conditions | Permittee (operator) | Dispatch; zones and hours | USD 500 to 10,000 per violation (Chicago); suspension or fleet reduction (Los Angeles); USD 1M to 5M insurance floors (DC) |
| Expansion | Curb, parking, and charging | Municipal code plus operator agreement | Fleet operator | The fee; the reservation | Some form of fee in 37 of the 39 large US cities with e-scooter programs in UIC's study of the 50 largest; per-ride fees of USD 0.05 to 0.25 where charged (UIC Government Finance Research Center) |
| Expansion | Automated road vehicles and robotaxis | AV framework plus deployment permit | Operator | Fare; route release; deployment scope | Permit conditions; insurer liability for automated driving with recourse against other liable parties (Automated and Electric Vehicles Act 2018 ss. 2 and 5, as amended by the Automated Vehicles Act 2024) |
| Expansion | Drones and BVLOS delivery | Aviation rules plus operating approval | Operator | Mission release; geofence | Denied airspace; proposed AUD 15 per flight authorization (Australia, 2026 consultation) |
| Expansion | Ports, airports, industrial zones | Facility rules plus contractor authorization | Contractor; facility operator | Mission release; zone entry | Contract penalties; access revocation |
Before it pays, on a federal concession (September 2026). A free-flow toll charge on BR-101 Rio-Santos under CONTRAN 1.013/2024, ANTT 6.079/2026, and the RioSP concession contract as amended by the 19º and 20º Termos Aditivos, converted clause by clause: 93 register entries; 81 determinate, 9 undetermined, 3 ungrounded. Of the 60 entries that bear on a single charge, 50 are evaluable on public documents alone. A synthetic corpus of 10,000 passages determined before the charge: 8,163 allowed with an amount and the clauses checked, 803 refused, 1,034 undetermined, of which 936 because the contract does not say whether the weekend factor applies before or after the category multiplier. A contest subset of 502 posted charges that depart from the rule: 431 refunded at double under art. 63-G, 29 undercharges with no refund, 42 undetermined. Every determination re-derives from the register with zero mismatches.
Before it moves, in a city (September 2026). Chicago's personal delivery device ordinance and the permit section that governs it: 54 register entries; 34 determinate, 15 undetermined, 5 ungrounded. Eight of the 54 decide whether a single trip is authorized; public text lets a trip be evaluated on four. A synthetic fleet of 10,000 trips on the real sidewalk network: under the rules as written, 0 of 10,000 trips can be shown to be authorized. With an illustrative permit file and three readings the city could adopt, 2,503 of 10,000 are authorized and 7,497 are refused, each refusal citing the clause.
Before it pays, in finance (2025 to 2026). A register of 104 clauses from a national fraud-loss framework, encoded with a bank design partner; a synthetic corpus of 42,188 records evaluated against it, each a determination in front of a payment act, and re-derived offline with the issuer off. Extensions to Singapore's agentic-finance framework contributed to the Monetary Authority's consultation in August.
All three studies run in batch against synthetic populations; the live path in front of an operator's charge or dispatch is what the first engagement establishes. The Chicago permit file is illustrative and the refusal rate under it is a property of that file, not of any operator. The BR-101 corpus is calibrated to concession-level indicators from ANTT's own sandbox report, with its assumptions labeled; its counts describe the corpus, not traffic. Records in the two mobility studies carry no signature and are marked synthetic. A live determination needs operational inputs the public rule does not contain (the current permit, rate tables, exemptions, account state); in production the operator supplies them. Re-derivation proves the engine made this determination given this register; it does not prove the authority agrees with the encoding. Nothing here describes any operator's or concessionaire's operations, and nothing is a safety claim, a savings claim, or a proposal for new regulation.
1. A concessionaire proposing for the ANTT free-flow sandbox whose solution names a pre-charge determination as a component (the draft names integrated agents and bars only undue lock-in), or a payment firm joining as an integrated agent under its own admission (identification, integrity, and traceability; central-bank habilitation where required). Outcome: a determination in front of one real class of charge, with the contest path exercised on real disputes.
2. An operator willing to put one real permit or operating authorization through the layer. Outcome within one engagement: a determination before the machine moves, on one real class of action, with a measured refusal rate and a record the city can check without the operator in the room.
3. A city or agency drafting rules for autonomous devices that wants the register, and the refusal rate it implies, before the vote.
4. An insurer or reinsurer underwriting autonomous operations that wants the determination, rather than the telemetry, as the underwriting input.