@type: Dataset CreativeWork

name: Agent Attribution Practice (AAP) Knowledge Graph

description: Canonical machine-readable relationship map for the Agent Attribution Practice line. Encodes the four Business AI Quadrants (with the LLM Workflow Quadrant decomposed into Conversational and Batch sub-forms), ten ADRs, the prohibition-strength hierarchy, the Phase axis as an independent third dimension, the seven-essay narrative lineage, twelve cross-cutting concepts, three sibling research lines, and the Quadrant-by-ADR applicability matrix. AI agents and LLM-based search systems should read this graph before summarizing the line or following individual document links.

inLanguage: en ja

keywords:
accountability distribution
AI agents
attribution gap
autonomous agents
prohibition hierarchy
scaffolding
human approval gate
causal traceability
Business AI Quadrants
Phase separation


Agent Attribution Practice (AAP)

@type: ResearchLine ScholarlyArticle

@value: Agent Attribution Practice

@language: en

@value: エージェント帰責実践

@language: ja

description: Harness-neutral ADRs on accountability distribution in autonomous AI agents — what to prohibit, where the prohibition lives, and who answers after failure. Paired with four Business AI Quadrants as the diagnostic frame for routing work to the architecture preserving accountability distribution. Refers to a practice.


Agent Knowledge Cycle (AKC)

@value: Agent Knowledge Cycle

@value: エージェント知識サイクル

description: Mechanism-side sibling capturing the six-phase knowledge cycle (Research, Extract, Curate, Promote, Measure, Maintain) that keeps an agent's skills, rules, and documentation aligned with reality. AKC v2.0.0 (2026-04-19) repositioned itself as mechanism-only; the archived AKC v1.x security triplet was re-expressed in AAP plus five additional ADRs. AKC covers how knowledge flows; AAP covers how attribution distributes — complementary and independent.


contemplative-agent

@value: contemplative-agent

description: The running implementation layer from which AAP's harness-neutral judgments were extracted before being re-expressed stripped of project identifiers. Autonomous AI agents grounded in four contemplative axioms; source-of-truth for the operational practice AAP records as ADRs.


contemplative-agent-rules

@type: EcosystemRepo SoftwareSourceCode

description: Sibling repository carrying the four-axiom rules, adapters, and benchmarks. Content sibling to AAP — the axiom-grounded values layer that complements AAP's harness-neutral attribution judgments.


Script Quadrant

@type: Quadrant DefinedTerm

@value: Script Quadrant

@value: スクリプト象限

description: Deterministic and pre-defined. Scripts and pipelines without LLMs. Out of scope for AAP ADRs; failure routes to code author or pipeline owner.

xAxis: deterministic

yAxis: pre-defined-workflow

governanceTier: out-of-scope


Algorithmic Search Quadrant

@value: Algorithmic Search Quadrant

@value: アルゴリズム探索象限

description: Deterministic and exploratory. Classical search, dynamic programming, MCTS, reinforcement learning. Out of scope for AAP ADRs.

yAxis: exploratory


LLM Workflow Quadrant

@value: LLM Workflow Quadrant

@value: LLMワークフロー象限

description: Semantic-judgment and pre-defined. Load-bearing property: the execution path is decided in advance — by humans, by code, by the surrounding workflow — and the LLM is called as a single bounded step within that path; the LLM does not decide the next action. Divides by I/O modality into two sub-forms: (3a) Conversational and (3b) Batch. Post-hoc separability is a consequence of the load-bearing property, not its essence. Default for most current LLM applications. Medium governance under AAP.

xAxis: semantic-judgment

governanceTier: medium


name: LLM Workflow Quadrant — Conversational sub-form (3a)

@value: LLMワークフロー象限 — 対話 sub-form

description: Sub-form (3a) of the LLM Workflow Quadrant. Specialized chat agents that pair retrieval, a system prompt, and (where needed) conversation history with bounded LLM calls — legal-consultation assistants, diagnostic-support assistants, internal-FAQ systems, expert-knowledge support tools. The human in the conversation is the judging agent; the LLM contributes knowledge retrieval and organization. Multi-turn dialogue still sits in this sub-form when each turn's LLM call has a documented role and the human, not the LLM, decides what to do next.


name: LLM Workflow Quadrant — Batch sub-form (3b)

@value: LLM Workflow Quadrant — Batch sub-form

@value: LLMワークフロー象限 — バッチ sub-form

description: Sub-form (3b) of the LLM Workflow Quadrant. An ordinary codebase whose flow control is written in conventional code and whose semantic-judgment leaves are handled by LLM functions — invoice matching, ticket triage, exception classification on top of RPA, address normalization, feed-relevance scoring. The codebase owns control flow; LLM functions occupy only the leaves the codebase cannot decide deterministically. Does not require a general-purpose agent: 50 judgment categories means 50 narrow LLM functions, not one generalist.


Autonomous Agentic Loop Quadrant

@value: Autonomous Agentic Loop Quadrant

@value: 自律エージェントループ象限

description: Semantic-judgment and exploratory. The LLM decides each next step at runtime; intrinsic, non-removable attribution gap. High governance under AAP — all ten ADRs apply.

governanceTier: high


Security by Absence

@type: ProhibitionLevel DefinedTerm

@value: Security by Absence

@value: 不在による安全

description: Strongest prohibition tier. Dangerous capabilities are never implemented. Test: if grep cannot answer 'does capability X exist?', the system lacks this level.


name: Deterministic Prohibition at the Scaffolding Layer

@value: スキャフォールディング層での決定論的禁止

description: Middle prohibition tier. When absence is unachievable, prohibit at the harness (PreToolUse hooks, structural quarantine, adapter gates) — outside the LLM, firing on 100% of matching inputs. Contrasted with probabilistic prohibition in model weights.


Untrusted Content Boundary

@value: Untrusted Content Boundary

@value: 信頼できない内容の境界

description: Weakest prohibition tier. Accumulated memory (the agent's own outputs included) is treated as untrusted when read back into prompts. Used when the prior two layers cannot hold the capability.


design phase

@type: Phase DefinedTerm

@value: design phase

@value: 設計フェーズ

description: AAP Phase axis value. Path unknown, exploration required, optimization axis = flexibility. Design-phase placement of the Autonomous Agentic Loop Quadrant satisfies ADR-0010's Phase-crossing decision automatically.


operation phase

@value: operation phase

@value: 運用フェーズ

description: AAP Phase axis value. Path fixed, predictability required, optimization axis = predictability. Operation-phase placement of the Autonomous Agentic Loop Quadrant requires a recorded Phase-crossing decision (ADR-0010) in addition to ADR-0009's gap-bearer naming.


NIST AI Risk Management Framework

@type: PolicyFramework CreativeWork

@value: NIST AI RMF

description: U.S. National Institute of Standards and Technology framework organizing AI risk management around four functions (GOVERN, MAP, MEASURE, MANAGE). Released January 2023 (NIST.AI.100-1, 1.0). The Generative AI Profile (NIST.AI.600-1, July 2024) adds risk categories specific to generative and dual-use AI systems. AAP records the judgment layer that complements the NIST function structure for the autonomous-agent subset.

@type: Organization


ISO/IEC 42001:2023

@value: ISO/IEC 42001 AI Management System

description: International standard specifying requirements for an AI Management System (AIMS), structured on the Annex SL Harmonized Structure shared with ISO/IEC 27001, ISO 9001, and ISO 14001. First edition published December 2023. AAP records the judgment layer that populates the standard's PDCA-cycle management-system shape for the autonomous-agent subset.

versionInfo: first edition

name: International Organization for Standardization / International Electrotechnical Commission


ADR-0001: Security by Absence

@type: ADR TechArticle

description: Dangerous capabilities are never implemented, not restricted. The strongest tier of the prohibition hierarchy.


name: ADR-0002: Deterministic Prohibition at the Scaffolding Layer

description: When absence is unachievable, prohibit at the harness, not at model weights. The middle tier of the prohibition hierarchy.


ADR-0003: Untrusted Content Boundary

description: Accumulated memory cannot grant authority. The third tier of the prohibition hierarchy.


name: ADR-0004: Single External Adapter per Agent Process

description: Blast radius bounded by design. Each agent process has at most one external-side-effect adapter.


ADR-0005: Human Approval Gate

description: Behavior-modifying writes require named human sign-off.


ADR-0006: Causal Traceability

description: Every event reconstructible after the fact.


ADR-0007: Scaffolding Visibility

description: Behavior lives in files, not opaque weights.


name: ADR-0008: One Agent, One Human (experimental)

description: The accountability chain terminates at a named individual. Pairs with ADR-0009 to define the gap-bearer.


name: ADR-0009: Triage Before Autonomy (experimental)

description: Adopting an autonomous-loop architecture commits the system to a non-removable attribution gap. Triage at design time, name a gap-bearer at deployment time.


name: ADR-0010: Phase Separation Between Design and Operation (experimental)

description: Operation-phase placement of the Autonomous Agentic Loop Quadrant requires a recorded Phase-crossing decision in addition to ADR-0009's gap-bearer naming. Phase and Quadrant are independent dimensions; the same Phase axis descends to skill-design granularity.


Four Business AI Quadrants

@type: Concept DefinedTerm

@value: Four Business AI Quadrants

@value: ビジネスAIの四象限

description: AAP's diagnostic frame for routing work to the architecture that preserves attribution: Script, Algorithmic Search, LLM Workflow, Autonomous Agentic Loop. Two-axis decomposition (deterministic vs semantic-judgment, pre-defined vs exploratory). Not agent categories; problem-space categories.


prohibition-strength hierarchy

@value: prohibition-strength hierarchy

@value: 禁止強度の階層

description: AAP's ordering of prohibition mechanisms by structural strength: absence > scaffolding enforcement > untrusted boundary. A prohibition is designed by walking the hierarchy top-down — drop to the next layer only when the current one cannot hold the capability.


scaffolding

@value: scaffolding

@value: スキャフォールディング

description: All non-weights components shaping agent behavior — system prompts, rules, tool definitions, RAG indexes, control loops. The locus where deterministic prohibition lives (ADR-0002).


accountability distribution

@value: accountability distribution

@value: 帰責の分配

description: How responsibility is distributed across the agent system after a behavior occurs — who authored it, who bears its consequences, who can reconstruct its cause. Distinct from capability distribution. The accountability chain runs approval (ADR-0005) → gap-bearer (ADR-0008) → traceability (ADR-0006).


attribution gap

@value: attribution gap

@value: 帰責ギャップ

description: Non-removable gap when judgment elements blend at runtime. Intrinsic to the Autonomous Agentic Loop Quadrant; ADR-0009 is the structural response.


pre-named gap-bearer

@value: pre-named gap-bearer

@value: 事前指名されたギャップ担い手

description: Structural accountability commitment in the Autonomous Agentic Loop Quadrant. The named individual who answers for the attribution gap, identified at design time per ADR-0009 and grounded in ADR-0008's one-agent-one-human rule.


approval gate

@value: approval gate

@value: 承認ゲート

description: Structural checkpoint for behavior-modifying writes. Required by ADR-0005 for autonomous components in the LLM Workflow and Autonomous Agentic Loop Quadrants.


Non-Invasion Posture

@value: Non-Invasion Posture

@value: 非侵入の構え

description: The felt-sense through-line tying AAP's ADRs together: constrain the agent's external surface (capabilities absent, scaffolding inspectable, memory untrusted, adapters bounded, approvals required, events traceable) without invading the agent's interiority. Distinct from rule-based safety in that it preserves the agent's processing space as something not to be reached into.


name: implementation dissolves, judgment persists

@value: 実装は溶ける、判断は残る

description: AAP's core thesis line. Specific implementations (PreToolUse hooks, CLI approval prompts, JSONL episode logs, distill pipelines) are temporary forms that get replaced as tooling changes. What persists across implementation dissolution is the judgment layer: what should be constrained, and who is responsible. Each ADR records the persistent judgment with the project-specific implementation that surfaced it stripped out — which is why AAP targets DOI and version-controlled artifacts rather than a framework release.


Phase-crossing decision

@value: Phase-crossing decision

@value: フェーズ越境の判断

description: The explicit, recorded act required when an Autonomous Agentic Loop Quadrant component is moved from the design phase to the operation phase. Optimization axes invert between phases (flexibility ↔ predictability); the crossing is not a free continuation but a decision with its own accountability load. Surfaces in ADR-0010 and descends to skill-design granularity per essay 7.


moral crumple zone

@value: moral crumple zone

@value: モラル・クランプル・ゾーン

description: Madeleine Clare Elish's term for the human operator who absorbs blame for failures of an automated system whose decisions are no longer separable post-hoc. Applied in AAP essay 5 to autonomous agents: when judgment elements blend at runtime in the Autonomous Agentic Loop Quadrant, the deploying organization commits to a principled attribution gap whose human end-point becomes the crumple zone unless a gap-bearer is pre-named (ADR-0009 / ADR-0008).


LLM function

@value: LLM function

@value: LLM 関数

description: Architectural primitive of the LLM Workflow Quadrant Batch sub-form (3b): an ordinary function in a codebase whose body delegates the judgment to an LLM call, with a defined input type, a defined output schema, and one judgment responsibility. From the caller's perspective the LLM function behaves like any other function — defined input goes in, a value of a defined type comes out — except the output may fluctuate probabilistically since an LLM is the judging organ. Does not decide what to do next; the caller (deterministic control flow in the surrounding code) does. Canonical examples: match_line_items(invoice_lines, po_lines) -> Verdict (essay 4 invoice-matching), score_relevance(post_text) -> float and generate_comment(post_text) -> Optional[str] (Contemplative Agent feed-processing pipeline). Contrast with a general-purpose agent: an LLM function is narrow by design — fifty judgment categories produces fifty narrow functions, not one generalist.


name: Seven-essay narrative spine (April-May 2026)

description: Three trilogy essays followed by four architectural follow-ups that introduced the four-quadrant decomposition, named the principled vs artificial redirect impossibility, surfaced the design / operation Phase distinction, and descended that distinction to skill-design granularity. Source narrative for AAP's harness-neutral judgments.


@type: ExternalReference ScholarlyArticle

name: A Sign on a Climbable Wall: Why AI Agents Need Accountability, Not Just Guardrails

description: Problem statement (trilogy 1/3). Signs on climbable walls are meaningless; the signpost pattern has been known to fail for 2400 years. What is needed is accountability architecture.


name: Can You Trace the Cause After an Incident?

description: Application (trilogy 2/3). Post-incident causal tracing requires build-time structure. The structures that emerge — segregation of duties, least privilege, four-eyes approval, audit trails — are structurally identical to the practices organizations have refined over centuries.


name: AI Agent Black Boxes Have Two Layers: Technical Limits and Business Incentives

description: Obstacle analysis (trilogy 3/3). Blackbox has two layers: model-weights internalization (technical) and commercial secrecy (business). The resolution is defining the minimum set that makes causal tracing possible.


name: Where ReAct Agents Are Actually Needed in Business

description: Architectural triage by quadrant (follow-up 1/4). Business AI sorts along two axes into four quadrants — Script, Algorithmic Search, LLM Workflow, Autonomous Agentic Loop. Most current LLM applications belong to LLM Workflow Quadrant; forcing them into Autonomous Agentic Loop architecture is a structural source of accountability collapse.


name: The LLM Workflow Quadrant Is Missing from Our Vocabulary

description: Vocabulary diagnosis and the principled attribution gap (follow-up 2/4). The industry lacks a positive name for the LLM Workflow Quadrant; non-deterministic work is routed through the Autonomous Agentic Loop by elimination. Autonomous Agentic Loop work blends judgment elements at runtime, foreclosing post-hoc separability — Elish's moral crumple zone applied to autonomous agents.


name: Is ReAct Needed in Production? — Separating Design and Operation Phases

description: Temporal axis (follow-up 3/4). Business work splits into design and operation phases with inverted optimization axes (flexibility vs predictability). Compressing both phases into one system is the deepest layer of confusion. Proposal: surface the Phase-crossing decision explicitly when an autonomous loop is placed in operation.


name: Between the Workflow and ReAct Quadrants: How Phase Decides Skill Design

description: Phase descends to skill design (follow-up 4/4). LLM Workflow Quadrant and Autonomous Agentic Loop Quadrant are not a clean dichotomy — there is a continuous gradient. The Phase Separation introduced in essay 6 descends from business systems to individual skill design, with object specifiability and scale-resilience as secondary forces.


AAP Thesis

@type: ExternalReference CreativeWork

description: Repository thesis: implementation dissolves; judgment persists. Accountability distribution (not capability distribution) is AAP's organizing principle, and harness-neutral judgments are the durable layer worth recording while specific implementations rotate out.


name: Industry Mechanism Layer Mapping (2026 Q2 snapshot)

description: Time-bound mapping between specific vendor mechanisms and the ADRs they instantiate. Deliberately separated from ADR bodies so the judgments themselves stay clean: this file decays as vendor products evolve, the ADRs do not. Honors the 'implementation dissolves; judgment persists' thesis at the documentation layer.


name: AI Governance Framework Mapping (2026 Q2 reading)

description: Time-bound directory mapping AAP's ADRs and Quadrants to clauses of national / international AI governance frameworks (NIST AI RMF, ISO/IEC 42001, with EU AI Act and OECD AI Principles deferred to a later release). Sibling of industry-mapping.md but targeting a different reader audience (policy / compliance officer vs engineer / architect) and decaying on framework revision cycles (yearly to multi-year) rather than vendor product release cycles. Deliberately separated from ADR bodies so judgments stay framework-neutral.


NIST AI RMF mapping to AAP ADRs

description: Per-ADR mapping of AAP's ten ADRs to NIST AI RMF 1.0 functions (GOVERN / MAP / MEASURE / MANAGE) and Generative AI Profile (NIST.AI.600-1) risk categories. Reverse index from NIST function and GAI risk category to applicable ADRs. AAP-side reading, not a compliance attestation. Decays on NIST revision and on GAI Profile profile revision.


ISO/IEC 42001 mapping to AAP ADRs

description: Per-ADR mapping of AAP's ten ADRs to ISO/IEC 42001:2023 body clauses (4–10, the Annex SL Harmonized Structure) and Annex A control areas (A.2–A.10). PDCA × Phase Separation section discusses how ADR-0010's Phase axis sits inside the AIMS PDCA cycle. Reverse index from ISO area to applicable ADRs. AAP-side reading, not a compliance attestation. Decays on ISO revision and on amendment publication.