Models Propose, Participants Commit

1. Derived is a category, not a quality

The RSM Canonical Model gives every concept exactly one category. Canonical concepts are the facts that participants and their systems assert, observe, commit or do. Derived concepts are conclusions computed about canonical state. They carry their inputs and a reasoning version, and they are "never canonical fact." Projections are governed, authorization-scoped views and are never an authority. Operational state is runtime bookkeeping. In the layered model, derived artifacts are produced by the application and intelligence layers, not by RSM itself.

Model output belongs in the derived category regardless of how good it is. A sharp interpretation and a poor one are both derived, and that is the point: the category describes where a conclusion stands in relation to the record, not how confident anyone feels about it. Wellzai's exploration specification follows through. Model output "may propose what should be investigated," but it does not create capabilities, relationships, offers, seeks, claims, authority, commitments, outcomes or Outcome Formations. Even the person's first sentence does not become a canonical Intent just because it was interpreted. It becomes one only "when the semantics justify publishing one into the persistent network." The same firebreak applies higher up. When an application computes a candidate Configuration, a gap or a Pathway, the result is a derived instance carrying its provenance, and it "MUST NOT be mistaken for canonical fact."

Keeping intelligence in its category has a practical benefit that is easy to overlook. Derived conclusions can be replaced without corrupting anything. Every derived Wellzai artifact must identify the canonical or authorized information it was produced from, so that when that information changes, the affected conclusions can be found and "stale reasoning" can be "invalidated rather than remaining silently active." A better model or a corrected rule can then replace an earlier conclusion without rewriting anything a participant asserted.

The category also limits what a model may introduce. A named person, organization, offer or relationship may appear in Wellzai's reasoning only if it is backed by evidence actually supplied from the network. "An LLM SHALL NOT create network entities." A connection Wellzai proposes between a producer and a buyer must be typed as proposed and cannot be displayed as an existing relationship. And a model cannot upgrade a discovered candidate to verified, committed or authorized without corresponding canonical evidence.

2. Technical capability is not authority

The second inequality concerns action, and here the RSM runtime is explicit. Every protocol operation identifies the actor initiating it, and actor identity preserves both "who is acting and under whose authority." The federation architecture puts the case for agents directly: "An agent may possess technical capability to issue [a commitment], but the operation is valid only when the Participant has delegated appropriate authority." Delegation is itself a defined grant. It names the principal, the delegate, the permitted operations, the scope, the purpose, the period of validity, and any limits on consequential action.

The reference implementation turns this into a test. An agent delegated to describe, ask and disclose on a farm's behalf may not commit, and "an attempted unauthorized [commitment] must fail even when the agent is authenticated and technically capable of [submitting it]." In the implementation's words, this "proves that authentication and authority are distinct runtime concerns." Being able to act and being allowed to act are separate facts, held in separate places.

Agents receive no exemption for being intelligent. They "operate through the same protocol and authority model as other actors. Their intelligence does not exempt them from policy, provenance, or delegation requirements." What an agent may see is also bounded. Its context is assembled from projections appropriate to its purpose rather than from unrestricted access, so that reasoning stays inside a bounded environment and accidental disclosure across unrelated contexts is reduced. The agent responsible for advancing an Outcome Context in Wellzai's design "does not possess inherent authority to make Commitments on behalf of Participants." It may recommend or request a commitment. The commitment itself must come from a participant or from an agent acting under explicit delegated authority.

3. Three acts that must not look alike

The federation architecture names the distinction the whole arrangement protects. Every consequential agent action should preserve the actor's identity, the principal it represents, the authority, the purpose, the input context and the result. That record "creates an auditable distinction between an AI suggestion, a delegated AI action, and a human or institutional Commitment." These are three different acts. A suggestion is derived intelligence offered to someone who may decide. A delegated action is something an agent does within authority a participant has granted. A commitment is a participant binding itself. Each can be legitimate, but the system's integrity depends on never letting one pass as another.

Wellzai's architecture draws the line as two lists. Wellzai may automatically interpret, clarify, discover, compare, synthesize, explain and recommend. It may not silently make a claim for a participant, publish an offer, grant authority, disclose protected information, make a commitment or establish a Formation: "Those transitions continue through RSM authority and protocol boundaries." The reference implementation's acceptance criteria make the same boundary a requirement. Wellzai may discover, evaluate, configure, identify gaps, develop pathways, recommend, request, coordinate and learn, but "it may not silently convert any of these operations into institutional agreement."

The line also has to be visible where people meet it. Wellzai's formation-layer design describes a coordination interaction that keeps three statements apart: what Wellzai recommends (in an illustrative case, that an indicative buyer commitment would satisfy the principal financing dependency of a configuration), the proposed action (request that commitment), and the authority the action requires (the buyer, or an agent the buyer has delegated). The language of exploration carries the same discipline. Options are to avoid phrases such as "will provide," "has agreed," "committed buyer," "secured financing" and "verified partner" unless canonical evidence supports exactly that state, and to prefer "candidate," "appears relevant," "may satisfy" and "worth exploring." Words are often where the line is first crossed, long before any record is touched. Where possibility becomes organized reality, and who may carry an arrangement across, is the subject of Possibility Is Not Agreement.

4. An explanation is an account, not a transcript

A system that proposes must be able to say why. Wellzai's architecture lists the questions a person should always be able to ask: why Wellzai understood the goal this way, why it is asking this question, why this participant appeared, why this option might work, what is still unknown, and what would change the recommendation. "The answers should come from a structured reasoning trace, not hidden model reasoning."

The distinction is deliberate. The trace records the source expression, explicit facts, inferences, assumptions, clarifications, the queries made to the network, the canonical inputs and their revisions, the rules applied, the conclusions derived and the uncertainty that remains. "This is not private chain-of-thought. It is an application-level explanation of facts, rules, assumptions, and derivation." The reference implementation's acceptance requirements say the same about Wellzai's derived artifacts: the trace need not expose private model internals, but it must expose the factual inputs, rules, assumptions, dependencies and derived conclusions sufficient for a person or system to understand why the result exists. What a person sees follows the same rule. Wellzai's Intent Path model specifies explanation as structured decision rationale, why a route is strong, what is still unresolved and why another route may be better, and states that no hidden reasoning tokens are exposed.

The reason matters for the argument here. A model's own narration of how it reached a conclusion is more model output. Making it the explanation would ask derived intelligence to vouch for itself. An application-level account can be checked against things that are not the model: the canonical inputs it cites, the rules it applied, the assumptions it names.

5. Checking in proportion to consequence

If model output is derived, something other than the model has to judge it. Wellzai's evaluation design states the first rule directly: a model may help create test material, but "the same model must not become the sole judge of whether its own interpretation is correct." Authority to evaluate runs downward from explicit structural assertions, through curated reference semantics, deterministic semantic invariants and human-reviewed equivalent interpretations, to a model-based evaluator used "only for genuinely fuzzy comparisons." The model judge is "optional and subordinate." That principle is developed in the Seednote on generation and grading.

The second rule is that passing a format check is not the same as being supported. Wellzai's semantic interpretation architecture says that Wellzai "must not accept every model-generated semantic proposition merely because it satisfies the schema." A verifier should ask, for each consequential proposition, whether the person's own words actually support it: whether they stated or implied this actor, whether the source supports ownership, whether a quantity belongs to this proposition, whether something is a current fact or a desired future state, and whether the model fabricated a relationship. The checking is aimed at the statements that matter, not at every detail of phrasing. The architecture also notes that a model may be highly confident and still be wrong, so a model's confidence cannot stand in for that check. This is a design requirement, not a description of production behaviour.

The common thread is that the depth of checking follows the distance between a statement and its consequences. A reading that only shapes which question to ask next can be checked lightly, because an error costs a question. A statement that could become a commitment cannot be checked by the system that produced it, because there an error costs someone's agency.

6. Where the line runs

Taken together, these rules describe a division of labour, not a list of restrictions. Models interpret, propose, compare and explain, and they are valuable because they do that quickly and across more of the network than any person could hold in mind. Their output stays derived, so it can be replaced as understanding improves and checked against the record it cites. Authority is a separate, inspectable fact. An agent's technical reach does not grant it, and an agent's intelligence does not exempt it. Commitment belongs to participants, and the record shows, for every consequential act, who acted, for whom, on what authority and for what purpose.

Much of this is architecture, not yet behaviour. The authority boundary is an acceptance requirement of the reference kernel, and the separation of explanation from model reasoning is a requirement of Wellzai's design. Verifying each consequential proposition against the person's own words is a design requirement that has not yet been put into production. But the direction is settled in the sources, and it rests on one invariant. Wellzai may propose what should come together. Participants determine what they will commit.

Sources

1. Wellzai Intent-to-Outcome Product and Application Architecture v1.0, §4.1, §10 (intelligence boundary; consequential boundaries), §12 (explainability; reasoning trace).
2. RSM Canonical Model v3.0, §3.1 (the four categories), §8 (derived instances and the firebreak).
3. RSM Runtime and Federation Architecture Specification v1.0, §3.2 (actor identity), §3.3 (delegation), §13 (agent runtime).
4. Wellzai Outcome Formation Reasoning Architecture Specification v1.0, §2.3 (Outcome Agent), §12.3 (human agency).
5. RSM Reference Implementation and Acceptance Specification v1.0, §7.2 (delegated authority), §24 (explainability, provenance, human and institutional agency).
6. Wellzai W2 Outcome Exploration Specification v1.0, §3.4, §21.2.
7. Wellzai Intent Intelligence and Intent Path Model v1.0, §10, §29.2, §33.
8. Wellzai Intent Evaluation and Inquiry Harness v1.0, §13.
9. Wellzai Multilingual Semantic Interpretation Architecture v1.1, §7.1, §11.4.