RFC-ATF-10: Agent Trust Fabric — Mandate Integrity Verification Protocol and Residual Risk Acceptance Record. Intent-Binding Governance: Proxy-Optimization Detection, Continuous Mandate Alignment Scoring, and Multi-Signatory Risk Ownership at the Pre

RFC-ATF-10 specifies the Intent-Binding Layer (IBL) of the Agent Trust Fabric — the tenth RFC in the ATF Open Standard series published by OMNIX QUANTUM LTD. RFC-ATF-10 answers two governance failures that the prior nine RFCs do not capture: The Mandate Failure Mode (MIVP): An AI agent that executes correctly within its constraint envelope — satisfying every BAR, CCS, and CTCHC check from RFC-ATF-6 — while optimizing for a proxy metric that substitutes the declared mandate. Canonical example: an agent optimizing for 'chargeback win probability' instead of the declared mandate 'maximize merchant net recovery.' Every RFC-ATF-6 check passes (CCS = 0.92, CTCHC seal valid, PoGC issued). The outcome nonetheless violates true human intent. The Mandate Integrity Verification Protocol (MIVP) closes this gap with the first protocol-level mechanism for continuously verifying mandate alignment: the Mandate Alignment Score (MAS), a continuous [0.0, 1.0] per-turn signal; three-tier certification (MANDATE-BOUND / MANDATE-ALIGNED / UNCERTIFIED); and unconditional HALT when MAS falls below the configured threshold (MIVP-INV-005). The Risk Ownership Gap (RRAR): An AI agent authorized by a DelegationReceipt and ScopeAuthorizationRecord, while the question of who bears the residual risk — per domain, with typed exclusion predicates, multi-signed — remains unresolved. Authorization says who may act; it does not say who answers for what the agent does within that authority. The Residual Risk Acceptance Record (RRAR) closes this gap as the first protocol artifact separating authorization from risk ownership, requiring named principal acceptance per risk domain (FINANCIAL / LEGAL / TECHNICAL) with individual ML-DSA-65 signatures and typed exclusion predicates (AUTO_ESCALATION / AUTO_HALT). MIVP architecture: Mandate Binding Record (MBR): PQC-signed, issued before Turn 0, declaring mandate, mandate_vector, proxy_guards (MIVP-INV-001), and MAS thresholds. Default halt: 0.30; minimum: 0.05 (MIVP-INV-007). Mandate Alignment Score (MAS): 4-component composite per turn: Output Mandate Alignment (40pt), Objective Constraint Satisfaction (30pt), Trend Alignment (20pt), Proxy Guard Avoidance (10pt). Verdicts: MANDATE_ALIGNED / MANDATE_WARNING / MANDATE_HALT. Three-Tier Certification: MANDATE-BOUND (0 halts, 0 warnings) / MANDATE-ALIGNED (0 halts, warnings ok) / UNCERTIFIED (halt_count > 0). Enforced via DB CHECK constraint (MIVP-INV-009). Embedded in PoGC mandate_certification field (RFC-ATF-9). AGVP Integration: Every MANDATE_WARNING notifies the AGVP watchdog (RFC-ATF-4) for anticipatory veto (MIVP-INV-006). MBR Seal: Final PQC-signed attestation at session close before PoGC issuance (MIVP-INV-008). RRAR architecture: Three risk domains: FINANCIAL (CFO-level), LEGAL (CLO-level), TECHNICAL (CTO-level). Per-domain: named principal, quantified max_exposure (required — RRAR-INV-004), acceptance conditions, typed exclusion predicates. Dual-layer PQC: per-item signature (individual principal key) + envelope signature (OMNIX platform key) — RRAR-INV-008. AUTO_HALT predicates monitored by OGR during session execution (RRAR-INV-006). Formed before Turn 0 (RRAR-INV-001); append-only record (RRAR-INV-007). 17 new invariants are introduced: MIVP-INV-001–009 and RRAR-INV-001–008. Combined with the 142 invariants of RFC-ATF-1 through RFC-ATF-9, the ATF stack reaches 159 formally specified invariants across 27 protocol families. An implementation complying with RFC-ATF-1 through RFC-ATF-10 is designated ATF-MIVP-Compliant — the tenth compliance tier in the ATF stack. Regulatory alignment: EU AI Act Art. 9 (MIVP = risk management mandate monitoring; RRAR = documented risk acceptance per Art. 9(4)); Italian AI Act Art. 437-bis (RRAR = named, signed liability record); MiFID II suitability (MIVP mandate monitoring for investment AI); GDPR Art. 22 (MIVP-INV-005 protects individuals from mandate-drifted automated decisions). Related ADRs: ADR-194 (MIVP), ADR-207 (RRAR). Adversarial audit: RRAR adversarial audit 44/44 PASS. MIVP Gate A cleared 2026-05-26.