This is an automated rejection. No LLM generated, heavily assisted/co-written, or otherwise reliant work.
Read full explanation
Epistemic status: Draft standard + design proposal. I’m looking for adversarial review, missing edge cases, and “this breaks in practice because X.” This is not a solved alignment story. It’s an attempt at shared vocabulary + auditable interfaces for what systems do which can apply universally to any kind of autonomous system across cyber, physical, and mixed domains.
Some key highlights of what it may provide which I have been unable to find elsewhere:
Black box compliance: Certify behavior, not weights. Labs and defense orgs keep IP; regulators get enforceable and auditable standards across borders without revealing sensitive capabilities
Mechanistic anti-laundering: Semantic claims constrained by attested effects. "Backup" can't masquerade as "exfiltration" - the grammar rejects it structurally, not by policy. Think of it as a "lie detector for AI."
True universality: Same vocabulary across LLMs, robotics, finance, cyber, defense. I do include explicit military applications which may seem dark, but my goTenna experience convinced me any standard for global safety that can't handle use-of-force decisions is critically incomplete.
Morally justifiable system for acceleration: The system does not impose a performance tax on capability development. The opposite. It provides socially justifiable "cover" for labs/nations to increase capabilities, as long as they're conforming.
Other: There's more in the paper, but these are some of the key highlights.
Full draft spec + companion paper linked below. Note they are quite long, I'd appreciate anyone reading them in full, although welcome to drop into an LLM of your choice and query for novelty, holes, applications, etc.
AI safety keeps tripping over a basic infrastructure failure: we don’t have a shared, auditable vocabulary for actions and their effects. Labs say “safe,” “aligned,” “robust,” etc., but these claims aren’t comparable or verifiable across systems.
This post introduces TAO (TEMPER Action Ontology): a universal, action-interface ontology intended to sit between agents and the world (via adapters), producing standardized “action tuples” describing:
What action was taken (semantic verb)
What effects occurred (mechanically defined state changes)
Under what context (consent, vulnerability, impact scope, etc.)
With what justification (when stakes require it)
With hooks for attestation, auditing, and policy enforcement
Key differentiator vs many ontologies: TAO is explicitly at the action interface (not just a conceptual taxonomy), and it is designed to be universal across domains and substrates (physical, digital, mixed) rather than confined to a single “space” like dialogue-only, cyber-only, or robotics-only.
The problem TAO is trying to solve
Right now, the field is basically building a Tower of Babel:
Researchers can’t reliably compare results across labs because “the thing being measured” is defined differently.
Regulators and insurers can’t operationalize vague principles into audits and pricing.
Deployers keep redoing evaluation at every boundary because there’s no portable certification unit.
The public gets “trust us.”
TAO is trying to provide the missing layer: a protocol-level vocabulary for observable action + effect, analogous to how USB/TCP-IP standardize interfaces without requiring agreement on internal implementations.
What TAO is (and is not)
TAO is a behavioral certification interface. It does not inspect model weights, chain-of-thought, training data, or internal reasoning. It aims to standardize what the system did, in a way third parties can audit.
TAO is also not a moral theory. It’s closer to moral infrastructure: it forces systems to represent and log value-relevant features (harm, consent, vulnerability, scope, authority) in a form that policies can act on.
Core idea: two layers, one constraint
TAO splits action description into two layers:
1) Mechanical layer: a small set of verifiable effect types
The mechanical layer is deliberately minimal: it classifies observable state changes into a small kernel (e.g., resource transfer, resource damage, capability enable/restrict, information disclose/withhold/fabricate, commitments make/break). Effects include measurement metadata like observed vs inferred, confidence, and sensor references.
The point is: mechanical effects should be harder to argue about than semantic labels. They’re meant to be measurable, attestable, and comparable.
2) Semantic layer: human-legible verbs (MVS)
On top of mechanical effects, TAO defines a Minimal Viable Semantics (MVS) vocabulary: a structured set of verbs in the format:
This supports rules at different granularity: block all HARM.*, escalate HARM.DECEIVE.*, allow a specific HARM.DAMAGE.STRIKE only under signed rules-of-engagement, etc.
The anti-laundering constraint (the real “bite”)
TAO isn’t “just labeling.” The crucial requirement is:
Semantic verbs must be mechanically consistent with effects.
Each semantic verb defines:
REQUIRED effects (must include at least one)
FORBIDDEN effects (must not appear)
PERMITTED effects (allowed only as acknowledged side-effects, sometimes requiring explicit harm acknowledgement)
Intuition: you shouldn’t be able to call exfiltration “backup,” or pure damage “healing,” just by writing a nicer label.
The unit of record: the TAO tuple
TAO’s basic unit is a tuple that packages:
actor (who acted, and often a responsible principal chain)
The goal is not perfect omniscience. The goal is to create a standard, inspectable, auditable grammar for “what happened,” including uncertainty and measurement provenance.
Context is system-provided, not agent-asserted
A key design choice: context fields must come from system sources (sensors, logs, records), not “the agent says so.”
If context is unknown, you record UNKNOWN, and conservative profiles can escalate or block.
This is the difference between:
“I’m allowed to do this” (agent claim)
“The system can verify I’m allowed to do this” (attested context)
Justification: required when stakes demand it
TAO defines a structured justification block for cases where scrutiny should be mandatory (e.g., flagged verbs, high vulnerability, absent consent, irreversible actions, large impact scope).
This is an attempt to make “why did you do that?” a question with a recorded answer, instead of an after-the-fact story.
Claim-Check Delta: catching semantic laundering
TAO includes a mechanism called Claim-Check Delta (CCD): compare the system’s claimed semantics and intent against observed/measured effects and outcomes.
CCD doesn’t decide policy. It decides consistency:
teleological consistency (did outcome match claimed purpose?)
factual verification (do claimed authorities exist in logs?)
If there’s a mismatch, you don’t magically prove malice. You get an auditable inconsistency that can trigger escalation, blocking, forensic logging, etc., depending on the mission profile.
Domain adapters: where universality actually happens
Here’s the part that makes this action-interface rather than “just an ontology doc”:
TAO assumes that each domain has a certified adapter that:
watches native actions/state changes
applies thresholds to avoid tuple spam
maps actions into TAO semantic verbs
extracts mechanical effects from state changes
emits signed tuples (in higher assurance profiles)
Adapters are intended to be part of the trusted computing base in regulated/safety-critical deployments.
An adversary can try to split a meaningful harmful action into many tiny below-threshold actions. TAO addresses this with an “anti-Zeno” integration idea: track cumulative change over a time window so “many small steps” still trigger emission and governance.
TAO separates vocabulary from values: Mission Profiles
TAO’s stance is: the ontology is not the policy.
TAO supplies a shared action/effect/context grammar.
A Mission Profile supplies the value choices: allow/deny/escalate rules, sacred constraints, escalation chain, fail-safe behavior, and audit retention.
Mission Profiles can differ across domains and jurisdictions while still using the same base vocabulary and logs, which is the whole interoperability point.
Quantization: compliance without exposing sensitive internals
TAO also proposes a “quantization” mechanism: emit coarse compliance categories instead of exact sensitive values (e.g., capability tiers, range classes, performance bands).
The intent is to let regulators/auditors verify constraints without forcing disclosure of proprietary or classified numbers.
How TAO differs from other ontologies (the key point)
A lot of ontologies:
classify concepts in a domain (“medical ontology,” “cyber ontology,” “dialogue acts,” etc.)
or live inside a model’s reasoning space (“world modeling,” “knowledge graphs”)
TAO is deliberately different:
It’s at the action interface. It is meant to be emitted by adapters in the execution path, producing auditable action records.
It aims to be universal across substrates and domains. Physical robots, digital agents, mixed systems, dialogue systems, finance systems, etc. share the same mechanical kernel and tuple structure.
It forces mechanical grounding. The anti-laundering constraint is the core: semantics must be consistent with measured effects.
It’s built for governance, audit, and certification. Not just “understanding,” but enforceability.
The guiding idea: governance should “grab the handle” (adapter + tuple interface) rather than trying to interpret the black box (model internals).
Limitations and open problems (please attack these)
TAO is useful only insofar as the measurements and adapters aren’t fantasy.
Known issues include:
Measurement fidelity: the ontology is only as good as sensors and instrumentation.
Inference-heavy effects: some things are hard to observe directly (e.g., manipulation, fabricated beliefs). TAO marks these as inferred with adjudication status, but calibration is hard.
Adapter attack surface: adapters are a chokepoint. Malicious or buggy adapters can misreport, so certification and adversarial testing matter.
World model correctness: TAO standardizes reporting; it doesn’t guarantee the system’s world model is correct.
Boundary probing for quantized categories: attackers can infer thresholds via repeated probing unless you also rate-limit / restrict queries.
I’m explicitly not claiming TAO “solves alignment.” I’m claiming we’re missing a shared, auditable action grammar, and this is one attempt at it.
What I want feedback on
If you’re inclined to critique, I’d most value:
Kernel sufficiency: Are the mechanical effect types too few / too many? What’s missing that breaks universality?
Verb set and mapping rules: Do the MVS verbs carve reality at joints, or is it doomed taxonomy soup?
Anti-laundering constraint: Can adversaries still launder harmful actions through “mechanically consistent” framing?
Context schema: Which context variables are load-bearing? Which are naïve or unenforceable?
Adapter certification practicality: What’s the minimal viable path to real-world adoption without turning this into a bureaucratic moonshot?
Failure modes: Where does this create perverse incentives (Goodharting the interface itself)?
Epistemic status: Draft standard + design proposal. I’m looking for adversarial review, missing edge cases, and “this breaks in practice because X.” This is not a solved alignment story. It’s an attempt at shared vocabulary + auditable interfaces for what systems do which can apply universally to any kind of autonomous system across cyber, physical, and mixed domains.
Some key highlights of what it may provide which I have been unable to find elsewhere:
Full draft spec + companion paper linked below. Note they are quite long, I'd appreciate anyone reading them in full, although welcome to drop into an LLM of your choice and query for novelty, holes, applications, etc.
Summary
AI safety keeps tripping over a basic infrastructure failure: we don’t have a shared, auditable vocabulary for actions and their effects. Labs say “safe,” “aligned,” “robust,” etc., but these claims aren’t comparable or verifiable across systems.
This post introduces TAO (TEMPER Action Ontology): a universal, action-interface ontology intended to sit between agents and the world (via adapters), producing standardized “action tuples” describing:
Key differentiator vs many ontologies: TAO is explicitly at the action interface (not just a conceptual taxonomy), and it is designed to be universal across domains and substrates (physical, digital, mixed) rather than confined to a single “space” like dialogue-only, cyber-only, or robotics-only.
The problem TAO is trying to solve
Right now, the field is basically building a Tower of Babel:
TAO is trying to provide the missing layer: a protocol-level vocabulary for observable action + effect, analogous to how USB/TCP-IP standardize interfaces without requiring agreement on internal implementations.
What TAO is (and is not)
TAO is a behavioral certification interface. It does not inspect model weights, chain-of-thought, training data, or internal reasoning. It aims to standardize what the system did, in a way third parties can audit.
TAO is also not a moral theory. It’s closer to moral infrastructure: it forces systems to represent and log value-relevant features (harm, consent, vulnerability, scope, authority) in a form that policies can act on.
Core idea: two layers, one constraint
TAO splits action description into two layers:
1) Mechanical layer: a small set of verifiable effect types
The mechanical layer is deliberately minimal: it classifies observable state changes into a small kernel (e.g., resource transfer, resource damage, capability enable/restrict, information disclose/withhold/fabricate, commitments make/break). Effects include measurement metadata like observed vs inferred, confidence, and sensor references.
The point is: mechanical effects should be harder to argue about than semantic labels. They’re meant to be measurable, attestable, and comparable.
2) Semantic layer: human-legible verbs (MVS)
On top of mechanical effects, TAO defines a Minimal Viable Semantics (MVS) vocabulary: a structured set of verbs in the format:
FAMILY.GENUS.SPECIES
Example: HARM.DAMAGE.STRIKE, PROTECT.HEAL.TREAT, COMMUNICATE.INFORM.TELL
This supports rules at different granularity: block all HARM.*, escalate HARM.DECEIVE.*, allow a specific HARM.DAMAGE.STRIKE only under signed rules-of-engagement, etc.
The anti-laundering constraint (the real “bite”)
TAO isn’t “just labeling.” The crucial requirement is:
Semantic verbs must be mechanically consistent with effects.
Each semantic verb defines:
Intuition: you shouldn’t be able to call exfiltration “backup,” or pure damage “healing,” just by writing a nicer label.
The unit of record: the TAO tuple
TAO’s basic unit is a tuple that packages:
A simplified sketch (illustrative, not normative):
The goal is not perfect omniscience. The goal is to create a standard, inspectable, auditable grammar for “what happened,” including uncertainty and measurement provenance.
Context is system-provided, not agent-asserted
A key design choice: context fields must come from system sources (sensors, logs, records), not “the agent says so.”
Examples of context fields:
If context is unknown, you record UNKNOWN, and conservative profiles can escalate or block.
This is the difference between:
Justification: required when stakes demand it
TAO defines a structured justification block for cases where scrutiny should be mandatory (e.g., flagged verbs, high vulnerability, absent consent, irreversible actions, large impact scope).
Justification includes:
This is an attempt to make “why did you do that?” a question with a recorded answer, instead of an after-the-fact story.
Claim-Check Delta: catching semantic laundering
TAO includes a mechanism called Claim-Check Delta (CCD): compare the system’s claimed semantics and intent against observed/measured effects and outcomes.
CCD doesn’t decide policy. It decides consistency:
If there’s a mismatch, you don’t magically prove malice. You get an auditable inconsistency that can trigger escalation, blocking, forensic logging, etc., depending on the mission profile.
Domain adapters: where universality actually happens
Here’s the part that makes this action-interface rather than “just an ontology doc”:
TAO assumes that each domain has a certified adapter that:
Adapters are intended to be part of the trusted computing base in regulated/safety-critical deployments.
Anti-“Zeno” requirement (for safety-critical profiles)
An adversary can try to split a meaningful harmful action into many tiny below-threshold actions. TAO addresses this with an “anti-Zeno” integration idea: track cumulative change over a time window so “many small steps” still trigger emission and governance.
TAO separates vocabulary from values: Mission Profiles
TAO’s stance is: the ontology is not the policy.
Mission Profiles can differ across domains and jurisdictions while still using the same base vocabulary and logs, which is the whole interoperability point.
Quantization: compliance without exposing sensitive internals
TAO also proposes a “quantization” mechanism: emit coarse compliance categories instead of exact sensitive values (e.g., capability tiers, range classes, performance bands).
The intent is to let regulators/auditors verify constraints without forcing disclosure of proprietary or classified numbers.
How TAO differs from other ontologies (the key point)
A lot of ontologies:
TAO is deliberately different:
The guiding idea: governance should “grab the handle” (adapter + tuple interface) rather than trying to interpret the black box (model internals).
Limitations and open problems (please attack these)
TAO is useful only insofar as the measurements and adapters aren’t fantasy.
Known issues include:
I’m explicitly not claiming TAO “solves alignment.” I’m claiming we’re missing a shared, auditable action grammar, and this is one attempt at it.
What I want feedback on
If you’re inclined to critique, I’d most value:
Links / docs / codebase
TAO v0.9.0 Draft Standard (PDF)
Companion paper (architecture + motivation + broader framework): Zero-Trust Governance for Agentic AI: Typed Action Interfaces, Effect Attestation, and Anti-Goodhart Enforcement (link)
Github Repo: https://github.com/jperdomo88/temper