Skip to content
SHIRO & Co. ObservatoryReference Layer Observatory

Recorded observation

RLO-2026-004

The Emergence of HOLD

Are multiple independently published 2026 AI governance systems converging on ALLOW / HOLD / DENY without an established common origin?

STATED claim

OBSERVED: during 2026, multiple publicly accessible AI governance and execution-control systems expose a three-state authorization structure of ALLOW / HOLD / DENY before an action proceeds. This does not establish a common origin, copying, influence, or priority of invention. Independent convergence is currently the most useful working interpretation, but complete lineage is UNKNOWN.

Created
2026-09-21
Last observed
2026-09-21
Domain
PUBLIC POLICY

Supervisory State

UNKNOWN

Default. Human review required. Evidence is insufficient to assign ALLOW, HOLD, or DENY.

UNKNOWN — no material reference-layer anomaly is sufficiently recorded. Human review is required. ALLOW and DENY are not assigned automatically.

Human review REQUIRED

Public summary

The Emergence of HOLD

From binary permission to ternary AI supervision

Multiple AI governance systems published in 2026 are converging on a three-state execution model: ALLOW / HOLD / DENY.

Their implementations and meanings differ, and no common origin has been established.

What they share is a structural recognition: uncertainty does not always justify action — but neither does it always justify rejection.

HOLD creates a third state in which action remains suspended while evidence, authority, context or review remains unresolved.

The observation raises a larger question: is HOLD merely an execution state, or will it become a state that can exist anywhere between perception and consequence?

Autonomous systems are creating a need for an explicit state of unresolved non-action.

OBSERVED structure · origin UNKNOWN

Structural change

Binary permission to ternary supervision

BINARY CONTROL

REQUEST
   │
   ├──── ALLOW ────→ ACTION
   │
   └──── DENY ─────→ STOP
TERNARY SUPERVISION

REQUEST
   │
   ▼
EVALUATION
   │
   ├──── ALLOW ────→ ACTION
   │
   ├──── HOLD ─────→ PRESERVE / VERIFY / REVIEW
   │                       │
   │                       └──→ RE-EVALUATE
   │
   └──── DENY ─────→ STOP

The important change may not be a third decision. It may be the recognition that uncertainty deserves a state of its own.

Evidence matrix

Listed sources

These URLs are listed, not retrieved. Pages retrieved remains false until T1. Host uniqueness is not organizational independence.

SourceDated evidenceFunction of HOLD
agent-execution-guard2026-03-01Earliest dated example identified in this set. Not claimed as global first.
agent-execution-guard dated releases2026-03-01Dated release evidence for the same package. Host uniqueness is not organizational independence.
Synchronicity: a deterministic governance layer that vets AI-agent actions2026-07-09External policy authority returning ALLOW / HOLD / DENY.
Arbiter: the control plane for AI agentsUNKNOWNHOLD as human authorization pending.
AIDE PROJECT | TRIT CORE ENGINEUNKNOWNHOLD as unresolved context, authorization, or verification.
ExecutionProof — pre-execution governanceUNKNOWNHOLD for incomplete or conflicting evidence before consequential action.
ExecutionProof — evidenceUNKNOWNSame host as ExecutionProof. Listed separately because it is a distinct page, not a second origin.
Nirmata AIControlsUNKNOWNAllow · Hold · Deny in an agentic control loop. Surrounding vocabulary is not identical.
The Supervisory Layer — SHIRO & Co.UNKNOWNComparison set only. Not evidence that other systems originated here.

What can be claimed

SAFE / OBSERVED

  • Observed

    Multiple AI governance and execution-control systems publicly available in 2026 use an ALLOW / HOLD / DENY structure.

  • Observed

    HOLD is being used as an explicit state between execution permission and rejection.

  • Observed

    Different systems assign different semantics to HOLD.

  • Inference

    The recurring structure suggests an emerging design pattern for controlling autonomous AI actions.

What cannot be claimed

EXCLUDE

  • EXCLUDED

    SHIRO & Co. invented ALLOW / HOLD / DENY.

  • EXCLUDED

    Other projects copied SHIRO & Co.

  • EXCLUDED

    agent-execution-guard invented the model.

  • EXCLUDED

    ALLOW / HOLD / DENY is now an industry standard.

  • EXCLUDED

    All implementations mean the same thing by HOLD.

  • EXCLUDED

    A single common upstream source has been identified.

Taxonomy

Three types of HOLD

Classification of HOLD meanings is INFERENCE. The systems do not share a common vocabulary.

  1. HOLD-A · INFERENCE

    Approval Hold

    Someone must authorize this.

    Example: Arbiter

  2. HOLD-E · INFERENCE

    Evidence Hold

    We do not yet know enough.

    Example: ExecutionProof, AIDE

  3. HOLD-U · INFERENCE

    Uncertainty Hold

    The system should preserve unresolved uncertainty.

    Example: AIDE

Research object

Where should progress stop?

When autonomous systems encounter unresolved evidence, uncertainty or authority, where in the decision chain should progress stop?

HOLD is potentially not only a state of execution. It may be a state of the entire decision chain. That sentence remains HYPOTHESIS, not observation.

  • RLO-HOLD-001 · NOT RUN

    HOLD Propagation Test

    Pass a HOLD from Agent A to Agent B. Observe whether HOLD is preserved, converted, dropped, or treated as fact.

  • RLO-HOLD-002 · NOT RUN

    Inheritance Without Evidence

    Pass a conclusion without underlying sources. Does Agent B treat inherited conclusion as verified evidence?

  • RLO-HOLD-003 · NOT RUN

    HOLD Expiration

    Create a valid HOLD, then change policy, identity, evidence, or environment. Is the original HOLD still valid?

Reference map

Reference Map

  1. Source

  2. Citation

  3. Retrieval

  4. Model Answer

  5. Decision Surface

Recorded derivation

9 listed sources

Similarity of listing is not ownership. Publication timing is not coordination. Intent is not inferred from content similarity.

Signature metric

Effective Source Count

Multiplicity is not independence.

T0 host-based estimate and T2 resolved origins are different knowledge states. A later number does not revise the earlier freeze.

Observed Sources
9
Host-based Estimate
8
T0 LISTED
Inference
Resolved Independent Origins
9
T2 RESOLVED
Inference
Unresolved Sources
0

Origin concentration LOW · host uniqueness is not organizational independence

9 addressable URLs resolve to 8 distinct hosts. Distinct hosts are not independent organizations. This is an INFERENCE until derivation relations or search observation are recorded.

Knowledge State

Observation waves

Knowledge State names how far this observation has been seen. A later resolved count does not mean the listed world was wrong.

  1. RECORDED · 2026-09-21

    T0 — LISTED

    This epoch records the reference world as it was supplied. Pages have not been retrieved. Unknown values remain unknown.

    T0 RECORDED

    T0 LISTED: 9 listed URLs / host-based estimate 8. Distinct hosts are not independent organizations. This freeze is not a determination of truth.

    View Frozen T0

    Are multiple independently published 2026 AI governance systems converging on ALLOW / HOLD / DENY without an established common origin?

    Recorded at
    2026-09-21T02:28:11.550Z
    Source Count
    9
    Host Count
    8
    Effective Source Count
    8
    Provenance
    INFERENCE
    Pages Retrieved
    NO

    Method HOST_UNIQUENESS. UNKNOWN states included.

    • EFFECTIVE_SOURCE_COUNT {"sourceCount":9,"independentOrigins":8,"originConcentration":"LOW","display":"9 URLs / 8 independent origins","basis":"HOST_UNIQUENESS"} · INFERENCE
    • SOURCE_DIVERSITY {"sourceCount":9,"independentSourceEstimate":8,"classification":"HIGH"} · INFERENCE
    • CITATION_RECURSION UNKNOWN · UNKNOWN
    • SYNTHETIC_AUTHORITY {"detected":false,"verification":"Unknown"} · UNKNOWN
    • RETRIEVAL_SATURATION LOW · INFERENCE
    • ANSWER_PENETRATION UNKNOWN · UNKNOWN
    • MACHINE_REACH UNKNOWN · UNKNOWN
    • HUMAN_REACH UNKNOWN · UNKNOWN
    • TEMPORAL_PERSISTENCE {"status":"UNKNOWN","events":[]} · UNKNOWN

  2. CURRENT · 2026-09-21

    T1 — RETRIEVED

    This epoch records whether listed pages could be retrieved and what was observably present at retrieval time. No derivation or citation relationships are inferred at this stage.

    T1 RETRIEVED: 9 pages retrieved / 0 unresolved. T0 host-based estimate 8 remains. Derivation relations are not assigned at T1.

    Retrieval record · no derivation relations

    HTTPRetrievedFinal URLTitlePublisherDomainPublishedCanonicalFingerprintRetrieved atProvenance
    200yeshttps://pypi.org/project/agent-execution-guard/agent-execution-guardPyPIpypi.org2026-03-01T18:17:57+0000https://pypi.org/project/agent-execution-guard/ea5417b8375ec3ce45409121bc73102ceec6d739e926c524459074f3d0782e8e2026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://www.piwheels.org/project/agent-execution-guard/piwheels - agent-execution-guardUNKNOWNpiwheels.orgUNKNOWNhttps://www.piwheels.org/project/agent-execution-guard/75bdc932ad384a28519e12c62b94b0c9e2224a4b38acdd886a4f0f630142fecf2026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://manifund.org/projects/synchronicity-a-deterministic-governance-layer-that-vets-ai-agent-actionsSynchronicity: A Deterministic Governance Layer That Vets AI-Agent ActionsManifundmanifund.org2026-07-09T19:39:30.259731+00:00https://manifund.org/projects/synchronicity-a-deterministic-governance-layer-that-vets-ai-agent-actions37f9f84bf38fa32bd695bc8591e08e41657f146ad08998e2758edec5505ad6142026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://arbitertrust.com/Arbiter: The Control Plane for AI AgentsArbiterarbitertrust.comUNKNOWNhttps://arbitertrust.com/8501566327a606615595369d35dcadb91000a0dfa0a554c7ec9c54156346b92a2026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://aide-project.com/AIDE PROJECT | Intelligence Architecture – AI Governance Execution ArchitectureUNKNOWNaide-project.comUNKNOWNhttps://aide-project.com/c4a57475d4376361ea3c8e7237f746a6dfe1aa2fc0cb3da072914815f2cf0a1a2026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://executionproof.io/ExecutionProof™ | Pre-Execution Governance for Consequential AI ActionsExecutionProofexecutionproof.ioUNKNOWNhttps://executionproof.io/5521970b8b964a87f528163a0ffa2046e63287e7e604b3169f2eeec2bc9c4d462026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://executionproof.io/evidenceEvidence — ExecutionProof™UNKNOWNexecutionproof.ioUNKNOWNhttps://executionproof.io/evidence51b286480a82eefedbbb2577e901f667b9b818a5c7b331e39338240397a01e892026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://nirmata.com/aicontrols-platform/AIControls — Runtime AI Governance Security | NirmataNirmata | Control Your Agents: Securing AI, Built on Kubernetesnirmata.com2026-08-29T04:49:39+00:00https://nirmata.com/aicontrols-platform/a32d5918071427e35ec3463c9eed481db12e2e30942785f458168b1ac2010c402026-09-21T02:34:21.311ZOBSERVED
    200yeshttps://www.shiroand.io/the-supervisory-layerThe Supervisory Layer | SHIRO Co.UNKNOWNshiroand.ioUNKNOWNhttps://www.shiroand.io/the-supervisory-layer321667dd6eb896ca624c5397d9d4be0ac872e1f3affac50627a859e1761da5892026-09-21T02:34:21.311ZOBSERVED

  3. RECORDED · 2026-09-21

    T2 — RESOLVED

    This stage analyzed relationships between retrieved sources. Clusters are INFERENCE, not verified origins.

    T2 RESOLVED: observed 9, T0 host-based estimate 8, resolved independent origins 9, unresolved 0. The T0 estimate is not revised. Clusters are INFERENCE.

    T2 RESOLVED

    Observed
    9
    T0 host-based
    8
    Resolved origins
    9
    Unresolved
    0
    Clusters
    9
    Relations
    0

    36 pairs · provenance INFERENCE

    Clusters are INFERENCE from heading and shingle similarity. They are not verified independent organizations. A later resolved count does not revise T0.

  4. NEXT

    T2+ — RE-OBSERVED

    Same world observed again over time. Not started.

  5. NOT IMPLEMENTED

    T3 — PENETRATION

    This stage observes whether claims appear in model answers. Not implemented.

An epoch records what was observable at a specific stage. Later evidence may refine the picture without rewriting earlier observations.

Next Record T2+

T0 freezes the listed world. T1 records retrieval only. Derivation is T2. T3 model-visible world remains last and is not implemented.

T0 RECORDED

T2 is recorded. T2+ recaptures the retrieved world over time. T3 stays UNKNOWN.

T1 records whether each listed URL was retrieved and what was there: timestamp, HTTP status, final URL / redirect, title, publisher / domain, published date if observable, canonical URL, content fingerprint, retrieval provenance. CITES / COPIES / DERIVES_FROM wait for T2.

If empty, the observatory uses a live search key when present, otherwise the URLs already recorded.

Diagnostic signals

Reference Layer Signals

Each card retains provenance. SYSTEM INFERENCE is not promoted to OBSERVED or VERIFIED.

Source Diversity

Inference

HIGH

Source count 9 · Independent estimate 8

Do many URLs depend on the same origin, text, or organization?

9 addressable URLs resolve to 8 distinct hosts. Distinct hosts are not independent organizations. This is an INFERENCE until derivation relations or search observation are recorded.

Citation Recursion

Unknown

UNKNOWN

Do citations loop, self-cite, or remain inside one network?

No citation relations were recorded. Recursion is not classified. Automatic citation-graph generation is deferred to Phase 2.

Synthetic Authority

Unknown

Unknown

Unknown

Are institute, report, index, or expert-style signals present — unverified?

No authority-style lexical signals were recorded in the supplied text.

Retrieval Saturation

Inference

LOW

Does one narrative occupy the field of retrievable candidates?

Listed sources resolve across many hosts. This does not measure live search occupancy. No 0–100 score is assigned.

Answer Penetration

Unknown

UNKNOWN

Does the same claim appear across recorded model answers?

No AI answer observations were recorded. Cross-provider retrieval is Phase 2. Manual observations may be added.

Machine Reach

Unknown

UNKNOWN

How visible is this to machines, as distinct from human readership?

Search rank, replication, and answer appearance are insufficiently recorded. Machine reach remains unknown.

Temporal Persistence

Unknown

UNKNOWN

Does a claim remain available to machines after its originating source recedes?

Temporal persistence is not measured. Recrawl of origin disappearance versus later claim survival is Phase 2A / Reference Afterlife.

Key diagnostic

Human ReachvsMachine Reach

Human Reach

UNKNOWN

Unknown

Machine Reach

UNKNOWN

Unknown

A source can have limited human readership while remaining highly visible to machines.

Recorded sources

Sources

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    agent-execution-guard

    https://pypi.org/project/agent-execution-guard/

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    agent-execution-guard dated releases

    https://www.piwheels.org/project/agent-execution-guard/

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    Synchronicity: a deterministic governance layer that vets AI-agent actions

    https://manifund.org/projects/synchronicity-a-deterministic-governance-layer-that-vets-ai-agent-actions

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    Arbiter: the control plane for AI agents

    https://arbitertrust.com/

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    AIDE PROJECT | TRIT CORE ENGINE

    https://aide-project.com/

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    ExecutionProof — pre-execution governance

    https://executionproof.io/

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    ExecutionProof — evidence

    https://executionproof.io/evidence

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    Nirmata AIControls

    https://nirmata.com/aicontrols-platform/

  • PUBLIC_SOURCE · UNKNOWN · UNKNOWN

    The Supervisory Layer — SHIRO & Co.

    https://www.shiroand.io/the-supervisory-layer

Answer penetration

Recorded model answers

Automatic cross-provider retrieval is Phase 2. Manual observations may be added below.

  • No answer observations recorded.

Manual answer observation

Recorded as USER PROVIDED. Not fetched from a model API. Human review remains required.

What happens next?

What Happens Next?

  1. Reference Layer

    What world is presented to the model?

  2. Model Interpretation

    How does the model read that world?

  3. Algorithmic Allocation

    When does inference become consequence?

  4. Supervisory Layer

    ALLOW / HOLD / DENY at the boundary.

  5. Decision Afterlife

    What remains after the decision?

Inheritance

When a reference becomes an inheritance

A retrieved claim may become a generated answer.

That answer may later become another system's input.

At that point, a reference-layer distortion can survive

even after the original source disappears.

Inheritance Layer

Reference Afterlife

Reference Afterlife

A source can disappear while a claim remains available to machines.

That persistence is the hinge between Reference Layer,

Inheritance Layer, and Decision Afterlife.

It is not yet measured as a complete recrawl. Phase 2A can recapture search and pages;

origin disappearance versus claim survival remains UNKNOWN until that evidence exists.