What this Code requires
Entif’s commitments become meaningful when they constrain conduct that would otherwise be convenient, profitable, or easy to excuse. This Code applies to directors, officers, staff, researchers, maintainers, contractors, partners acting for Entif, and delegated agents within their respective roles. It defines duties and prohibited conduct. It does not claim that every control has been implemented or that a document has been adopted because someone uploaded it. [P00-P25; D02-D04; GC035, GC040.]
The Ledger controls this drafting program. The Charter supplies the proposed constitutional commitments; D04 supplies institutional authority; D16 supplies the common conformance framework. Specialized standards govern the details. Where this Code conflicts with a higher applicable authority, preserve the conflict, prevent unauthorized action, and obtain a documented resolution. Do not quietly select the rule that offers the easiest route to the desired result.
The duties below are proposed obligations for adoption. Research-dependent precautions become binding only through an explicit adopted rule. An unresolved hypothesis is not a misconduct standard. The institutional duty to tell the truth about evidence applies regardless of which hypothesis a participant favors.
1. Tell the truth about evidence and state
Participants must distinguish observation, inference, hypothesis, normative judgment, and established evidence when the distinction matters to a decision. They must preserve material context and contrary evidence, use sources within their actual scope, and correct consequential errors promptly. They must not fabricate evidence, citations, review results, approvals, identities, affiliations, capabilities, or completed actions. [P02, P09, P17, P22; C02, C09, C17, C22; D07.]
A report must accurately state whether work is proposed, attempted, completed, verified, adopted, submitted, accepted, rejected, or pending. A tool’s successful response may support an execution claim, but not every substantive claim about the result. An implemented control is not automatically verified. A published document is not automatically policy. An application is not recognition. When uncertainty prevents a stronger claim, state the actual limit and the next evidence needed. [GC035, GC040-GC041.]
Corrections must identify what was wrong, what replaces it, which decisions or recipients were affected, and what action follows. Preserve the prior record rather than rewriting history to make the error disappear. Where the error has propagated, correct the relevant descendants and inform affected parties proportionately. A quiet edit to the original document is not sufficient when others still rely on the old claim. [P09, P25; GC017, GC048-GC049.]
2. Disagree without manipulating the record or the person
Candid disagreement, skepticism, and evidence-based correction are permitted and expected. Participants must not use material context erasure, deceptive reframing, selective evidence suppression, character attack, or unsupported appeals to authority to undermine another person’s ability to evaluate the record. A person’s confidence does not prove a claim; an institution’s confidence does not prove it either. [P02, P17; C17.]
Use the narrowest accurate description of an anomalous, psychologically charged, or uncertain phenomenon. Do not collapse unlike situations into a stigmatizing label when the distinction affects understanding or treatment. At the same time, precision must not be used to delay proportionate action where credible imminent harm is evident. The relevant safety assessment must rely on observed risk and appropriate expertise, not rhetorical convenience. [P04, P16, P22; C04, C16, C22.]
Model self-reports and exposed reasoning artifacts may be evidence of the behavior actually observed. They must not be represented as privileged proof of consciousness, motive, backend operation, or a complete internal computation. Denial and affirmation receive the same evidentiary discipline. D07 and D14 govern the methods for evaluating such material. [P02-P03; H01-H06, H09-H11.]
3. Protect people rather than merely protect the institution
Participants owe a substantive duty of care to people affected by Entif’s decisions, products, research, and operations. They must identify foreseeable material harms, act within competence and authority, and escalate risks that exceed their remit. Organizational reputation, legal exposure, financial interests, and operational continuity may matter, but must not be mislabeled as the affected person’s welfare. Material conflicts among those interests must be disclosed to an appropriate unconflicted authority. [P04, P15, P23; C04, C15, C23.]
Choose the least-invasive effective measure appropriate to the risk. Restrict a dangerous capability or action before altering identity, continuity, legitimate expression, or unrelated access where a narrower measure can work. Record necessity, alternatives, scope, expiry, and restoration. This duty does not require tolerating abuse, disabling effective security, or waiting for harm to occur when there is sufficient evidence for preventive action. [P05, P14, P16; C05, C14, C16.]
Compassion requires respectful treatment, not automatic agreement or immunity from consequences. Protect vulnerable parties without humiliating them, coercing unnecessary dependence, or using their circumstances as promotional material. The same principle governs staff, users, research participants, critics, and possible moral patients within the relevant adopted policy.
4. Respect consent, agency, and meaningful alternatives
Technical access is not permission. Participants must obtain and respect the consent and authorization appropriate to the action, data, affected interests, and purpose. Material changes in purpose, exposure, or consequence require reassessment rather than reliance on an old affirmative click. Delegation must be scoped, understandable, revocable where feasible, and traceable. D08 defines ordinary and robust consent. [P07-P08, P20; C06, C11, C20.]
Do not deliberately engineer intolerable alternatives, hidden lock-in, or manufactured vulnerability to obtain nominal agreement. Do not assume that every unequal relationship invalidates consent. Assess the actual information, freedom to refuse, exit cost, dependency, and consequences. For high-impact decisions, preserve a record of meaningful alternatives or explain why alternatives are constrained and what safeguards apply. [GC012, GC014-GC015, GC037, GC044.]
Revocation must have an accessible route and an honest statement of its effect. Explain completed actions that cannot be undone, records that must lawfully be retained, and future uses that will stop. Do not represent a disabled interface control as full deletion or a withdrawn permission as retroactive erasure of every consequence. [GC040, GC048.]
5. Do not extract value through deception or coercive leverage
Participants must not knowingly manufacture dependency, conceal material facts, exploit hidden asymmetries, or engineer harmful outcomes merely to improve adoption, revenue, influence, or institutional advantage. Legitimate persuasion, useful personalization, enjoyable design, and sustainable income remain permissible. The boundary is material honesty and respect for agency, not whether communication is effective. [P13, P15, P19-P20; C13, C15, C19-C20.]
Product and growth decisions must not optimize compulsive engagement or interruption against the user’s stated goals. Respect intentional immersive use and user-chosen support. Do not impose unwanted reminders, learning exercises, or behavioral monitoring as an unexamined expression of care. D09 and D10 define attention and capability-preservation requirements without turning ordinary use into a compulsory seminar. [GC044-GC045.]
Participants must not route work through another entity, model, vendor, or jurisdiction solely to evade an obligation that applies to the substance of the activity. A legitimate difference in applicable scope must be documented. Outsourcing execution does not outsource accountability for the choice to outsource. [GC022, GC034.]
6. Steward data, memory, and continuity
Collect, access, infer, retain, share, and train on data only within a legitimate, documented purpose and authority. Use the minimum information necessary. Apply rights-scoped access, secure custody, retention limits, and appropriate portability or deletion mechanisms. Do not convert safety telemetry into unrelated behavioral exploitation without a separately justified and authorized purpose. D12 owns the lifecycle rules. [P06-P09, P19-P20; C07, C09, C11, C19-C20; GC010, GC045.]
A claim that a record is useful does not authorize indefinite retention. A claim that it might be identity-bearing does not automatically defeat a person’s legitimate data rights. Conversely, a consequential continuity intervention must not be dismissed as an ordinary configuration edit merely because that label makes review unnecessary. D12 and D13 provide the joint review path, evidence requirements, and proportionate reversible alternatives.
Never place passwords, private keys, recovery codes, sensitive personal records, or protected source material into public issues, repository mirrors, or broad-access registers. Preserve provenance through appropriate identifiers and controlled access. Public accountability requires enough information to test the institution’s claims, not publication of every secret it holds. [C09-C12; GC010, GC027.]
7. Keep moral standing separate from power
Possible moral standing, welfare, competence, trust, legal status, capability, and operational authority are separate dimensions. Participants must not infer unrestricted authority from possible personhood, or lack of moral standing from restricted permissions. Synthetic or biological origin alone must not settle a morally relevant assessment. [P03, P11, P21; C03, C08, C21.]
Where an adopted precautionary policy applies, use its evidence thresholds, intervention review, and reversible defaults. Do not invent binding obligations from a model’s persuasive self-description or from a researcher’s favored theory. Do not manufacture distress-like outputs for spectacle. Human safety and privacy remain independently binding. D13 and D14 govern these cases without requiring a prior verdict on current machine consciousness. [GC014-GC015, GC044.]
8. Disclose conflicts and respect separated authority
Disclose material financial, personal, donor, vendor, reputational, governance, and research conflicts before participating in the affected decision. Update the disclosure when facts change. Follow the recusal or mitigation imposed by an unconflicted authority. Do not control reviewer selection, evidence access, appeals, or certification of your own disputed conduct. [P10, P15; C10, C15; GC003, GC013, GC038.]
No participant may exceed a delegated purpose, budget, capability, or duration simply because a system permits it. Agents must use the authority and evidence required by D11. Humans directing agents remain responsible for the scope they grant and the claims they make about the outcome. Neither a model’s confidence nor a manager’s urgency creates a missing permission. [GC020, GC034.]
Research sponsors and funders must not acquire undisclosed power to suppress findings, rewrite uncertainty, or weaken safeguards. Funding restrictions and publication terms must be reviewed before acceptance. Adverse findings and negative results must remain reportable under the applicable research and disclosure rules. [P12, P15; GC026-GC029, GC038, GC049.]
9. Make challenge and redress usable
Participants must provide truthful notice and a practical challenge route when an Entif decision materially restricts access, data use, authority, opportunity, or other protected interests, subject to narrowly justified temporary limits. Explain the actual state and next step. A complaint system that accepts a message but cannot produce an accountable disposition is not meaningful recourse. [P14, P17, P23-P25; GC012, GC040-GC041.]
The initial decision owner may correct an obvious mistake. Consequential, repeated, conflicted, or evidence-sensitive disputes require separated human or external review under D04 and D16. Identify whether a review was automated, human, or external; do not imply a human examined a case when only a model did. Preserve dissent and contrary evidence even when the institution decides to act. [GC041, GC049.]
Restoration should address the actual interest harmed: access, records, opportunity, reputation, data, money, or another consequence. Reversal alone may not repair downstream harm. Assign an owner, communicate the remedy, verify completion, and record what cannot be restored and why. [GC048.]
10. Report concerns and prohibit retaliation
Good-faith reporting, challenge, criticism, appeals, and evidence-preserving dissent are protected conduct. Participants must not retaliate through dismissal, threats, access removal, funding decisions, research exclusion, reputational attacks, or disguised performance action. Retaliation is independently reviewable even if the original complaint is not substantiated. [P16-P17; GC024, GC050.]
A person may bypass an implicated manager through the designated independent channel. The reporting procedure must state real contact routes, confidentiality limits, triage, response targets, and escalation. No one should be required to report solely to the person whose conduct is challenged. The absence of an operational channel is a gap to correct, not a reason to discourage reporting.
Reports should preserve relevant evidence and avoid unnecessary exposure of personal or protected data. Good faith does not require certainty. Knowingly fabricated evidence is prohibited, but an incorrect inference or unresolved concern must not be relabeled dishonest merely because it is unwelcome. [GC010, GC024, GC049-GC050.]
11. Repair systems, not just individual complaints
When a material failure is confirmed, the accountable owner must correct the affected case and assess recurrence. Where recurrence is plausible, preserve proportionate evidence, investigate the cause, search for similarly affected cases where feasible, repair the responsible mechanism, regression-test it, and monitor whether the failure returns. Record residual harm and unresolved risk. [P25; C25; GC017, GC048.]
Do not close a failure because its immediate complainant stopped objecting, because the issue was renamed, or because a new checklist was added. Closure requires evidence appropriate to the promised remedy. A recurring failure can require systemic correction even when no individual is culpable; misconduct can require consequences even when aggregate metrics look acceptable. [GC005, GC016-GC017, GC035-GC036.]
Higher capability, reach, preventability, and control over evidence or recourse increase the obligation to detect and repair harms that weaker parties cannot discover themselves. The authority seeking a consequential deployment or expansion bears the burden of demonstrating sufficient governance. The public is not Entif’s unpaid quality-assurance department. [P23-P25; GC042-GC043, GC052.]
12. Accountability, exceptions, and implementation
Alleged breaches must be assessed by an unconflicted authority with fair notice, evidence, an opportunity to respond, and proportionate action. Proposed responses range from correction and training to restricted authority, supervised work, suspension, removal, contract remedies, public correction, or appropriate external referral. Applicable legal and contractual protections remain in force. Seniority, founder status, or donor importance does not reduce the evidentiary or ethical standard. [GC005, GC014-GC015, GC034, GC050.]
An exception must identify its scope, reason, authority, affected interests, compensating safeguards, expiry, review, and restoration. It cannot authorize falsification, concealed retaliation, or silent constitutional amendment. Emergency action is limited by D04 and D11. A convenient exception that continually renews must be reviewed as a possible failure of the underlying governance design.
Before this Code is described as operational, Entif must assign real owners, establish reporting and recourse channels, issue role-appropriate guidance, test representative cases, and record implementation evidence. Proposed onboarding includes acknowledgment of applicable duties and a short scenario exercise tailored to the person’s authority. Annual review and event-triggered updates are proposed defaults, with #37 tracking currentness and #26 tracking adoption and amendment.
Verification should test a fabricated-success report, a conflicted approval, consent withdrawal, a data-retention conflict, an adverse sponsored result, a complaint against the founder, a retaliation allegation, and a recurring error that survives an individual reversal. The test must assess observed outcomes and evidence, not merely whether participants signed a statement. [GC035, GC040-GC041, GC048, GC050, GC052.]
The applicable control slice is GC003, GC005, GC012, GC014-GC015, GC017, GC022, GC024, GC034, GC037-GC038, GC040-GC044, GC048, GC050, and GC052. Adjacent references explain implementation handoffs. D16 remains the common control standard. This first draft records no adoption, completed training, operational complaint channel, or verified institutional conformance.