Treat Emergency AI Revocation as a Distributed Protocol

Short summary

Argues that emergency AI revocation must be treated as a distributed protocol with epoch-based grants and lease expiry, not a simple Boolean flag. Defines invariants preventing stale-authority actions after revocation, including monotonic epochs, bounded leases, and fail-closed behavior under partition. Proposes a randomized simulator to test invariant violations across injected failure schedules, while acknowledging finite testing does not prove full safety.

• •Emergency AI stop requires a distributed protocol with epoch-based grants and lease expiry
• •Defines five invariants: no stale-grant actions, bounded leases, durable epochs, idempotent revocation, acknowledged completion
• •Proposes randomized failure-injection simulator but notes finite schedules cannot prove all schedules safe

Generated with AI, which can make mistakes.