10Chapter 10.0 · Governance and compliance

Governance is defined by what it withholds

The protocol's commercial value rests on counterparties being able to contract without pricing in the risk that a future vote changes the terms.

10.1 · Withheld decisions

Three categories sit permanently outside token voting

Governance can change what the protocol does next. It cannot reach backward into an instrument it has signed.

Quality-floor standards

The standards that decide whether a corpus is fit for licensing into regulated use. A body able to lower a floor to admit more supply could degrade the material the whole commercial premise depends on.

Individual adjudication outcomes

Holders may set panel rules, severity weights and appeal thresholds. They may not reverse a specific finding — appeals require a process, not a vote.

Existing counterparty obligations

Executed licence terms, gateway arrangements in force and published disclosures do not become revisable because a majority would prefer otherwise.

10.2 · The three chambers

Composition differs because the knowledge differs

Chamber I

Holders' Assembly

All staked participants, weighted by stake and lock duration.

  • Emission parameters
  • Treasury allocations within published bands
  • Licence tariff bands by class
  • Language registry admissions
  • Amending the framework, within the Column
Chamber II

Adjudication Council

Bonded validators, weighted by adjudication accuracy and volume — not by stake alone.

  • Quality floors by class
  • Severity weights by offence type
  • Appeal thresholds
Chamber III

Technical Stewardship Committee

Engineering and security contributors appointed by the Assembly on the Council's nomination. Term-limited; no concurrent Council seat.

  • Execution-environment upgrades
  • Bridge controls
  • Emergency pause
The Unamendable Column

No vote of any body may alter these

Amending the Column needs the highest supermajority in the framework, plus a fixed interval between passage and effect — so a decision made in unusual market conditions cannot execute before reversal is possible.

  1. Authorise supply above the fixed maximum
  2. Create a redemption right or a revenue distribution
  3. Remove the bonded requirement from any actor class
  4. Alter the burn destination rules
  5. Extend emissions beyond the pool exhaustion point
Fig. 10.2Decision authority across the three chambers, bounded by the Unamendable Column.
10.3 · Data protection architecture

The registry records claims about material — never the material

Consent scopes are stored as hashes of a structured attestation held off-chain. The public record shows that a scope exists and its class, without disclosing its terms.

On-chain

Small, non-reversible, meaningful in aggregate

Consent scope hashes Verification attestations Quality tier assignments Permitted jurisdiction of processing Retention limits Licence issuance records Revocation records Supply registry entries
Never on-chain

Nothing an individual could be reconstructed from

Raw corpora Model weights Transcript content Speaker recordings Identity documents
Erasure

Propagates forward

Withdrawal removes a corpus from active storage, blocks new licences and derived assets, and records the revocation on-chain. It cannot reach weights already trained — and the framework says so.

Access control

Jurisdictional refusal at the gateway

A gateway can refuse requests from jurisdictions it is not authorised to serve. Compliance is partly delegated to intermediaries with direct regulatory exposure.

Fig. 10.4The structural boundary between on-chain claims and off-chain custody.
10.4 · The Settlement Gateway Layer

Four functions. No customer funds, at any point.

Fees in local currencies are collected by regulated intermediaries under licences the protocol does not hold. The gateway layer is how those claims reach the registry — and how distributions leave it.

Receive

Settlement instructions arrive through whichever regulated channel is lawful in the jurisdiction.

Convert

Fiat converts to TLVY only where the protocol's own share is realised — never for counterparty-facing transactions.

Screen

Sanctions and wallet-level checks run before any distribution instruction is released.

Report

Reports reconcile against issued licences and recorded tasks in the registry.

A counterparty's bill stays in its own currency from quotation to settlement.

The token-level event is invisible to the counterparty, which keeps the necessity test honest: no customer is ever asked to price token exposure into a service contract.

Multi-gateway operation is the default. Several gateways run in parallel with per-jurisdiction configuration, refusal rights and independent reconciliation — and a failure to reconcile halts issuance.