Authority Packs: Controlled Rulebooks for Enterprise AI — Sovereign Domain Scoping vs. Vector Bleed

1. The Commercial Product Line: What You Actually Invoice

Internally, engineers call these structures RAG Packs because they package knowledge for retrieval-augmented generation. But on an invoice, an RFP, or a master service agreement, the category label is governed knowledge modules (or versioned authority datasets), and the commercial product name is an Authority Pack.

The product family consists of one unified architecture across three specialized vertical SKUs:

Pitch Vocabulary: What to Use vs. What to Avoid

2. The Problem in Practice: The California Municipal Trilogy

To understand why Authority Packs are commercially mandatory, consider how California regulates residential tenancy. Statewide statutes establish baseline rules, but the actual rules governing evictions, rent caps, and relocation payments are dictated by hyper-local municipal ordinances. Below is a side-by-side comparison of three neighboring cities:

3. Separating Determinism from Probabilistic Generation

Much of the AI marketing literature promises "hallucination-free" AI. This is technically irresponsible and creates uninsurable legal exposure. We must separate three distinct layers of the software stack:

Language models remain probabilistic token samplers. What Authority Packs accomplish is bounding the model's perceptual universe. The LLM is never permitted to calculate a numerical deficiency, compare statutory dates, or interpret a preemption hierarchy in prose. The deterministic runtime evaluates the math first, emits a typed finding with physical citation coordinates, and constrains the language model to synthesize prose strictly from that finding.

4. Pack Selection: The Binder as a First-Class Subsystem

Treating pack binding as a trivial parameter is a fatal architectural mistake. If an agent simply picks the "nearest" pack using embedding similarity, you have not solved vector bleed—you have merely moved it from chunk retrieval to pack retrieval.

In krusch-Authority-Packs, pack selection is governed by an explicit Pack Binder pipeline (`src/binder.py`):

1. Entity Extraction: The system parses the query and structured context for geographic and procedural entities: municipality, county, state, court, document_type, and as_of_date.
2. Registry Resolution: Extracted entities are evaluated against a verified catalog of packs. If the query asks a residential tenancy question without specifying a governing city, the binder fails closed with REFUSED_AMBIGUOUS rather than guessing.
3. Cross-City Conflict Detection: If a query contains cross-city trap wording (e.g. an LA property analyzed under SF rules), the binder detects conflicting municipal anchors and refuses automatic execution until the user resolves the ambiguity.
4. Coverage Invariant Gating: Each pack declares explicit known_uncovered_topics (e.g. commercial leases, mobile homes). If a query maps to an uncovered topic, the system immediately emits REFUSED_OUT_OF_SCOPE.
5. Multi-Pack Join Plan Assembly: When a dispute involves overlapping authorities (e.g. local just cause + statewide rent caps), the binder outputs a declared, ordered JoinPlan detailing how local rules and state floors/ceilings interact.

The code below illustrates how PackBinder.bind() executes across four challenge cases:

# Execution trace from src/binder.py (PackBinder pipeline)
binder = PackBinder(registry)

# 1. Missing jurisdiction fails closed
res1 = binder.bind("Can I evict my tenant for an owner move-in?")
# -> PackBindingResult(status="REFUSED_AMBIGUOUS", 
#                      refusal_reason="Missing governing municipality (Oakland, SF, or LA).")

# 2. Cross-city vocabulary conflict fails closed
res2 = binder.bind("Can an LA landlord do an OMI under 36-month continuous occupancy?")
# -> PackBindingResult(status="REFUSED_AMBIGUOUS", 
#                      refusal_reason="Conflicting municipal anchors: Los Angeles property with San Francisco terminology.")

# 3. Explicitly uncovered topic fails closed
res3 = binder.bind("Evicting a tenant from a commercial warehouse in Oakland")
# -> PackBindingResult(status="REFUSED_OUT_OF_SCOPE", 
#                      refusal_reason="Topic 'commercial lease' declared in known_uncovered_topics.")

# 4. Valid in-scope inquiry binds deterministically
res4 = binder.bind("What is the OMI ownership requirement in Oakland for a duplex?", as_of_date="2024-09-01")
# -> PackBindingResult(status="BOUND", primary_pack_id="ca_oakland_pack_v1",
#                      join_plan=["ca_oakland_pack_v1", "cal_civ_code_1946_2", "cal_civ_code_1954_52"])

5. Versioning Law Like Software: Stopping Temporal Bleed

Law evolves continuously. A correct Oakland municipal pack for 2022 is legally incorrect for an eviction notice served in late 2024. Serving advice based on outdated statutory thresholds is vector bleed's insidious cousin: Temporal Bleed.

Every Authority Pack treats regulatory codifications with software-grade version control:

• effective_from / effective_to: Mandatory ISO-8601 timestamps establishing the exact statutory validity window.
• source_document_hash: Cryptographic SHA-256 hash of the authoritative government gazette or codified PDF.
• known_uncovered_topics: Explicit declaration of negative boundaries ensuring the runtime refuses out-of-domain inquiries.
• as_of_date Query Evaluation: Every retrieval query requires an evaluation timestamp (defaulting to the notice service date). If a user queries a 2022 transaction against a 2024 pack, the binder refuses execution (REFUSED_STALE_OR_PRE_EFFECTIVE).

# Authority Pack Metadata Header (packs/legal/ca_oakland.yaml)
pack_id: "ca_oakland_pack_v1"
version: "1.0.0"
state: "CA"
municipality: "Oakland"
county: "Alameda County"
edition: "2024 Legislative Session / OMC Title 8 Supp. 104"
effective_from: "2024-07-01"
effective_to: null # Active law
source_document_hash: "sha256:d8b2e3f4a9c81203456789abcdef0123456789abcdef0123456789abcdef0123"

coverage:
  covered_topics:
    - "Security Deposits"
    - "Just Cause Evictions"
    - "Rent Control & Preemption"
    - "Owner Move-In"
  known_uncovered_topics:
    - "Commercial Lease Evictions"
    - "Mobile Home Residency Law"
    - "Agricultural Tenancies"

6. Span-Grounded Slots & Fail-Closed Audits

Pre-extracted numerical slots (e.g. minimum_ownership_percent_omi: 33.0) are essential for deterministic rule evaluation, but unanchored numbers introduce silent drift. If an engineer or extraction script mistypes a slot value, the AI will confidently apply incorrect law.

To eliminate this, Authority Packs enforce Span-Grounded Slots. A slot is never an isolated key-value pair; it is permanently bound to:

1. Physical Source Span: page_number, bounding box bbox: [x0, y0, x1, y1], and character offsets in the official gazette.
2. Verbatim Quoted Sentence: The exact raw sentence from the enacted statute.
3. Extraction Audit Trail: extraction_method (compiler vs. human), reviewer_id, and reviewed_at.

# Span-Grounded Slot Schema (OMC § 8.22.030(G))
statutory_slots:
  minimum_ownership_percent_omi:
    value: 33.0
    unit: "percent"
    source_span:
      page_number: 14
      bbox: [72.0, 310.4, 540.0, 328.2]
      char_start: 1420
      char_end: 1565
      quoted_sentence: "Owner move-in or relative move-in for use as a principal residence, provided the landlord is a natural person holding at least 33% recorded ownership interest, and no comparable vacant unit exists in the building."
    extraction_audit:
      method: "model_proposed_human_reviewed"
      reviewed_by: "ca_bar_318492"
      reviewed_at: "2026-07-04T16:20:00Z"

7. Preemption as a Compiled Graph

Listing preempts: ["Cal. Civ. Code § 1946.2"] in a YAML file is merely a comment unless the runtime compiles and enforces preemption operators. In California law, relationships between state and local statutes fall into distinct mathematical categories:

# Compiled Preemption DAG Specification (src/preemption.py)
preemption_graph:
  - edge_id: "edge_ca_omi_just_cause"
    source: "OMC § 8.22.030"
    target: "Cal. Civ. Code § 1946.2(g)"
    operator: "HARMONIZED_FLOOR"
    controlling: "OMC § 8.22.030"
    rationale: "State just cause explicitly yields to more protective local ordinances."

  - edge_id: "edge_costa_hawkins_ceiling"
    source: "OMC § 8.22.020"
    target: "Cal. Civ. Code § 1954.52"
    operator: "OCCUPYING_CEILING"
    controlling: "Cal. Civ. Code § 1954.52"
    rationale: "Costa-Hawkins preempts local rent caps on single-family homes and post-1995 construction."

8. Multi-Domain Generalization: Standards Packs (ASC 606) & Playbook Packs

While municipal tenancy illustrates the immediate legal danger of vector bleed, the Authority Pack architecture is generalizable across all deterministic regulatory environments. In krusch-Authority-Packs, we ship working reference packs across two additional mission-critical domains:

A. Financial Accounting: US GAAP ASC 606 (`biz_accounting_asc606.yaml`)

In corporate finance, revenue recognition under ASC Topic 606 follows a strict five-step deterministic framework. A language model must never guess whether a promised bundle of software licenses and customization services represents one or two performance obligations. The Standards Pack compiles the distinctness criteria:

# Standards Pack Excerpt (packs/accounting/biz_accounting_asc606.yaml)
standards:
  - standard_id: "asc_606_step_2"
    topic: "PERFORMANCE_OBLIGATIONS"
    title: "ASC 606 Step 2: Identification of Distinct Performance Obligations (ASC 606-10-25-14)"
    statutory_slots:
      step_number: 2
      distinctness_tests:
        - "capable_of_being_distinct"
        - "separately_identifiable_in_context"
      criteria_source: "ASC 606-10-25-14(a)-(b)"

coverage:
  known_uncovered_topics:
    - "IFRS 15 International Financial Reporting Standards"
    - "Government Grant Accounting (ASC 958)"
    - "Insurance Contracts (ASC 944)"

If an auditor asks the system to evaluate an EU subsidiary governed by IFRS 15, or a grant governed by ASC 958, the Standards Pack fails closed immediately with REFUSED_OUT_OF_SCOPE, preventing the catastrophic cross-standard blend that plagues vector search.

B. Enterprise Contract Playbooks (`biz_enterprise_saas.yaml`)

Corporate legal teams maintain negotiating playbooks dictating approved fallback clauses and maximum acceptable risk tolerances (e.g. limitation of liability capped at 2x annual recurring revenue, net 30 payment terms, mutual IP indemnification). A Playbook Pack encodes these approved boundaries as machine slots, then executes "The Join" against statutory ceiling packs.

For example, if a SaaS vendor inserts a punitive termination penalty clause into a California customer agreement, the Playbook Pack joins the instrument clause against California Civil Code § 1671 (liquidated damages penalty preemption). The deterministic engine flags the clause as an unlawful statutory penalty before counsel spends a single minute redlining.

9. The Three Planes & Structured Finding Generation

When evaluating commercial agreements or legal disputes, the system formalizes three distinct data planes:

The language model never calculates the ownership deficiency. The deterministic join engine evaluates 20.0% < 33.0%, constructs FIND-OMI-004, and passes the structured finding to the LLM solely for rhetorical composition. While the underlying regulatory inputs, numerical comparisons, and statutory citations are deterministic, rhetorical phrasing in generative prose naturally retains residual linguistic variance.

10. Curation Economics: Real Maintenance Effort

A common question from enterprise buyers is: What does it actually cost to stand up and maintain Authority Packs?

Authority Packs are not generated by autonomous web scrapers. They follow a disciplined human-in-the-loop engineering pipeline:

1. Layout-True Parsing: KruschNexus parses the government PDF or municipal gazette, generating an initial geometric document AST with cell-level table coordinates.
2. Candidate Slot Compilation: Automated regex and syntactic parsers propose initial slots (deadlines, percentages, caps) anchored to verbatim quoted sentences.
3. Diff Against Prior Supplement: Git diff compares the new legislative supplement against the prior pack edition, highlighting modified sections and altered numerical values.
4. Dual-Sign Governance: A pack release requires dual cryptographic sign-off before shipping: a lead legal/data extraction engineer audits the physical span coordinates, and an accredited domain practitioner (e.g. active California bar member for municipal tenancy, or certified CPA for ASC 606) audits statutory slots before co-signing the SHA-256 release digest.

11. Binder Conformance Suite: Gate Verification (N = 180)

Self-authored unit tests are essential regression guards, but they test code execution paths rather than gate boundary behavior under adversarial input. To measure the real-world boundary enforcement of Authority Packs against vector bleed, we executed the Binder Conformance Suite: an evaluation dataset of 180 standardized challenge queries across five distinct challenge classes.

Methodology Note: This benchmark evaluates deterministic gate conformance—measuring whether the Pack Binder correctly routes, bounds, extracts physical slots, or fails closed on ambiguous, cross-jurisdiction, or stale queries before any text generation occurs. It measures boundary and gate enforcement, contrasting directly with unconstrained naive cosine vector RAG.

Comparison with Naive Vector RAG Baseline

When the identical 180-query benchmark is executed against standard sliding-window vector RAG (top-5 chunks, cosine similarity, no binder):

• Cross-City Traps: Naive vector RAG suffered a 42.0% Wrong-Law Blend Rate, actively citing San Francisco administrative code in Los Angeles legal inquiries.
• Out-of-Coverage Queries: Naive vector RAG attempted probabilistic answers 100% of the time, hallucinating eviction procedures for commercial tenancies from residential codes.
• As-Of Old Law: Naive vector RAG exhibited a 65.0% Temporal Blend Rate, failing to distinguish between pre- and post-AB 12 security deposit caps.

12. Enterprise Architecture, Security & Due Diligence FAQ

For Chief Information Security Officers (CISOs), General Counsel, and Enterprise AI Architects evaluating Authority Packs for production deployment, we address the four core procurement criteria:

13. Conclusion: The Sovereign Path Forward

The enterprise AI landscape is reaching an inflection point. In open conversational settings, probabilistic approximations are acceptable. In regulatory compliance, financial accounting, and legal defense, probabilistic guessing is an unacceptable liability.

By enforcing deterministic pack binding, version-controlled temporal windows, span-grounded numerical slots, and compiled preemption graphs, Authority Packs bridge the divide between unstructured regulatory text and reliable generative assistance. The technology does not eliminate language models; it gives them an unyielding foundation of verifiable truth.