Definitions for the WorldModel™ framework — the ten architectural layers, the eleven cross-cutting policies, and the general vocabulary used across the reference, the architecture, and the companion books. Terms are alphabetized within each section.
Each layer has a defined role, an enforceable interface, and a precedence relationship to the others. Listed in canonical order.
The declared priorities, rights, and non-negotiable constraints that define what “good” means in the venue. The normative source of truth. The Value System encodes priorities and tradeoffs; the Constitution encodes non-negotiable rights and constraints.
The real-time enforcement layer. Evaluates every proposed action against the Value System, consent state, jurisdictional constraints, and operational policy. AI components submit proposals; CGL™ decides.
Treats time as a first-class governed dimension of venue operations. Holds the venue’s schedule of operational regimes (day, twilight, night, after-hours; opening, peak, lull, closing, overnight, maintenance, emergency), calendar regimes (weekends, public holidays, religious observance days, Halloween weeks, Christmas weeks, Easter weeks, summer-vacation surge, event days), performance and show regimes (parade in progress, fireworks window, concert hour, pre-show, show, post-show, blackout), and sensor- or event-triggered regimes (sunset-bound, weather-bound, acoustic-envelope, illumination-bound). Holds time-bounded grants of consent, entitlement, personalization, and access that expire on schedule, and mutual-exclusion windows that lock shared physical resources against colliding actions. Supplies CGL™ with the active rule set for the current moment, signals pending regime transitions to MAOL™ and FCL™, and arbitrates between otherwise-valid actions whose safety, appropriateness, priority, or authority depends on temporal context. Administrative versioning, lifecycle management, retention, expiration, and rollback of policy artifacts are governance-ops processes executed outside the ten-layer runtime stack.
The identity subsystem. Maintains continuity of preferences, accessibility settings, language, and return-visit context under explicit consent and purpose limitation.
Continuous physical-world model of the venue. Space, flow, occupancy, environmental conditions, content state, and the zone-conditional governance state that constrains action by location, including restricted areas, zone-bound entitlements, zone-conditional commerce rules, zone-conditional consent state, zone-conditional accessibility provisions, and zone-mutual-exclusion locks. Provides shared situational and zone-conditional governance ground truth to MAOL™, CGL™, and accessibility delivery mechanisms. Zone-conditional governance is implemented as a property of the ten-layer architecture rather than as a separate runtime layer.
The operational conductor. Decomposes goals into bounded tasks, assigns them to specialist agents, enforces tool-use limits, and turns governed intent into coordinated action under CGL™ authorization.
The federation layer. Coordinates governance, identity, and operational state across venues, operators, and jurisdictions — without collapsing local authority.
The resilience layer. Defines what the system does when capability is reduced — preserving safety, accessibility, and trust ahead of optimization.
The safety override layer. Preempts every other layer when a safety-relevant condition is signaled. Hard precedence. Recovery requires authorized, auditable action.
Non-gating, append-only observer and audit layer. Records, for every governed decision, the policy version in force at decision time, the TGF™-resolved regime active at that moment, the EDE™ spatial context, the consent state, the rule set evaluated, the action authorized or denied, and the actor that requested it. Also records access events, policy versions, overrides, federation events, and governed actions. Maintains tamper-evident records and does not approve, delay, or block execution. Supports legally required retention limits, pseudonymization, redaction, tokenization, or cryptographic erasure under TGF™ and the Consent and Data Sovereignty policy.
Cross-cutting policies are rules and enforcement mechanisms that operate across multiple layers. Never called layers, never called concerns, never auxiliary.
Rules and behaviors that vary by jurisdiction — privacy, consent, retention, age-gating, content rules — enforced consistently across layers within the rules of the jurisdiction.
Mechanisms ensuring that every piece of presented content is traceable to its approved source, attributable, and recoverable. Anti-confabulation by architecture.
Defined points at which authorized humans approve, modify, or override automated decisions, with the override itself recorded as a governance event.
Rules governing augmented, mixed, and extended-reality content: registration to physical space, safety constraints, age-appropriateness, and consented overlay.
Constraints on sound, light, motion, haptic, and other sensory output — including bleed control, intelligibility, neurodivergent-aware modes, and accessibility-driven sensory shaping.
Rules governing what guests may access, purchase, or unlock — applied consistently across identity, environment, and orchestration layers, with consent and audit retained.
Rules for versioning, amendment, deprecation, and retirement of every policy, content asset, and architectural element. Recorded by AAL™ at every policy version transition; the TGF™-resolved regime under which a decision was made is preserved in the AAL™ record. Administrative versioning, lifecycle management, retention, expiration, and rollback of policy artifacts are governance-ops processes executed outside the ten-layer runtime stack.
The defined hierarchy of safety authorities, the conditions under which each is invoked, and the precedence of safety constraints over all other goals at runtime.
Cryptographic, network, and operational boundaries that prevent unauthorized access, modification, or exfiltration — enforced across every layer, with no privileged exceptions.
Inclusion treated as a system constraint, not a retrofit. Equity of language, modality, pacing, and dignity preserved across every guest journey by structural design.
Consent as an ongoing operational condition, not a one-time checkbox. Data sovereignty respected across jurisdictions, with selective disclosure and minimization as architectural defaults.
Vocabulary used across the framework, the books, and the supporting documentation.
The discipline of preventing AI components from inventing content. In WorldModel™, enforced architecturally through Policy 02 and governed proposal evaluation in CGL™.
The operational property that a venue continues to deliver its required services across foreseeable failures, degraded conditions, and exceptional events. In WorldModel™, business continuity is the outcome of three architectural responsibilities working together: redundancy (the provision — power, environmental, network, compute, data, layer, federation, operational); RGL™ (the behavior under exercise — graceful degradation with safety, accessibility, and trust preserved ahead of optimization); and AAL™ (the evidence — auditable records of every failover, degraded period, and recovery).
A property of the ten-layer architecture by which spatial governance is implemented without adding a layer. EDE™ carries the zone-conditional governance state (restricted areas, zone-bound entitlements, zone-conditional commerce rules, zone-conditional consent state, zone-conditional accessibility provisions, zone-mutual-exclusion locks); cross-cutting policies supply the zone-conditional rules; TGF™ supplies temporal-coincidence arbitration for shared physical resources; CGL™ resolves the combined active rule set at every governed decision.
The architectural property by which consent is treated as an ongoing operational condition enforced at runtime — not a one-time checkbox. ICL™ maintains current consent state; CGL™ evaluates consent state at every action that depends on it; the consent state at decision time is preserved in the AAL™ record alongside the policy version, the active TGF™ regime, and the EDE™ spatial context. Consent changes propagate within bounded time; Policy 11 (Consent and Data Sovereignty) governs the cross-cutting rule set.
The runtime structure of WorldModel™: sense and ingest → update shared operational truth → propose candidate actions → govern before execution → execute, verify, and record. Every cycle is governed and recorded.
The set of non-negotiable rights and constraints declared by the operator and enforced by CGL™ at runtime. Part of VS+C™.
The architectural property by which the venue’s declared constitution persists across system upgrades, leadership changes, and regulatory shifts. Enforced by TGF™ and Policy 07.
Coordination across venues, operators, and jurisdictions through FCL™ — without collapsing local authority. Distinct from centralization.
The architectural property by which the system, when capability is reduced, degrades into a defined, auditable, safe state — preserving safety, accessibility, and trust ahead of optimization. Enforced by RGL™.
AI deployed under enforceable governance: AI components are proposal generators, not decision authorities; every proposal is evaluated against the Value System and Constitution before execution; every decision is recorded for assurance.
The precedence property of OSOL™ (Layer 09). When a safety-relevant condition is signaled, OSOL™ preempts every other layer regardless of experience or orchestration goals.
Personalization across many touchpoints, modalities, languages, and time windows — preserving consent, jurisdiction, accessibility, and operator policy at each step. Distinct from marketing personalization.
The continuously updated representation of venue state that every subsystem reads from before acting. Maintained by EDE™, ICL™, AAL™, and federated by FCL™.
The architectural role of an AI component in WorldModel™. AI proposes candidate actions; governance decides. Structural discipline, not advisory.
A TGF™-managed time-bounded lock that prevents otherwise-valid actions from colliding on a shared physical resource. Referenced against EDE™ spatial state. Canonical example: an accessibility crossing on a plaza must not coincide with theater egress into the same plaza, and the reverse must also hold.
A configurable architectural property of the framework, not a fixed pattern. WorldModel™ supports eight postures, specified per deployment: power (UPS, generator, dual-path feeds); environmental (HVAC, fire suppression, temperature monitoring); network (redundant routing, failover links, isolated management); compute and storage (duplicated nodes, parallel media, replicated storage, N+1 and 2N configurations); layer (multiple instances of CGL™, ICL™, AAL™ with defined failover); data (replicated state, consent receipts, audit trails); federation (through FCL™, cross-site continuity during local outages); and operational (spares, rapid-replacement procedures, mean-time-to-recovery targets). RGL™ governs behavior when redundancy is exercised. AAL™ records every failover and recovery so business-continuity posture is auditable.
The architectural property by which only the minimum necessary attribute is disclosed to satisfy a request — rather than disclosing raw identity. Enforced through ICL™ and Policy 11.
Three canonical depth levels for content delivery, originating in Alice® content discipline and carried into WorldModel™ as governed personalization profiles. Streaker: brief, headline-level engagement. Stroller: moderate dwell. Student: deep, scholarly engagement.
Uninterruptible power supply and generator-backed power, scoped to governance-critical compute and safety-relevant systems. UPS coverage and generator transfer behavior are specified per zone in the deployment plan; safety-authority systems take priority during transfer. UPS posture is one component of the broader power redundancy category, alongside dual-path feeds and circuit-level isolation. AAL™ records every power event, transfer, and recovery for business-continuity audit.
The priorities and tradeoffs declared by the operator and enforced by CGL™ at runtime. Part of VS+C™.
The governance architecture for hyper-personalized venues. Comprised of ten architectural layers and eleven cross-cutting policies. Patent-pending.
The operational interface layer that makes WorldModel™ deployable across multi-vendor destinations. Schemas, APIs, and adapters.