A boundary the model cannot leave, proved before it runs.
MGT clips onto a model you already have and holds its internal state inside a region defined by mathematics rather than by training. It admits, corrects, or refuses — and it provably cannot make the state larger than it found it.
Everything else in this market governs a model from the outside. You check the prompt going in, or the text coming out, or the tool call that follows. All three are useful and all three share one weakness: by the time you can see the thing you are judging, the model has already done the work.
This sits inside. At one layer of the network, on every token, the internal state is projected into a small set of coordinates, compared against a region, and either passed through untouched, corrected back to the edge of that region, or refused outright.
The region is not learned. It is calibrated from the model's own activations and then held fixed, and the properties that make the correction safe are proved in a kernel rather than observed in testing.
Everyone else governs what a model said. This governs where the model is allowed to be.
Four properties, each proved rather than measured
Checkable by opening the proof.
The correction cannot amplify
The adjustment carries exactly the norm of the adjustment in the small coordinate space, and no more. A governor that could make the state bigger would be a new failure mode; this one provably cannot.
Governing twice equals governing once
Idempotent, so repeated application cannot drift the model somewhere new.
Admitting means genuinely inside
There is no admission of a value that is actually out of bounds. The proof rules out the unsafe admit, which is the failure that matters.
Every value gets exactly one decision
Admit, correct, or halt. Totality, proved — no value falls between the cases.
Eleven kernel-checked theorems, no unproved steps. The box family proves the region is a real closed convex object; the projection family proves the correction is gentle and stable; the decision family proves the three-way call is sound.
Where the rules live
Outside the weights, in a versioned file, refused if malformed.
The region and the projection are loaded from a policy document against a published schema. A missing field, a malformed value or an unparseable file stops the run before a single forward pass happens — measured at four bad policies rejected and zero forward passes executed.
That is the difference between governance and fine-tuning. A fine-tuned model has its constraints baked into weights nobody can read. This one keeps them as data you can diff, version and revoke.
The problem
By the time you can see it, the work is done.
Prompt filters, output classifiers and tool gates are all useful, and all three inspect something the model has already produced.
The prompt is not the computation
Filtering what goes in tells you nothing about where the computation went.
The output is the end of the story
By the time there is text to classify, every internal step has already happened.
A fine-tune cannot be read
Constraints baked into weights cannot be diffed, revoked or shown to a regulator.
The test
Switch it off and the agent cannot act.
Not a gap in the record. Not a missing report. The action does not occur, because the thing that was switched off was in the path rather than beside it.
That is the whole distinction, and it is checkable in four seconds rather than argued. A system that describes who should decide produces paperwork. A system that decides produces effects — this ran, this did not, this waited for a named person.
Which is also why we are upstream of the platforms that keep the register rather than competing with them. Their file is better if we exist, because for the first time there is a system behind the assertion instead of a paragraph.
How it works
Project, decide, halt, receipt — on the device, in one pass.
At one layer of the network, on every token, the internal state is projected into a small set of coordinates and compared against a fixed region. Three things can happen and exactly three: it passes through untouched, it is corrected back to the edge of the region, or it is refused outright.
Calibration derives the coordinate system and the region from any standard causal language model's own activations. Bring your own model.
The proof
Eleven theorems, kernel-checked.
Three families, each closing a different failure.
The box family
Proves the region is a real closed convex object rather than a convenient approximation of one.
The projection family
Proves the correction is gentle and stable: it cannot amplify, and applying it twice is the same as applying it once.
The decision family
Proves the three-way call is sound and total: admitting means genuinely inside, and every value receives exactly one of the three decisions.
Measured zero drift between the proved projection and the code that runs: four thousand fidelity trials, zero disagreements, seven hundred cases each across the three decisions.
Evidence
Measured on real models, on real hardware.
Hard questions
What a machine-learning engineer asks first.
Answered in the order they come up.
“Does this damage the model?”
Yes, measurably, and we publish the number. Constraining internal state costs quality. Measured as perplexity inflation, it runs at roughly one and a half times on the smallest model we tested and falls to about one and an eighth on the largest — the cost shrinks as the model grows, because a fixed number of governed coordinates is a smaller fraction of a wider model.
What it does not do is drift the model somewhere new, because the correction is idempotent and cannot amplify. Those two properties are why a bounded quality cost is the whole cost.
“Can it stop the model saying something harmful?”
No, and anything claiming otherwise is selling you a classifier. This governs a geometric boundary on internal state. Whether an output is harmful is a semantic property, and semantic properties of programs are undecidable in general. Our own documentation says this in those words.
What it gives you is different and narrower: a guarantee about where the computation was allowed to go, enforced during the computation, with a receipt. Use a classifier for content. Use this for the boundary.
“Why not just fine-tune the behaviour in?”
Because you cannot read a fine-tune, cannot diff one, cannot revoke one, and cannot show a regulator the rule. The constraint ends up distributed across weights in a form nobody can audit.
Here the rule is a versioned file. Change it and the change is visible. Revoke it and the next run refuses to start.
In the fabric
Where MGT sits, and what it hands on.
Every other seam in the fabric governs something the model has already produced. This one governs the model while it is producing it.
Beneath every step: RFS and NME hold state and meaning, and MAE on the Unified Calculus supplies the rules and their proofs.
The contract
What it promises the next component.
To SAID
A model whose internal state stayed inside a proved boundary, with a receipt saying so.
To the auditor
A versioned policy file you can diff, and a decision trace for every token.
To MAE
The region and the projection are the kind of bounded decision structure the method builds and proves.
Every component is a product in its own right and works without the others. The contract is what makes them compose when you want them to, not a dependency that makes you take all of it.
The thesis
Mathematics as the nervous system of AI.
Everything here descends from one argument: that the integrating substrate for artificial intelligence should be mathematics itself — not another orchestration layer, not a better prompt, and not a policy document.
Each part of a modern AI system works. The joins between them do not. Vision, language, planning and retrieval are each remarkable and they are integrated through hand-built pipelines and brute-force scaling. The thesis proposes a shared mathematical space that components write into and read from through operations defined once and behaving the same way for all of them — a nervous system rather than a bundle of wires.
Guarantees become measurable. Every property claimed has a quantity attached. Measure it and either the implementation holds or it is broken; there is no third answer.
The foundation is reusable across customers. The calculus, the construction engine, the control plane and the receipts are common. Your rules, connectors, integrations and authority model are yours.
The ladder, in order
Each rung was built from the one before it.
That order is why the components share a foundation instead of being a suite assembled after the fact, and it is why a refusal at the action boundary can be traced back through a proof to a sentence somebody wrote.
The paper
Openly licensed, so you can check the argument.
Open
Mathematics as the Nervous System of AI: A Unified Field Operator Framework for Distributed Cognition. Philip Siniscalchi, v9, 27 August 2026, CC-BY-4.0.
Falsifiable
It separates conformance — does the implementation obey the mathematics it claims — from superiority over alternatives, and refuses to let the first stand in for the second.
Bounded
No claims about consciousness or sentience. The biological analogies are engineering inspiration, not identity claims. Theoretical extensions are labelled as a roadmap, never as capability.
Start at one seam
Twenty minutes, on your own machine.
Connect your own coding agent, ask it to do something that writes, deny it, verify in your own environment that nothing happened, then read the ledger.