AUTHORITY
The machine does not manufacture authority.
Institutional authority remains external. The architecture binds to its state and makes that boundary explicit.
REGULATORS · SUPERVISORS · AUDIT
Do not only inspect the report. Inspect the architecture that made execution possible.
Traditional oversight is often retrospective: review the output, inspect the log, reconstruct the decision. Machine Law asks an earlier question: under which external authority, rule state, jurisdiction, time and dependencies could an execution right exist for the exact action at all?
OLD MODEL
Control after the consequence
Observe and score the output
Inspect logs after the event
Treat PASS as implicit permission
MACHINE LAW
Inspectable execution boundaries
External authority remains explicit
Determination and authorization remain separate
Capability exists only after valid closure
DETERMINATION
A Gate Judgment is not permission.
Domain determination and execution authorization remain separate. A PASS alone cannot create an Execution Right.
OVERRIDE
Human intervention remains visible.
An authorized override is a separate evidence event and does not silently mutate the prior state.
EVIDENCE
Integrity is not substantive legal truth.
Evidence remains claim-bounded. Verification can establish supported integrity and binding properties without claiming sovereign legal judgment.
AUTHORITATIVE SOURCE → RULE STATE → JURISDICTION → TIME → DEPENDENCIES → DETERMINATION → EXECUTION-RIGHTS CLOSURE → CAPABILITY → EVIDENCE
From attestation to independent re-verification.
The regulator-facing value is not that software replaces supervision. It is that the control architecture exposes enough of its authority boundaries, authorization logic, claim limits and evidence for independent review. The machine can surface a state. The competent human or institutional authority retains the sovereign judgment.
COORDINATED VULNERABILITY DISCLOSURE · GOVERNED EVIDENCE
A vulnerability is not governed until its handling is provable.
CVD must not end at an email address. immo.quick technically and semantically separates attacks, cooperative vulnerability reports and official reporting channels. Intake, triage, authorization, remediation, fix verification and coordinated disclosure are treated as distinct states and proof events.
ADMISSION
Report ≠ attack
Security research receives its own controlled intake path. Attack forensics remains a separate event model.
TRANSITION AUTHORITY
Status ≠ truth
A stronger CVD state can arise only through valid, authorized transitions; direct status jumps are not legitimate governance.
PROOF
Handling becomes inspectable
Receipts and immutable governance events bind content, time, authority, reason and state sequence.
Claim boundary: aligned with BSI CVD principles; no BSI testing, certification, recognition or conformity statement. BSI coordination is asserted only when actual involvement exists.
GLOBAL EXECUTION REQUIREMENTS
Die Regulierung bewegt sich zur Ausführung.
FINMA, BaFin, NIST, NSA, EU und US-Regierungsstrategien konvergieren auf kontinuierliche Autorisierung, Zero Trust, Resilienz, Evidenz und durchsetzbare Grenzen. Sehen Sie, wie immo.quick diese Kontrolleigenschaften bereits auf der Execution-Rights-Ebene operationalisiert.