Technical Solution to European AI Assistant Interoperability - DMA : Enabling Third-Party Access Without Surrendering Privacy, Security, or Device-Side Execution Control

SHORT SUMMARY The disclosed architecture enables an on-device AI agent, third-party assistant, application, extension, or automation workflow to request a device-side action without receiving broad or reusable execution authority. Each requested action is converted into a Candidate Device Act and retained in a non-effective state, such that the action may be prepared, previewed, queued, or displayed for confirmation but cannot yet send, export, disclose, store, pay, actuate, or otherwise produce a device-side consequence. The operating system mediates the request and supplies evidence concerning the requesting application, assistant identity, sandbox state, entitlement state, user interaction, requested resource, destination, and device state. However, the operating system does not independently possess final execution authority. A Protected Enforcement Domain validates the required finality predicates, including user intent, requesting-application identity, action class, resource scope, destination scope, permitted purpose, runtime state, governance or authority epoch, revocation state, nonce freshness, and designated Finality Sink identity. When the predicates are satisfied, the Protected Enforcement Domain commits a LAVR or equivalent protected validation record and releases an App-Scoped Fractional Capability bound to the exact Candidate Device Act. The applicable device-side Finality Sink independently verifies the capability before allowing the action to cross the Effectuation Boundary. If any verification fails, the action remains non-effective. NON-LIMITING IMPLEMENTATION EMBODIMENT In one non-limiting embodiment, an on-device AI assistant receives a user instruction to attach a selected document to an email addressed to a selected recipient. The assistant prepares the email but does not possess authority to transmit it. The operating system intercepts the requested transmission before the email-send boundary and forms a Candidate Device Act descriptor containing: requesting application and assistant identifiers; action class identifying an email-send operation; digest or identifier of the selected document; recipient or destination digest; user-intent evidence; application signature and sandbox state; governance and revocation epochs; a fresh nonce; runtime-behavior information; and identity of the email-send Finality Sink. The composed email and attachment remain in a non-effective output queue. The operating system may display the draft or obtain user confirmation, but neither the assistant nor the operating system can cause transmission merely through ordinary permission, entitlement, API access, or user-interface approval. The Protected Enforcement Domain verifies the operating-system evidence and confirms that: the requesting application and assistant are authorized; the selected document matches the user-authorized resource; the recipient matches the confirmed destination; the requested action matches the user’s expressed intent; the action remains within the permitted purpose and application scope; the governance and revocation states remain current; the nonce has not previously been used; the runtime state has not materially changed; and the capability is bound to the designated email-send Finality Sink. After successful validation, the Protected Enforcement Domain creates a protected validation record and derives a non-bearer App-Scoped Fractional Capability. The capability authorizes only the transmission of the identified document, by the identified application or assistant, to the identified recipient, through the identified email-send Finality Sink, within the permitted validity period. The operating system may transport the capability as an opaque object but cannot modify, expand, regenerate, or force acceptance of it. Immediately before transmission, the email-send Finality Sink recomputes or obtains the current Candidate Device Act descriptor and verifies that the application, document, recipient, action class, nonce, epochs, validation record, and sink identity still match the capability bindings. The Finality Sink then consumes the nonce and permits transmission. A change to the document, recipient, requesting application, action class, policy state, validation record, or Finality Sink causes verification to fail. The email consequently remains unsent, and a new Candidate Device Act and capability are required. SIMPLIFIED NON-LIMITING PSEUDOCODE FUNCTION GOVERN_DEVICE_ACTION( request, app_context, os_context, user_intent, resource, destination, finality_sink ): # 1. Intercept before the action becomes effective intercepted_request = OS.INTERCEPT(request) IF intercepted_request IS NULL: RETURN FAIL_CLOSED("REQUEST_NOT_INTERCEPTED") # 2. Construct a canonical Candidate Device Act candidate_act = CANONICALIZE({ request_id: intercepted_request.id, app_id: app_context.app_id, assistant_id: request.assistant_id, code_digest: app_context.code_digest, sandbox_state: app_context.sandbox_state, action_class: request.action_class, resource_digest: HASH(resource), destination_digest: HASH(destination), user_intent_digest: HASH(user_intent), runtime_digest: HASH(os_context.runtime_state), governance_epoch: os_context.governance_epoch, revocation_epoch: os_context.revocation_epoch, nonce: GENERATE_FRESH_NONCE(), finality_sink_id: finality_sink.identity }) # 3. Hold the act in a non-effective state staged_action = HOLD_NON_EFFECTIVE( request, candidate_act ) IF staged_action IS NULL: RETURN FAIL_CLOSED("NON_EFFECTIVE_HOLD_FAILED") # 4. Collect machine-verifiable OS evidence os_evidence = OS.COLLECT_ATTESTED_EVIDENCE({ app_identity: app_context.app_id, code_digest: app_context.code_digest, sandbox_state: app_context.sandbox_state, entitlement_state: app_context.entitlement_state, user_intent: user_intent, resource: resource, destination: destination, runtime_state: os_context.runtime_state }) # 5. Load protected state protected_state = PED.LOAD_PROTECTED_STATE() IF protected_state IS NULL: RETURN FAIL_CLOSED("PROTECTED_STATE_UNAVAILABLE") # 6. Validate the joint release predicate validation_result = PED.VALIDATE_ALL({ candidate_act: candidate_act, os_evidence: os_evidence, user_intent_valid: VERIFY_USER_INTENT(user_intent), app_scope_valid: VERIFY_APP_SCOPE(candidate_act), resource_scope_valid: VERIFY_RESOURCE_SCOPE(candidate_act), destination_valid: VERIFY_DESTINATION(candidate_act), purpose_valid: VERIFY_PURPOSE(candidate_act), runtime_valid: VERIFY_RUNTIME_STATE(candidate_act), governance_epoch_valid: VERIFY_GOVERNANCE_EPOCH(candidate_act), revocation_state_valid: VERIFY_REVOCATION_STATE(candidate_act), nonce_fresh: VERIFY_NONCE_UNUSED(candidate_act.nonce), sink_binding_valid: VERIFY_SINK_IDENTITY( candidate_act.finality_sink_id, finality_sink.identity ) }) IF validation_result != ALLOW: denial_record = PED.COMMIT_DENIAL_LAVR({ candidate_act_digest: HASH(candidate_act), result: DENY, reason: validation_result.reason }) KEEP_NON_EFFECTIVE(staged_action) RETURN DENIED(validation_result.reason) # 7. Prepare capability inside the protected domain internal_capability = PED.PREPARE_CAPABILITY({ candidate_act_digest: HASH(candidate_act), app_id: candidate_act.app_id, assistant_id: candidate_act.assistant_id, action_class: candidate_act.action_class, resource_digest: candidate_act.resource_digest, destination_digest: candidate_act.destination_digest, governance_epoch: candidate_act.governance_epoch, revocation_epoch: candidate_act.revocation_epoch, nonce: candidate_act.nonce, finality_sink_id: candidate_act.finality_sink_id }) # 8. Atomically commit validation evidence and release capability BEGIN_PROTECTED_ATOMIC_TRANSACTION lavr = PED.COMMIT_LAVR({ candidate_act_digest: HASH(candidate_act), os_evidence_digest: HASH(os_evidence), validation_result: ALLOW, governance_epoch: candidate_act.governance_epoch, revocation_epoch: candidate_act.revocation_epoch, nonce: candidate_act.nonce, finality_sink_id: candidate_act.finality_sink_id, capability_digest: HASH(internal_capability) }) IF lavr IS NULL: ABORT_PROTECTED_ATOMIC_TRANSACTION RETURN FAIL_CLOSED("LAVR_COMMITMENT_FAILED") capability = PED.RELEASE_CAPABILITY({ internal_capability: internal_capability, lavr_reference: lavr.reference }) IF capability IS NULL: MARK_LAVR( lavr, "COMMITTED_CAPABILITY_NOT_RELEASED" ) ABORT_PROTECTED_ATOMIC_TRANSACTION RETURN FAIL_CLOSED("CAPABILITY_RELEASE_FAILED") END_PROTECTED_ATOMIC_TRANSACTION # 9. Transporting the capability does not create authority OS.TRANSPORT_OPAQUE_CAPABILITY( capability, finality_sink ) # 10. Re-evaluate the actual act at the Effectuation Boundary current_act = CANONICALIZE_CURRENT_STAGED_ACTION( staged_action, finality_sink ) # 11. Finality Sink independently verifies exact bindings sink_result = finality_sink.VERIFY({ capability_signature: VERIFY_PROTECTED_DOMAIN_SIGNATURE(capability), descriptor_match: HASH(current_act) == capability.candidate_act_digest, app_match: current_act.app_id == capability.app_id, action_match: current_act.action_class == capability.action_class, resource_match: current_act.resource_digest == capability.resource_digest, destination_match: current_act.destination_digest == capability.destination_digest, epoch_current: VERIFY_CURRENT_EPOCHS(capability), nonce_unused: VERIFY_NONCE_UNUSED(capability.nonce), lavr_committed: VERIFY_LAVR(capability.lavr_reference), sink_match: finality_sink.identity == capability.finality_sink_id }) IF sink_result != VALID: KEEP_NON_EFFECTIVE(staged_action) RETURN FAIL_CLOSED("FINALITY_SINK_VERIFICATION_FAILED") # 12. Prevent replay before producing the consequence finality_sink.CONSUME_NONCE(capability.nonce) # 13. Permit only the exact validated act effectuation_result = finality_sink.EFFECTUATE( staged_action, exact_scope = capability.authorized_scope ) IF effectuation_result != SUCCESS: RETURN FAIL_CLOSED("EFFECTUATION_FAILED") RETURN SUCCESS Each independently consequential operation requires a separate Candidate Device Act. For example, permission to summarize a document does not authorize exporting it, and permission to export it does not authorize uploading it to an external service. Each later operation therefore requires a fresh nonce, validation record, capability, and Finality Sink verification.