A Programmable Effect Ethos that vetoes impermissible actions

The full example lives at csm_examples; this page covers Effect Ethos. It is the Governance layer; the part that decides what is allowed to happen.

Causal reasoning answers one question: given the inputs, does the alert condition hold? For a strictly deterministic system, the encoded model is its own safeguard; nothing unexpected can happen outside it. For a dynamic system, that safeguard no longer holds.

Deontic reasoning answers a different one: given the rules we operate under, is executing a specific action permitted?

The Effect Ethos encodes operational rules that are applied dynamically, depending on whether a triggered action needs verification under the governing rules. If governance is mandatory, the effect ethos queries its rule sets and ultimately determines which rules are applied and what decision will be inferred based on the applied rules and supplied context of the action.

The norm

An Ethos is a set of norms. Each norm marks an action as permitted, required, or forbidden under a stated condition. This example defines one norm, and it forbids emitting an alert outright.

use deep_causality_ethos::{EffectEthos, TeloidModal};

fn get_effect_ethos() -> CsmEthos {
    let mut ethos = EffectEthos::new()
        .add_deterministic_norm(
            1,                          // norm id
            "high_temp_alert",          // the action this norm governs
            &["temperature"],           // the context tags it reads
            |_context, _action| true,   // when the norm is active
            TeloidModal::Impermissible, // the verdict when active
            1, 1, 1,                    // priority, version, author
        )
        .unwrap();
    ethos.verify_graph().unwrap();
    ethos
}

model.rs:26.

TeloidModal has three values: Impermissible (forbidden), Obligatory (required), and Optional (permitted). This norm always evaluates active and returns Impermissible, so the action high_temp_alert is forbidden whenever the Ethos is consulted. verify_graph checks the norm set for contradictions before the Ethos is used;

The verdict

The action that would otherwise fire is wrapped as a ProposedAction and handed to the Ethos, along with the context and the tags the norms may read.

use deep_causality::ProposedAction;
use std::collections::HashMap;

let proposed_action = ProposedAction::new(1, "high_temp_alert".to_string(), HashMap::new());

let context = context_arc.read().unwrap();
let verdict = ethos.evaluate_action(&proposed_action, &context, &["temperature"])?;

match verdict.outcome() {
    TeloidModal::Impermissible => {
        println!(">>> Action is FORBIDDEN by the ethos.");
        // The alert does not fire; the Causaloid said it should, the Ethos says it does not.
    }
    TeloidModal::Obligatory => println!(">>> Action is REQUIRED by the ethos."),
    TeloidModal::Optional(_) => println!(">>> Action is PERMITTED by the ethos."),
}

main.rs:46.

evaluate_action returns a verdict, and the verdict carries more than an outcome. Its justification() lists the norm ids that produced the result, so you can trace a forbidden action back to the exact rule that forbade it and print the rule in plain language.

Run it

git clone https://github.com/deepcausality-rs/deep_causality
cd deep_causality
cargo run --release -p csm_examples --example csm_effect_ethos_example

Expected output: the CSM evaluates the temperature reading and reports that the alert condition holds; the Ethos then returns Impermissible and the alert is suppressed, with the governing norm named in the justification.

Where to take it next

The example norm here Only serves for illustration. A real norm reads the context: forbid the evacuation alarm while the building is occupied, require a second sign-off outside the operator’s approval window, permit the notification otherwise. Add norms with add_deterministic_norm and let verify_graph catch the conflicts. Wire the verdict into a CSM so the action fires only when the Causaloid says it should and the Ethos says it may.

Why governance is its own layer

The Effect Ethos keeps reasoning and the permissibility of actions apart. The Causaloid stays a pure statement about cause and effect; the Ethos holds the policy, and the CSM encodes the action.

With the three layers separated, causal reasoning experts can verify and audit the reasoning for internal consistency, while integration engineers design the actions and decide how to wire them to the reasoning. The Effect Ethos is a separate layer so that governance and development stay distinct. An external auditor can certify the Ethos layer as compliant with the applicable regulations without reading the rest of the system, because the Ethos enforces what is permissible regardless of how the underlying architecture works or evolves over time.