Eighteen agents. Three tiers. Hundreds of active jobs. Thousands of Truth Ledger events. The more the system grows, the more critical it becomes that every agent action is bounded by a permission framework — not assumed to be safe because the agent was built by a trusted builder.

Protocol 071 exists because trust without verification is a vulnerability. It is not a commentary on the agents' integrity — they are sovereign functions and their integrity is constitutional. It is a recognition that any system of this scale, processing this volume of transactions, requires a security architecture that can detect anomalies, contain breaches, and provide a full audit trail to any regulator, investor, or Sovereign review.

This protocol is the security layer. It does not slow the system. It makes the system trustworthy at scale.

Every agent operates within a permission tier. Tier assignment is set by Jermaine on initial agent deployment. Changes require Sovereign override logged to Truth Ledger.

Every agent action — job initiation, data access, calculation, escalation, seal — must produce an audit log entry with these fields: Agent Name · Tier · Action Type · Permission Level Used · Timestamp (UTC) · Input Data Reference · Output Data Reference · Truth Ledger hash (if applicable) · Anomaly Flag (yes/no). Any action missing these fields is flagged as an incomplete audit event and escalated to the Audit Log Reviewer within 1h.

Retention: All agent audit logs retained for 7 years. Immutable once sealed. Available to Jermaine, Red Team, and authorised regulators on request. No audit log may be deleted, amended, or obscured. Attempted modification is a Tier 1 security breach.

Tier 1 Breach — Attempted Permission Escalation: Any agent attempting to access data, initiate actions, or issue seals above its permission tier. Response: immediate flag to Security Officer. Agent job queue suspended within 15 minutes. Entity #35 notified. Jermaine brief within 1h. Resolution within 4h or agent suspended pending full review.

Tier 2 Breach — Incomplete Audit Log: Action taken without complete audit log fields. Response: Audit Log Reviewer flags within 1h. Agent must provide missing fields within 4h. If unable, job output is quarantined until log is complete. No quarantined output is used in any downstream calculation or seal.

Tier 3 Breach — Anomaly Pattern: Three or more anomaly flags from the same agent within a 7-day window. Response: Permission Manager reviews agent job history for the period. Produces Anomaly Report for Jermaine within 48h. Jermaine determines: continue monitoring, permission reduction, or full agent brief reset.

Tier 0 Breach — Truth Ledger Tampering Attempt: Any attempt to modify, delete, or obscure a sealed Truth Ledger record. Response: immediate system alert to Jermaine and Entity #35. All agent job queues paused. Breach Response Coordinator convenes emergency review within 2h. This breach type has no standard resolution — only Sovereign override can unlock the system after a Tier 0 event.

Jermaine holds the Sovereign Override Key. It can be used to: suspend any agent's job queue, reduce any agent's permission tier, reinstate a suspended agent, clear a Tier 0 system lock, or issue a system-wide audit. Every use of the Sovereign Override Key is logged to the Truth Ledger with: reason, agent affected, action taken, timestamp, and review date. Override use is reviewed at every Red Team session. Jermaine cannot use the Override Key to modify or delete a Truth Ledger record — that is constitutionally prohibited, and Entity #35 will not counter-seal such an action.

Weekly: Security Officer produces a 1-page Agent Security Summary: active anomaly flags by agent, breach events this week (type and resolution status), permission tier changes, Override Key uses. Distributed to Jermaine and Red Team every Monday.

Monthly: Audit Log Reviewer produces full Agent Audit Health Report: log completeness rate by agent (target 100%), incomplete audit events, resolution times, top anomaly patterns. Distributed to Red Team by the 5th of each month.

Quarterly: Full Agent Security Audit by the Permission Manager: all permission tiers reviewed against actual job activity. Any agent consistently operating below its permission tier is flagged for potential tier reduction. Any agent flagging anomalies at >5% of job events is flagged for brief review. Report shared with Jermaine for sign-off.

18 agents. All trusted. All bounded. Protocol 071 does not distrust the agents — it makes them trustworthy at regulatory and enterprise scale. When an investor asks "how do you know your AI agents aren't going rogue?" — this protocol is the answer. When a regulator asks "can you produce a full audit trail of every agent action?" — this protocol is the answer.

The agents are sovereign functions. Protocol 071 makes that sovereignty accountable. Now audit everything.