Sovereign Relational Architecture
About 12 minutes to read
A form with a dropdown. A database with required fields. A system that needs to put you in one box.
The box you pick can be true and still not be enough for what the field claims to record.
The artifact problem
Imagine a form that asks for tribal affiliation. The dropdown lists each of our three Peoples as a separate choice, plus Other. The field takes one answer, so I would pick Hidatsa. What that single choice cannot say is that we are one Nation: the Three Affiliated Tribes of the Mandan, Hidatsa, and Arikara Nation. The name carries a confederation the People made for themselves, with shared governance and a long history of pressure and endurance.
“Hidatsa” is true. The trouble depends on what the institution does next. If it reads that answer as naming the sovereign body whose authorization it must seek, a true part now stands in for a political relation that the menu has no room for. Nothing in the record is false. The record is being asked to stand for more than it can. The Nation, not a category on a form, decides who its citizens are. The form only asked how I identify.
The essay this model is built on calls this the artifact problem. A receiver takes a partial account as if it were enough, and ignores the relations that govern its meaning and use. The word comes from signal processing, where handling a signal can add features that were never in it: in aliasing, every sample is taken correctly and the result still shows a different wave. Each part is true, and the whole stands for something it is not. A receiver is any institution or system that takes in a record and acts on it. So an artifact is not a flaw inside a file. It comes from what a receiver does with the file.
Being partial is not the problem by itself. A receiver that holds only a partial account can still carry it faithfully, as long as the receiver says what the account leaves out and stays answerable to those relations. The essay calls that a relay.
An authored explanation: the imagined affiliation form
Suppose the institution uses “Hidatsa” to decide whose authorization it needs. The essay asks four questions of any record: what it represents, who may authorize a use and who has standing to carry it out, what keeps it intelligible, and whether the institutions that receive it uphold its governance. A record can fail on any one of them and produce an artifact. One failure can draw others after it. The four mechanisms below answer those questions in turn:
Downstream, these changes support decisions that look valid inside the system and are wrong outside it, in ways you can predict. The institution may ask the wrong body for authorization, or classify and allocate on a false premise.
This is the author's explanation of one imagined use, not a test the form fails. Whether an artifact appears depends on what the receiver does with the answer.
Persistence conditions
Most data systems start with records, subjects and objects that are assumed to exist already. Then they ask who may access them. The essay asks an earlier question: what relations have to hold for this knowledge to stay what it is when it moves into this system?
The essay calls those relations persistence conditions: the relations knowledge depends on to remain itself as it changes hands and changes form. A teaching might depend on the season it is taught in, who teaches it, who may hear it, or what it is for. Communities define these conditions for their own knowledge. They depend on context, they can be disputed, and they are governed.
Some knowledge keeps its conditions through a particular change, and some does not. The same teaching can stay itself as a seasonal lesson in a community program and stop being itself as a searchable record pinned to a map. Nothing about the knowledge changed. What changed was the relation being proposed.
Contents ↑Digitization Viability Assessment (DVA)
Digitization Viability Assessment (DVA) is the governing community's way of asking whether one proposed making or use can uphold the knowledge's persistence conditions. The institution that wants to go ahead has to show that it can. The community does not have to prove anything in order to say no. The institution also pays for the assessment, whatever the outcome. The community may decline to assess at all, and no promised benefit buys an exception.
The unit of assessment is always one proposal: this knowledge, in this form, for these purposes and recipients, in this technical setting, for this long, with these copies and derivatives. Each operation is judged on its own. A proposal might support storage but not indexing, or teaching access but not model training. A worksheet can organize the discussion, but it never produces a score. An operation that cannot work is not averaged away by others that can, and without enough evidence the proposal waits. A determination can take more than one shape: viable in one form but not another, kept for a term and then destroyed, held but shared only with the community, or sent back to community judgment each time the knowledge is used. The model carries shapes like these; it does not carry a condition that the community be present, which no gate can check. A yes or a no to one proposal does not decide another: a changed relation is assessed again, not read off an earlier answer. When more than one Nation or community has a say, the loosest answer does not settle it, as the neighboring Nation's contest shows. Credentials can show expertise; they give no one standing to agree or refuse on a community's behalf.
An assessment reaches one of three outcomes. The names are the essay's own, as it stands in the author's current revision.
Here the governing process finds that every operational requirement in the proposal can be written as a rule the system itself can safely check and enforce. That still does not mean the system holds all the relations, and it does not take the place of the community's continuing governance.
Technical controls handle part of the work. The rest depends on community judgment at the points the determination names, or on the institution's own enforceable undertakings, such as a funded way to report misuse and put it right. The governing process has to accept that these arrangements cover every requirement.
Making, describing, storing or moving the object would cut a relation it depends on, expose what must stay protected, or ask more than the technical setting can do. The outside system receives nothing: no decision record, no content, no identifying details. The object is simply not made there. The community may keep its own internal record.
What SRA does
Sovereign Relational Architecture (SRA) is the essay's design pattern for carrying a DVA determination into the receiving institution. DVA asks the question; SRA carries the answer. A warrant, a gate and a grant do most of the technical work. The rest depends on institutions, funding and people, and on a governing practice that keeps all three honest.
A signed record of one bounded decision. It says which operations are allowed, required or forbidden, for whom, and until when. It can also name the governing process it recognizes, when the decision comes back for review, and how it can be replaced. It never carries anyone's ceremonial or kinship standing, or the protected reasons for the decision. Its declared remainder tells the receiver that some obligations bind even though no rule encodes them, and it can name what the receiver has undertaken. The receiver must honor them without learning why.
Inspect an invented warrant →The check that runs before each action. The gate confirms that the warrant is signed and still current, and that no dispute holds this action. It matches the exact action, recipient and purpose. It confirms that the receiver has not loosened or tightened the conditions, and that no duty is overdue in a way the undertaking says should pause access. Only then does it issue a grant for that one action. Where keeping a condition takes acts no system can perform or judge, such as teaching by the right people at the right time, the gate does not pretend to check it: that duty rests on the receiver's undertaking and on the governing process that accepted it.
Try the gate →A grant is a one-time permission for one exact action. The resource, action, recipient, purpose and time must all match. When a grant expires, the obligations behind it do not. A stolen grant can still do harm; keeping its scope narrow limits that harm but cannot remove it.
Saying no in public is a deliberate political statement, and the community decides whether to make it. A refusal that protects these relations is a successful result. By default it leaves no shared record: a visible no teaches the next asker how to ask, a ledger of refusals can be read as a list of what to go after, and the community owes no reasons. Saying no where others can see it is a separate act. The community may also keep its own record of refusals, as evidence of how often institutions ask and how much time answering takes. It never has to. A restricted note belongs in a separate record the community controls. Non-disclosure of existence (NDE) goes further: nothing about the matter is written anywhere shared, no entry, identifier, reason or revealing count.
Try the refusal and non-recording demonstration →A receiver that passes something on may neither loosen nor tighten the conditions without the originating process's authorization. The originating process is the governing process that made the original determination. Loosening is easy to recognize as harm. Tightening can harm too: extra approval steps can block teaching, return or circulation the community requires. More restrictive is not always more faithful.
Compare invented receiver policies →More-than-human persistence conditions
A dam is not a record of a river at all. It is a physical intervention, and it can end the conditions a river's life depends on. The artifact problem shows up in the paperwork around it: accounts that turn river into water inventory, bottomland into acreage with a price, and relation into title, then treat those accounts as a full description of what was there.
The Missouri River is a relative. When the Army Corps closed the dam, water remained and a reservoir formed. But at that reach, the river the People, cottonwoods, fish, gardens and ceremonies had known did not survive the enclosure. Lake Sakakawea is real. It is not an administrative equivalent of the river the Corps transformed. The ghost is the record that treats a payment for the bottomlands as having settled the loss.
Maaxiiriwia, Buffalo Bird Woman, teaches the People to know Macúahca, sweetgrass, as a relative: a medicine and a presence in ceremony. In that teaching, where sweetgrass grows is a sign that the place is in right relation with the people who gather her. The author's family keeps a small pot of her on a deck in Carlisle and tends her the way kin are tended. She is kept safe and groomed, and the family lives with her. That tending is the care this framework asks of a receiver, which is not possession of a plant or a record but answerability to the relations that make it what it is.
The same care applies to a beaver family and the stream they work. Watching closely does not let a person speak for the beaver or the stream; standing to relay what the stream teaches comes from recognition within the community. The stream does not sign a warrant. Here a warrant is a bounded human undertaking about human action: this community will not authorize conduct that goes against what it has witnessed. It can record observations, sources, limits and precautions. It cannot record the stream's consent, and it cannot exhaust the stream's authority.
Contents ↑What building it taught
The learning model follows invented cases from start to finish: a proposal, the conditions and evidence, a determination written for a fictional governing process, one bounded action, and what happens when circumstances change. Eight cases let you compare, for example, a machine-enforceable deposit, a language program under hybrid governance, a proposal that is never made, a dispute with a limited scope, and an answer produced exactly as approved that review later corrects. A component inspector shows the checks underneath.
Keeping real keys safe, tying each grant to the one party allowed to use it, separate production databases, receivers that exchange decisions with one another, enforced deletion, replacing keys on a schedule, and testing whether NDE can be detected from response times all require real infrastructure. The model does none of these.
Why this matters now
The essay's warning applies to every new pipeline, including those that train models: a pipeline can keep a community's data whole and still take its governance apart. Software can amplify that failure while behaving exactly as specified. Better consent at collection does not fix it. No consent form can repair a transformation that cuts the relations the knowledge depends on, and once the plaintext is outside the system's control, no policy file can stop copying or reuse, model training included.
This work begins from particular ground: the Mandan, Hidatsa, and Arikara Nation, the Missouri River, Maaxiiriwia and Macúahca, and what happens when a system cannot see what its categories authorize.
Relation comes before data. Architecture cannot create that sovereignty or carry the whole relation. It can stop substituting for it, and it can be built so that what it cannot hold stays owed.
Contents ↑