31. Governed vehicle-agent, policy, privacy, and market runtime

The vehicle can be the account without being a legal person, owner, unrestricted spender or physical controller. A vehicle agent is a governed software actor representing one or more asset personas for declared beneficiaries. It reads a policy-filtered evidence projection, produces drafts or bounded proposals, and receives only the minimum current grants needed for approved digital actions.

An agent proposal is inert until policy, confirmation and connector boundaries admit it.

#31.1 Principal, agent, beneficiary, and provider

#31.2 Grant and policy-evaluation contract

Scoped grant and policy decision
ActionGrant {
  grantId, issuerPrincipalId, granteeAgentId, beneficiaryIds[],
  actions[], resourceSelectors[], purpose, audience,
  validTime, jurisdiction, channel, confirmationMode,
  monetaryLimits?, rateLimits?, locationLimits?, dataMinimization,
  requiredDuties[], prohibitedEffects[], delegationDepth,
  policyRef, policyDigest, revocationEpoch, proofRefs[]
}

Decision = evaluate(subjectAttributes, resourceAttributes,
                    requestedAction, purpose, environment,
                    currentGrantSet, prohibitions, duties,
                    policyVersion, knownAt)

Deny by construction
The social and commerce agent runtime receives no credentials, network route, API method, schema, grant type or connector capable of steering, braking, propulsion, flight-control, payload release or other physical actuation.

#31.3 Grounded content transaction

#31.4 Persona versioning and succession

#31.5 Spotting, invitations, and location privacy

1. Create a spotting observation from lawful public signals with capture time/place precision, media rights and people/plate privacy.
2. Resolve only to candidates; image similarity, plate, VIN or logo never creates a profile merge or ownership assertion.
3. Publish a coarsened/delayed location and redacted media projection appropriate to the asset risk and owner preference.
4. Deliver a physical/QR/NFC invitation that lets an apparent owner, custodian or team claim, dispute or ignore the candidate profile.
5. Verify control through risk-appropriate evidence without publicly exposing private documents or live location.
6. Record the car story as attributed interview assertions; approve public excerpts and keep private source material scoped.
7. Use resulting interests only for consented event/service recommendations; never infer sensitive human traits from vehicle association.

#31.6 Recommendation and advertising policy

#31.7 Commerce object model and accounting

#31.8 Auction and bid transaction

Followers and bids do not own the vehicle
Popularity, appraisal, asking price, standing offer, highest eligible bid, transaction price and long-term brand value remain distinct. No market projection changes title, custody, persona rights or sale authority without its own governed records.

#31.9 Recruitment, internships, and serious-engineering pathways

• A challenge, race, training session or vehicle project publishes skills, eligibility, consent, evidence and review criteria.
• Candidate portfolios and telemetry contributions remain attributed to the person/team; the vehicle profile can reference but not own them.
• Agent recommendations may explain opportunities and help assemble an application, but high-impact selection stays human-reviewed.
• Hiring, education, immigration, disability, age and other sensitive decisions use dedicated lawful processes outside the social-ranking system.
• Every referral, interview invitation, decision status and withdrawal carries a purpose-bound receipt and retention policy.

#31.10 Risk tiers and dispatch-time reevaluation

Risk is evaluated twice: when a proposal is formed and immediately before dispatch. The second decision binds the exact canonical proposal digest, current grant epoch, policy version, beneficiary, provider terms, money total, confirmation artifact and environmental context. A stale approval cannot authorize a changed payload.

#31.11 Economic mandates and double-entry journal

A vehicle may earn and spend under delegated management, but it is an accounting dimension—not an unqualified legal owner of funds. Every balance belongs to a named legal account holder or escrow arrangement, with the vehicle/persona/mission carried as reporting dimensions and the beneficiary made explicit.

Economic mandate and journal contract
EconomicMandate {
  mandateId, principalId, beneficiaryId, agentId,
  allowedActionKinds[], allowedMerchantCategories[],
  perActionMinorLimit, periodMinorLimit, currency,
  validInterval, confirmationThreshold, grantEpoch
}

JournalEntry {
  journalEntryId, economicEventId, bookedAt, effectiveAt,
  currency, lines[{accountId, debitMinor, creditMinor,
                   vehicleId?, personaId?, missionId?, providerRef?}],
  sourceReceiptIds[], reversalOf?
}

Invariant per currency: sum(debitMinor) == sum(creditMinor).
Amounts are integer minor units. Corrections append reversing and replacement
entries; posted journal rows are never edited in place.

• Escrow cash, customer funds, provider payables, taxes, platform fees and beneficiary earnings remain separate accounts; a single net 'vehicle balance' is only a derived report.
• Quote, reservation, order, payment authorization, capture, refund, payout and chargeback are different economic events linked by provider receipts.
• Every revenue share states the calculation basis, exclusions, fee/tax treatment, period, rounding rule, currency conversion source and dispute window.
• Mandate exhaustion, grant revocation, owner/beneficiary change or unusual fraud signals stop new commitments without rewriting completed accounting history.

#31.12 Unknown effects, reconciliation, and compensation

Connector retries are financial and reputational decisions
A network timeout does not mean the ticket, bid, post or payment failed. The stable action ID and provider idempotency key must be reconciled before a retry. UNKNOWN_EFFECT is a first-class durable state, not an exception string.