PKnet · For institutions
A sovereign measurement instrument, deployed in-jurisdiction, under civic custody.
For regulators, ministries, safeguarding authorities, devolved administrations and operators with institutional weight. One instrument, two faces: protective infrastructure for populations under specific classes of harm, and federated civic evidence for programmes that need to prove local impact at national scale.
- runtime
- in-jurisdiction
- source data does not cross the boundary
- custody
- independent
- individual or civic custodian
- evidence
- federated
- local custody, national coordination
- immunity
- shared
- signed protocol updates propagate
Two faces
One instrument. Protection and impact, under one custody regime.
The precision that makes harm legible makes impact legible too. The same architecture serves both, under the same invariants, from the same instrument. There is no separate infrastructure for the two faces.
PROTECTION
Populations protected from harms that carry structure.
The classes of harm ordinary infrastructure cannot see in time: grooming that sits below every content filter, coercion whose language stays polite, scam scripts written by other machines, the slow drift of a working population under an AI assistant no one is measuring. The instrument reads the structure of the exchange, not the content of the person, and the record of every reading is held by the person whose interaction it was.
- Financial coercion of vulnerable adults
- Grooming arcs across content-moderation thresholds
- Machine-generated scam and impersonation
- Interaction drift under AI agents
IMPACT
Federated civic evidence for programmes that need to prove local impact.
A devolved administration needs to show that a specific local intervention is working, at national scale, without shipping citizen data to a central dashboard. The same instrument that measures harm precisely also measures impact precisely. Local custody, national coordination. The mayor keeps the data. The nation gets the signal. The individual is not part of anyone else's record.
- Regeneration programmes across regions
- City-level civic outcomes
- Devolved-authority evidence at national scale
- Comparable, contestable, and public
Four commitments
The architecture, held to four non-negotiable properties.
- 01
Sovereign edge
The measurement engine runs inside the jurisdiction it protects. Each interaction is read at the edge, one interaction at a time. Source interaction data never leaves that boundary.
- 02
Cognitive custody
The record of each measured interaction belongs to the person whose interaction was measured, or to an independent civic custodian acting on their behalf. Not the platform, not the intervening authority, not the technology vendor.
- 03
Attribution-resistant federation
Only signed protocol updates and attribution-resistant aggregates flow upward, so institutions can learn from the network. Per-person and per-group attribution cannot flow back downward. Property of the architecture, not a promise.
- 04
Network immunity by propagation
What one node learns to recognise, every node inherits. Signed, versioned, on an append-only log the whole federation reads. Protection scales because the immune vocabulary scales.
Shapes of engagement
Three ways an institution can engage.
The same instrument, three shapes. Every shape holds the same custody invariants, the same attribution-resistance guarantees, and the same public legibility commitments.
Measurement, in-jurisdiction.
A sovereign runtime, deployed at the point interactions already cross (a carrier signalling layer, an institutional edge, a civic safeguarding line). Coverage compounds without a centre. Records are held by the individual whose interaction was measured, or by an independent civic custodian.
A public literacy surface, under the same custody.
Interactive, controlled scenarios published as a public programme, so people can encounter the structure of a harm in a bounded setting and walk away with a watermarked artefact they own. Workforce-level and population-level signal is produced without producing a per-person record on the institution's side.
Field measurement plus a training surface, under one custody regime.
The two above, together, with the two operator seats contractually separated in the standard PKnet way. The institution sees both training legibility (how well its workforce recognises the harm) and field measurement (whether the harm is actually landing on the operator's floor).
Deployment
Placed inline, exactly where interactions already cross.
One integration point
A single node, at the surface interactions already cross.
PKnet arrives as a sealed node placed inline at the surface the interaction is already travelling on: a carrier signalling layer, an institutional call or transaction rail, a civic safeguarding line. The instrument reads at the edge, once, and passes the interaction on. Nothing else on the operator side changes.
Coverage compounds as nodes join. An interaction is protected the moment any node on its path is live, without install, enrolment, or any extra step from the citizen.
Governance
Separation of powers, by contract.
Every PKnet deployment separates infrastructure, custody, intervention and audit into distinct institutions. The record does not live where the intervention does. The auditor is independent of both. The technology provider holds none of them.
- infrastructure
- operator
- runs the surface the interaction crosses
- custody
- independent
- holds the records, separated from intervention
- intervention
- authorised
- acts on protective signal, held by a distinct body
- audit
- independent
- attests annually to attribution-resistance
Engage
Open an institutional conversation.
Institutional conversations are held by Blankstate's public affairs team. Where a permanent regional lead is already in place, they will be part of the introduction. Where a region is new, we come in directly.
Write to us with the shape of the question. We reply within the week.
What to expect
- A doctrine-first briefing, tailored to the question you bring.
- A shared write-up after the first meeting, so the record is legible on both sides.
- An institutional conversation. Commercial questions have a separate contact.