A two-layer engine
Conduct, then competence.
We don't only track what parties may do (conduct). We validate who holds the power to change a position and whether the act is valid (competence) — before computing the result. The difference shows up exactly where ordinary policy engines fail silently.
Breach
Unlawful but effective.
The act took effect; a duty was violated. Liability follows.
A controller keeps processing data after a consent is withdrawn. The act has legal effect — the processing happened — but it is unlawful, and liability follows.
Ultra vires
Outside authority, void.
The actor lacked the competence to perform the act. The act has no legal effect.
An AI agent authorised only to read case files attempts to sign a contract on the client's behalf. The act is outside its granted authority, so it is void — it never legally happened.
Disability
No power, void.
The actor never held the power in question. The act cannot land.
A party with no mandate purports to waive a right they do not hold. They lack the power to change that position, so the waiver has no legal effect.
Breach is a question of conduct — the act counts, but it is wrong. Ultra vires and disability are questions of competence — the act does not count at all. KROG validates competence before it computes conduct.