KROG
🇳🇴

A two-layer engine

Conduct, then competence.

We don't only track what parties may do (conduct). We validate who holds the power to change a position and whether the act is valid (competence) — before computing the result. The difference shows up exactly where ordinary policy engines fail silently.

  • Breach

    Unlawful but effective.

    The act took effect; a duty was violated. Liability follows.

    A controller keeps processing data after a consent is withdrawn. The act has legal effect — the processing happened — but it is unlawful, and liability follows.

  • Ultra vires

    Outside authority, void.

    The actor lacked the competence to perform the act. The act has no legal effect.

    An AI agent authorised only to read case files attempts to sign a contract on the client's behalf. The act is outside its granted authority, so it is void — it never legally happened.

  • Disability

    No power, void.

    The actor never held the power in question. The act cannot land.

    A party with no mandate purports to waive a right they do not hold. They lack the power to change that position, so the waiver has no legal effect.

Breach is a question of conduct — the act counts, but it is wrong. Ultra vires and disability are questions of competence — the act does not count at all. KROG validates competence before it computes conduct.

One worked example

The same object, through the whole chain.

Process, Records, Engine and Agents do not each describe a different example. They describe different stages of the same object: one consent under the Email Newsletter specification.

Object: Consent · sub_8f3c1a · DPS Email Newsletter (6d79e35089c96073)

  1. DPS
  2. Applicable rule
  3. Jural stateStatus: Roadmap
  4. AuthorityStatus: Roadmap
  5. Agent actionStatus: Roadmap
  6. Record
This page

Applicable rule

Status: Beta

The rules that subsume the facts.

The engine resolves the rules that bear on the specification — GDPR Art. 6(1)(a) for the basis, Art. 13 for the information duty, Art. 7(3) for withdrawal. Rules are read formally, not as prose, and validated in two layers: competence before behaviour.

← Previous stageDPSStatus: LiveThe facts of the processing, written once.Next stage →Status: RoadmapJural stateThe positions that actually hold.

Stages labelled Roadmap are designed, not operational today. They are never described in the present tense.