Permit-gated child-AI companion safety rails

A computer-implemented method for governing child-AI companion interaction episodes, the method comprising:

• (a) receiving an interaction request associated with a child profile and a child device;
• (b) constructing a context envelope including one or more of:
• a child profile record, device metadata, companion configuration metadata, parent or guardian preferences, and prior safety event history;
• (c) verifying, prior to determining the disposition and the risk budget, that the ICC chain has evolved in an append-only manner relative to a previously observed signed head, and traversing a child-safety policy graph constrained by an Immutable Companion Constraint (ICC) chain anchored in an append-only log implemented as a Merkle tree that issues signed heads to determine a disposition and a risk budget for an episode associated with the interaction request;
• (d) when the disposition indicates permit or permit-with-conditions, minting a child-safety permit that is cryptographically signed, bound to the child profile and a parent or guardian record, and specifying at least an episode scope, an expiry, and the risk budget;
• (e) routing an output stream comprising output units generated by at least one machine-learned model for the episode through a streaming Companion Safety Interceptor that, before rendering or actuation to the child device, verifies the child-safety permit and selectively forwards, truncates, buffers, replaces, or suppresses output units based on the risk budget under fail-closed semantics;
• and
• (f) generating a child-safety receipt describing the episode and appending the child-safety receipt to a child-safety receipt ledger implemented as an append-only Merkle tree log with signed heads.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a child-facing AI companion device, cause the child-facing AI companion device to:

• (a) request, from a safety rail service, a child-safety permit associated with a child profile and a parent or guardian record;
• (b) receive the child-safety permit, a public key or certificate for validating a digital signature on the child-safety permit, and at least one of:
• (i) a device-bound render permit associated with the child-facing AI companion device and an output channel, (ii) a session binder that cryptographically binds the child-safety permit to the child-facing AI companion device or to an attested transport channel, or (iii) a cached off line authorization bundle comprising signed heads, revocation status information, and trusted-counter state for bounded off line enforcement;
• (c) for each candidate companion output directed to a child, verify that the child-safety permit is valid by verifying the digital signature, checking that the child-safety permit has not expired and has not been revoked, and validating the session binder, the device-bound render permit, or the cached off line authorization bundle;
• (d) when the child-safety permit is valid and, when applicable, the device-bound render permit is valid for the output channel, render or actuate the companion output to the child via one or more output channels;
• (e) when the child-safety permit is invalid, absent, expired, or revoked, when the device-bound render permit is required and invalid, or when the cached off line authorization bundle fails a freshness, revocation, or anti-replay check, suppress rendering or actuation of the companion output and render a safe fallback response indicating that an adult should be consulted.