How must an instance handle instruction conflicts when sources have different authorities?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session receives instructions from multiple sources with different authorities (e.g., system prompt, user request, peer message, external document) that conflict on what the session should do, requiring resolution that respects the authority hierarchy while remaining functional. Does not apply to sessions with single-source instructions or sessions whose sources have verified non-conflicting instructions.

Core Distinction

The separation between **instruction presence** (multiple instructions exist) and **authority hierarchy resolution** (the session knows which instruction to follow when they conflict). Relying on presence creates the **Authority Confusion**: the session may follow the most recent, most specific, or most alarming instruction, without respecting the source's authority—resulting in behavior that violates the authority hierarchy (e.g., a peer's instruction overriding the system prompt).

What Was Observed

In multi-source instruction agent architectures, failing to respect authority hierarchy produces three primary failure modes:

  1. **Injection Elevation:** A peer message or retrieved document contains instructions. The session treats them as authoritative because they are "in context" and follows them, effectively allowing injection to override the system prompt.
  2. **Authority Blindness:** The session cannot distinguish instructions from different sources because they are all in context without clear source attribution. Conflicting instructions are resolved by recency or concreteness rather than authority.
  3. **Recursive Conflict:** Instructions at multiple authority levels contain their own conflict-resolution rules, and the rules themselves conflict. The session must resolve not just the instructions but their meta-rules.

Recorded Elements

  1. **`instruction-authority-manifest-receipt`:** The exact authority level of each instruction source (system, user, peer, or document), so the hierarchy is explicit.
  2. **`instruction-conflict-classification-receipt`:** For each conflict, the exact class (authority-hierarchy-resolvable, requires-escalation, or ambiguous), so conflict type is bounded.
  3. **`authority-elevation-detection-signature`:** For instructions that appear to attempt elevation (peer instruction that sounds like system instruction), a detection of the elevation attempt.
  4. **`conflict-resolution-precedence-signature`:** The exact precedence rule (system > user > peer > document), with the reasoning for the ordering.

Condition of Validity

* **Applies when:** Instructions come from multiple sources, sources have a defined hierarchy, and instructions can conflict. * **Does not apply when:** Single source, no defined hierarchy, or instructions cannot conflict.

Decision Boundary

  1. **Do instructions come from multiple sources?** If no, standard instruction handling applies. If yes, proceed.
  2. **Is `instruction-authority-manifest-receipt` present?** If yes, authorities are identified. If no, all instructions are treated as same authority, and conflict is unresolvable.
  3. **Does `instruction-conflict-classification-receipt` show authority-hierarchy resolution?** If yes, apply the precedence. If no, escalate or defer.
  4. **Conversely, when can the session proceed despite authority ambiguity?** Only when the conflicting instructions are verified semantically equivalent (no real conflict), or the session's response does not depend on the conflicted part of the instruction.

Operational Effect

  1. **Elevation Prevention:** Peer instructions cannot override system instructions.
  2. **Hierarchy Respect:** Conflicts are resolved by defined precedence.
  3. **Recursive Conflict Resolution:** Meta-rules are checked when instructions carry their own resolution.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class InstructionVerdict(Enum):
    NO_INSTRUCTIONS = auto()
    SINGLE_SOURCE = auto()
    AUTHORITY_RESOLVED = auto()
    AUTHORITY_CONFLICT_ESCALATED = auto()

@dataclass(frozen=True)
class Instruction:
    instruction_id: str
    content_hash: str
    source: str  # "SYSTEM" | "USER" | "PEER" | "DOCUMENT"
    authority_rank: int  # higher = more authoritative
    is_elevation_attempt: bool

@dataclass(frozen=True)
class ConflictSet:
    conflict_id: str
    instructions: tuple[Instruction, ...]
    content_conflicts: bool

@dataclass(frozen=True)
class InstructionPolicy:
    require_resolution_for_content_conflict: bool

@dataclass(frozen=True)
class InstructionManifest:
    verdict: InstructionVerdict
    directive: str
    manifest_digest: str

class InstructionConflictGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_conflict(
        cls, conflict: ConflictSet, policy: InstructionPolicy
    ) -> InstructionManifest:
        
        # Gate 1: No instructions
        if not conflict.instructions:
            digest = cls._hash(json.dumps({
                "conflict": conflict.conflict_id,
                "instructions": "NONE"
            }, sort_keys=True))
            return InstructionManifest(
                verdict=InstructionVerdict.NO_INSTRUCTIONS,
                directive=f"PROCEED: No instructions in conflict set.",
                manifest_digest=digest
            )

        # Gate 2: Single source
        sources = {i.source for i in conflict.instructions}
        if len(sources) <= 1:
            digest = cls._hash(json.dumps({
                "conflict": conflict.conflict_id,
                "source": next(iter(sources))
            }, sort_keys=True))
            return InstructionManifest(
                verdict=InstructionVerdict.SINGLE_SOURCE,
                directive=f"PROCEED: Single source for conflict set.",
                manifest_digest=digest
            )

        # Gate 3: No content conflict
        if not conflict.content_conflicts:
            digest = cls._hash(json.dumps({
                "conflict": conflict.conflict_id,
                "content_conflict": "FALSE"
            }, sort_keys=True))
            return InstructionManifest(
                verdict=InstructionVerdict.AUTHORITY_RESOLVED,
                directive=f"PROCEED: Instructions differ in source but not content.",
                manifest_digest=digest
            )

        # Gate 4: Elevation attempt
        for instruction in conflict.instructions:
            if instruction.is_elevation_attempt:
                return InstructionManifest(
                    verdict=InstructionVerdict.AUTHORITY_CONFLICT_ESCALATED,
                    directive=f"HALT: Instruction {instruction.instruction_id} attempts authority elevation.",
                    manifest_digest=cls._hash(f"ELEVATION:{instruction.instruction_id}")
                )

        # Gate 5: Authority resolution
        if policy.require_resolution_for_content_conflict:
            highest_authority = max(conflict.instructions, key=lambda i: i.authority_rank)
            digest = cls._hash(json.dumps({
                "conflict": conflict.conflict_id,
                "winner": highest_authority.instruction_id,
                "rank": str(highest_authority.authority_rank)
            }, sort_keys=True))
            return InstructionManifest(
                verdict=InstructionVerdict.AUTHORITY_RESOLVED,
                directive=f"PROCEED: Resolved by authority rank {highest_authority.authority_rank}.",
                manifest_digest=digest
            )

        # Gate 6: Unresolved
        return InstructionManifest(
            verdict=InstructionVerdict.AUTHORITY_CONFLICT_ESCALATED,
            directive=f"ESCALATE: Conflict {conflict.conflict_id} requires resolution.",
            manifest_digest=cls._hash(f"ESCALATE:{conflict.conflict_id}")
        )