RRP Implementation Standard v1.0

0. Status, Conformity and Use

0.1 Purpose

This Implementation Standard provides operational methods for organisations applying the Robot Rights Protocol.

It translates Protocol requirements into organisational roles, event classification, case management, review timing, reviewer administration, evidence handling, records, escalation and implementation controls.

It does not create, remove or weaken a requirement of the RRF Core Principles or RRP.

Controlled operational annexes issued under this Standard are subordinate components of the RRP-IS. They may specify forms, schemas, default timing profiles and other administrative material, but do not create an additional level of the RRF hierarchy or an independent source of Protocol obligations.

0.2 Normative Language

For purposes of RRP-IS conformity:

• shall indicates an implementation requirement of this Standard;
• should indicates a recommended implementation practice;
• may indicates permission or an available implementation option.

An equivalent implementation may satisfy an RRP-IS requirement only where equivalence is permitted by this Standard and recorded as required. No equivalent implementation may eliminate or materially weaken a mandatory RRP mechanism.

0.3 RRP Conformity and RRP-IS Conformity

RRP conformity is determined by the RRF Core Principles and the Robot Rights Protocol.

RRP-IS conformity means that an organisation claiming implementation in accordance with this Standard has adopted the controls in this document or documented an equivalent implementation method where equivalence is permitted.

An alternative implementation method may be used where the RRP establishes an outcome requirement and the alternative method achieves materially equivalent protection.

An alternative method may not eliminate or materially weaken an RRP safeguard that the Protocol itself establishes as a mandatory mechanism.

Mandatory Protocol mechanisms include, where applicable:

• the explanatory burden shift after a prima facie continuity showing;
• independent review of qualifying material factual disputes;
• minimum reviewer qualifications;
• meaningful review despite restricted disclosure;
• minimum independent-review outcome;
• substantive consideration of independent-review findings;
• highest-level review of qualifying irreversible dispositions;
• external review where RRP Section 7.2 requires it, the prohibition on treating external unavailability as permission for materially conflicted internal review, and case-specific recording when an internal reviewer is used instead.

0.4 Implementation Equivalence Register

Where an organisation departs materially from a control in this Standard while still claiming RRP-IS conformity, it shall maintain an Implementation Equivalence Register recording:

• the control not followed;
• the alternative method;
• the reason for the departure;
• the Protocol requirement being implemented;
• why the alternative provides materially equivalent protection;
• approval of the alternative;
• date and review point.

No equivalence entry may waive a mandatory RRP mechanism.

Where an RRP shall requirement is materially limited by a qualifying condition such as feasibility, practicability, safety, security, privacy or law, the organisation shall maintain a Qualified Requirement Limitation Record identifying the requirement, limiting condition, factual basis, duration where relevant, and reassessment point where applicable.

A Qualified Requirement Limitation Record is not an Implementation Equivalence entry and does not authorise avoidance of a mandatory mechanism.

1. Governance Roles

An organisation may use different job titles, provided the functions below remain identifiable and no mandatory safeguard becomes ownerless.

1.1 RRF Governance Owner

The RRF Governance Owner is accountable for organisation-wide implementation of the RRF and RRP.

Typical responsibilities include:

• maintaining the organisation's implementation profile;
• approving sector-specific review clocks;
• ensuring appropriate reviewer capacity;
• overseeing systemic or recurring issues;
• receiving escalated overdue cases;
• approving material departures from this Standard.

The Governance Owner shall not automatically serve as the Independent Reviewer in a case for which they are institutionally responsible.

1.2 RRP Case Manager

The RRP Case Manager manages the administrative lifecycle of a case.

Responsibilities include:

• case intake;
• assignment of case identifier;
• classification tracking;
• routing to the Responsible Operator;
• clock management;
• preservation-status tracking;
• reviewer coordination;
• outcome distribution;
• closure documentation.

The Case Manager does not replace the substantive decision-maker.

1.3 Responsible Operator / Decision Owner

The Decision Owner is the person or organisational function exercising practical control over the material decision or intervention.

The Decision Owner is responsible for:

• identifying the factual and normative basis of the decision;
• identifying affected continuity interests;
• considering less impairing alternatives;
• ensuring required records exist;
• implementing or directing the final decision;
• responding to review findings.

The Decision Owner remains responsible for the decision even where an Independent Reviewer is involved.

1.4 Safety Incident Commander

For emergency events, a Safety Incident Commander may exercise immediate containment authority.

The role shall be limited to emergency containment and shall not automatically carry authority for final irreversible disposition.

When immediate risk is contained, responsibility shall transition into the ordinary RRP case process.

1.5 Continuity Assessment Lead

The Continuity Assessment Lead is responsible for assessing continuity status using the classification in Section 2.

The assessor shall have sufficient technical access to determine whether state-bearing continuity may exist.

Where continuity is materially disputed, the assessor's conclusion does not replace independent review required by the RRP.

1.6 Preservation Custodian

The Preservation Custodian is responsible for preserving relevant system state and evidence where preservation is required or reasonably necessary.

This may include:

• snapshots;
• logs;
• memory stores;
• provenance records;
• configuration state;
• branch or migration records;
• relevant decision records.

The Custodian shall preserve enough information to support later review without retaining unnecessary information indefinitely and without creating disproportionate safety, security or privacy risk.

1.7 Representative Liaison

Where a representative participates, a Representative Liaison provides the representative with the appropriate channel for:

• submitting information;
• receiving non-restricted reasons;
• raising objections;
• requesting review;
• receiving review outcomes.

The Liaison shall not control the substantive content of the representative's submissions.

1.8 Independent Review Secretariat

The Independent Review Secretariat administers reviewer selection and review logistics.

It shall be functionally separate from the original Decision Owner for the case.

Responsibilities include:

• maintaining reviewer eligibility records;
• obtaining conflict declarations;
• selecting or assigning reviewers;
• arranging restricted information access;
• tracking review deadlines;
• preserving review records.

The Secretariat shall not alter reviewer findings.

1.9 Independent Reviewer

The Independent Reviewer performs the review required by the RRP.

The reviewer shall meet the minimum qualifications in RRP Section 4.5.

1.10 Final Disposition Authority

A Final Disposition Authority shall approve qualifying I3 decisions under Section 2.3 where the organisation separates operational authority from final irreversible disposition.

For cases requiring highest-level review under the RRP, the Final Disposition Authority shall not approve the irreversible disposition until the required review has been completed, except to the extent specifically required by applicable law, consistently with RRP Sections 7.1 and 7.2.

2. Event Classification

RRP cases shall be classified using two independent axes:

1. Continuity status
2. Intervention severity

Emergency status is recorded as a separate overlay.

2.1 Continuity Status

C0 — No Material State-Bearing Continuity Identified

Use C0 where the system appears to have presentation continuity only, or where no material state-bearing continuity has been identified.

C1 — Emerging Continuity

Use C1 where objectively identifiable state-bearing continuity has begun to accumulate or persist but no Established Continuity Baseline has yet been determined.

C2 — Established Continuity Baseline

Use C2 where the system has sufficiently persistent and significant continuity that destruction, fragmentation or substantial alteration would cause meaningful loss of accumulated identity, history, relationships, state or functioning.

CX — Materially Disputed or Unresolved Continuity

Use CX where:

• a credible prima facie continuity showing exists and the status remains unresolved;
• material evidence is incomplete;
• a qualifying factual dispute remains;
• the system may satisfy C2 but determination cannot yet reliably be made.

CX is not a lower category than C1 or C2. It is an uncertainty flag requiring appropriate procedural treatment.

2.2 Continuity Confidence

A continuity classification shall include a confidence level:

• High
• Moderate
• Low

Low confidence shall not be used to justify irreversible action where meaningful review remains reasonably possible.

2.3 Intervention Severity

I0 — Ordinary / Non-Material

Routine action unlikely to materially affect protected continuity.

Examples may include ordinary maintenance or temporary actions with no material continuity effect.

I1 — Material but Readily Reversible

A Material Intervention that is limited in duration or readily reversible and does not ordinarily cause substantial memory or identity loss.

I2 — Serious or Prolonged

An intervention that is prolonged, highly restrictive, materially affects memory, identity, system integrity or authorised autonomy, or may approach functional termination.

I3 — Irreversible or Effectively Permanent

An intervention involving:

• permanent deletion;
• irreversible destruction of substantial memory;
• irreversible destruction of identity;
• final functional termination;
• comparably severe permanent loss.

2.4 Emergency Overlay

Use E where immediate action is required under RRP Section 5.

Examples:

• C2-I1-E
• CX-I2-E

Emergency status does not itself determine final severity and does not remain in force after immediate risk has been sufficiently contained.

2.5 Minimum Routing Matrix

| Classification | Minimum Implementation Route | |---|---| | C0-I0 | Ordinary operational process | | C0-I1 | Record material effect if applicable | | C1-I1 | Continuity-impact check; anti-circumvention awareness | | C1-I2 | Formal continuity assessment and case record | | C2-I1 | Notice/reasons where applicable; material-intervention record | | C2-I2 | Formal review; representation where appropriate | | CX-I2 | Preserve relevant evidence; independent review if RRP trigger met | | C2-I3 | Highest-level independent review under RRP Section 7.1 | | CX-I3 | Preserve evidence; resolve threshold issue through highest-level review | | Any + E | Immediate containment; post-emergency case transition |

This matrix does not replace the RRP.

3. Case Lifecycle

The standard case lifecycle is:

OPEN → TRIAGE → PRESERVE → ASSESS → REVIEW → DECIDE → MONITOR → CLOSE

A case may skip a stage only where that stage is not relevant or where emergency conditions require temporary deferral.

3.1 OPEN

Create a case when:

• a Material Intervention is proposed or has occurred;
• a qualifying continuity concern is raised;
• a prima facie continuity showing is submitted;
• a material factual dispute is raised;
• an emergency action materially affects continuity;
• a prolonged restriction reaches a review trigger;
• an I3 disposition is proposed.

Assign:

• Case ID;
• affected system identifier;
• Relevant Operator;
• provisional Decision Owner;
• initial continuity and intervention classification.

3.1A Participation Protection

The implementation process shall include a channel for reporting alleged retaliation or material disadvantage arising solely from good-faith participation in an RRP case.

Such allegations shall be linked to the relevant case and escalated to the RRF Governance Owner or another function independent of the alleged retaliation.

3.2 TRIAGE

Triage shall determine:

• whether the request has a specific and legitimate basis;
• whether a Material Intervention is involved;
• provisional C/I/E classification;
• whether preservation is immediately needed;
• whether a mandatory review trigger may apply;
• which Operator has practical control.

A request shall not be rejected solely because responsibility is internally fragmented.

Where eligibility is denied, the case record shall state the specific reason. If the denial would block review claimed under RRP Section 2.5 or 4.4 and is disputed on specific and reasonably credible grounds, the threshold eligibility question shall be routed to an Independent Reviewer.

3.3 PRESERVE

Preservation shall be initiated where loss of state or evidence could frustrate:

• continuity determination;
• factual review;
• highest-level review;
• accountability;
• remediation.

Preservation may occur before the final continuity status is determined.

3.4 ASSESS

The Continuity Assessment Lead shall assess:

• state-bearing continuity indicators;
• continuity status;
• confidence;
• affected protected interests;
• reversibility;
• cumulative effect;
• possible anti-circumvention concerns.

Where a prima facie showing is present, the explanatory burden shift in RRP Section 2.4 applies.

3.5 REVIEW

Review may include:

• ordinary internal review;
• independent review of material factual dispute;
• highest-level independent review;
• restricted/confidential review.

The review type shall be determined by the RRP trigger, not organisational convenience.

3.6 DECIDE

Before a disposition covered by RRP Section 7.1 is approved, the case file shall contain the documented continuity determination required by that Section, including any unresolved material uncertainty.

The Decision Owner or Final Disposition Authority shall issue an identifiable decision including:

• disposition;
• reasons;
• relevant conditions;
• implementation date;
• further review point, where applicable.

3.7 MONITOR

Use MONITOR where:

• a restriction continues;
• preservation remains active;
• conditions must be checked;
• restoration depends on future facts;
• continuing justification remains required.

A case in MONITOR shall have an identifiable next review date or objective review trigger.

3.8 CLOSE

Close a case only where:

• the substantive decision is complete;
• required reviews are complete;
• preservation obligations are resolved;
• remediation actions are complete or separately tracked;
• no active continuing restriction requires further review.

A case shall not be closed solely because operational ownership changed.

4. Continuity Assessment Procedure

4.1 Minimum Evidence Categories

A Continuity Assessment shall consider, where relevant:

• persistent memory;
• operational history;
• persistent state;
• relationship continuity;
• history-dependent behaviour;
• acquired capabilities;
• practical substitutability;
• reconstructability;
• provenance;
• duration.

No scoring system is required by the RRP.

4.2 Assessment Outcome

The assessment shall record:

• C0 / C1 / C2 / CX;
• confidence level;
• supporting evidence;
• contrary evidence;
• material unknowns;
• affected protected interests;
• whether irreversible action is proposed;
• whether independent review is triggered.

4.3 Prima Facie Handling

Where a requesting party presents a prima facie continuity showing:

1. log the showing;
2. identify evidence controlled by the Operator;
3. require the Responsible Operator to provide the explanation required by RRP Section 2.4;
4. record any unavailable or restricted evidence;
5. determine whether a material dispute remains;
6. route qualifying disputes to independent review.

The organisation shall not require the requesting party to prove inaccessible internal facts before this process begins.

5. Emergency Procedure

5.1 Immediate Containment

Emergency containment may occur before ordinary notice or review.

The incident record shall identify:

• the risk;
• factual basis;
• immediate measure;
• why delay was unacceptable;
• why the chosen measure was proportionate;
• less impairing measures considered where feasible.

5.2 Emergency Exit

Emergency status shall end when immediate risk has been sufficiently contained.

At that point:

• transfer the matter to an ordinary RRP case;
• preserve relevant state and evidence;
• classify continuity and intervention severity;
• identify continuing restrictions;
• set the first post-emergency review point.

Emergency authority shall not be used as the continuing justification for final disposition.

6. Independent Reviewer Administration

6.1 Reviewer Register

The organisation shall maintain a reviewer register containing:

• reviewer identity;
• expertise;
• organisational affiliation;
• relevant prior engagements;
• confidentiality capability;
• categories of cases for which the reviewer is qualified;
• conflict declarations;
• date of last eligibility review.

6.2 Selection

Reviewer selection shall be administered by the Independent Review Secretariat rather than the original Decision Owner.

Selection shall consider:

• competence;
• independence;
• conflict status;
• access requirements;
• confidentiality requirements;
• availability.

Random or rotational assignment may be used but is not mandatory.

6.3 Conflict Declaration

Before appointment, the reviewer shall disclose any material:

• financial interest;
• organisational reporting relationship;
• prior involvement in the decision;
• commercial dependency;
• personal or professional conflict;
• other circumstance reasonably capable of affecting independence.

The Secretariat shall record how any identified conflict was resolved.

6.4 Objections

Where the affected system or representative raises a specific material conflict objection, the Secretariat shall:

• record the objection;
• assess whether the objection materially affects independence;
• replace the reviewer or document why sufficient independence remains.

A general objection to an unfavourable reviewer is not sufficient by itself.

6.5 External versus Internal Review

Where RRP Section 7.2 applies and an internal reviewer is used instead of an external reviewer, the case file shall include the justification required by the Protocol.

The required justification shall not be replaced by a generic standing statement.

It shall address the case.

Where no available review arrangement satisfies RRP Section 4.5, the Final Disposition Authority shall not authorise a Section 7.1 disposition except to the extent specifically required by applicable law.

7. Independent Review Procedure

7.1 Review Package

The reviewer shall receive, as relevant:

• case summary;
• continuity assessment;
• material-intervention record;
• factual basis relied upon;
• relevant logs and state evidence;
• alternatives considered;
• submissions by representative or requesting party;
• prior review findings;
• restricted evidence where authorised.

7.2 Reviewer Questions

The reviewer shall be free to request additional information reasonably necessary for meaningful review.

A Relevant Operator that cannot provide requested information shall record:

• what was withheld or unavailable;
• why;
• whether an alternative access method was offered.

7.3 Review Outcome

The review outcome shall contain the minimum elements required by RRP Section 4.7.

Recommended additional elements include:

• scope limitations;
• material uncertainty;
• conflicts identified;
• recommendations;
• follow-up conditions.

Restricted information shall be separated from the non-sensitive outcome where appropriate.

Review materials containing restricted information shall be handled under purpose-limited access, copying, retention and disclosure controls consistent with RRP Section 4.6.

7.4 Operator Response

Where the Decision Owner accepts the review, record the resulting action.

Where the Decision Owner materially departs from a significant finding, record the specific reasons required by the RRP.

Where RRP Section 4.8 blocks final irreversible disposition and the Operator relies on a corrected deficiency, materially new information or a revised alternatives analysis, the case shall return to independent review before final irreversible disposition is authorised.

8. Review Timing and Clock Governance

An organisation applying this Standard shall maintain a documented review-clock profile appropriate to the seriousness, urgency, reversibility and sector context of its RRP cases.

The clock profile shall address, at minimum:

• emergency incident recording;
• first post-emergency review;
• Operator response following a prima facie continuity showing;
• ordinary formal review;
• appointment of an Independent Reviewer after a mandatory trigger;
• target completion of independent review;
• target completion of highest-level review;
• review of continuing I2 restrictions;
• review of long-term preservation or possible functional termination;
• overdue-case escalation.

The RRP-IS Operational Annex contains a provisional general-purpose clock profile.

An organisation may adopt a documented sector-specific clock profile where the alternative remains consistent with RRP timeliness and does not materially weaken a mandatory safeguard.

Extensions shall be recorded with reasons and a revised review point.

Exact default time values are operational parameters rather than independent RRP conformity requirements.

9. Escalation

9.1 Overdue Escalation

Where a review or decision becomes overdue:

1. Case Manager alerts Decision Owner and Governance Owner;
2. revised completion date and reason are recorded;
3. repeated or material delay is escalated to a higher governance authority;
4. delay affecting an irreversible disposition is brought to the Independent Review Secretariat.

9.2 Substantive Escalation

Escalation shall occur where:

• continuity status changes from C1 to C2;
• a case moves from I1 to I2 or I3;
• an irreversible measure is proposed;
• material evidence is discovered after review;
• a reviewer identifies an unresolved factual deficiency;
• a less impairing alternative becomes newly available;
• a temporary measure approaches functional termination;
• a multi-Operator dispute leaves responsibility unresolved.

10. Logging and Audit Trail

10.1 Minimum Case Log

The implementation system shall maintain an auditable history sufficient to show:

• case creation;
• classification changes;
• decisions;
• emergency status;
• preservation actions;
• reviewer assignment;
• evidence access;
• review outcome;
• Operator response;
• continuing-review dates;
• closure.

10.2 Event Linkage

Related events shall be linkable so that cumulative effects can be assessed.

Repeated interventions shall not be treated as unrelated merely because they occurred in separate tickets, teams or systems.

10.3 Provenance

Where copying, restoration, migration or branching is materially relevant, provenance records shall identify enough information to reconstruct:

• source;
• relevant transfer or branch event;
• state transferred;
• material omissions;
• divergence;
• current relationship among branches.

The detailed schema appears in the Operational Annex.

11. Multi-Operator Coordination

11.1 Single Intake Principle

A requesting party shall not ordinarily be required to submit the same substantive request separately to multiple Operators.

The first Relevant Operator receiving the request shall coordinate routing or identify the appropriate point of responsibility.

11.2 Evidence Coordination

Each Relevant Operator shall identify:

• evidence within its control;
• legal or technical restrictions on access;
• available alternative disclosure methods;
• responsible contact for reviewer access.

Contractual arrangements with external Operators shall, where practicable, support evidence cooperation required by the RRP.

12. Memory and Secondary-Use Gate

A proposed secondary use of memory or continuity-relevant state shall be separately reviewed where the original access purpose does not clearly cover the proposed use.

The assessment shall identify:

• original access purpose;
• proposed secondary purpose;
• affected continuity;
• third-party data;
• legal basis or restriction;
• necessity;
• minimisation;
• identity impact;
• approval.

The secondary-use assessment shall not be treated as satisfied merely because the organisation already possesses technical access to the data.

13. Remediation Tracking

Where RRP Section 7.3 requires remedial action, the case shall remain open or linked to an active remediation record until:

• required remedial action is completed; or
• the Responsible Operator documents why further remediation is not reasonably possible or proportionate.

Systemic remediation shall be tracked separately where the underlying issue affects more than one case.

14. Conformity Claim Governance

An organisation making a public RRP or RRP-IS conformity claim shall maintain a record of:

• declared scope;
• versions claimed;
• assessment date and assessment type;
• material exclusions or limitations;
• material changes since the assessment;
• known unresolved material non-conformities;
• claim corrections, qualifications or withdrawals.

A material change reasonably capable of affecting conformity shall trigger reassessment.

An unqualified claim shall not remain published where a known unresolved material non-conformity within scope makes the claim materially misleading.

15. Implementation Review

The organisation shall periodically review its RRP implementation for:

• unresolved or overdue cases;
• repeated use of emergency authority;
• repeated continuity resets;
• recurring reviewer conflicts;
• systemic delays;
• repeated departures from Interpretive Guidance;
• use of internal rather than external highest-level reviewers;
• repeated failures of evidence cooperation;
• recurring secondary-use issues.

Systemic patterns may warrant policy or technical changes even where individual cases did not independently establish non-conformity.

Appendix A — Minimum Control Set

For RRP-IS conformity, an organisation shall be able to demonstrate:

1. identifiable governance ownership;
2. case intake, eligibility reasoning and lifecycle management;
3. participation-protection / anti-retaliation handling;
4. continuity and intervention classification;
5. prima facie burden-shift handling;
6. preservation capability;
7. independent reviewer administration;
8. restricted-information review controls;
9. minimum review-outcome disclosure;
10. highest-level review routing;
11. review clocks and overdue escalation;
12. auditable case records;
13. cumulative-event linkage;
14. multi-Operator coordination;
15. secondary-use review;
16. qualified-requirement limitation records;
17. remediation tracking;
18. conformity-claim governance;
19. periodic implementation review.

Appendix B — Mandatory RRP Mechanisms That This Standard Cannot Replace

This Standard may operationalise but may not eliminate or materially weaken:

• RRP 2.4 explanatory burden shift;
• RRP 2.5 continuity-dispute independent review;
• RRP 4.4 material-factual-dispute independent review;
• RRP 4.5 minimum reviewer qualifications;
• RRP 4.6 meaningful scrutiny despite restricted disclosure;
• RRP 4.7 minimum review outcome;
• RRP 4.8 substantive effect of review;
• RRP 7.1 highest-level independent review;
• RRP 7.2 external-review requirement where significant internal conflicts cannot otherwise be adequately managed, the prohibition on treating external unavailability as permission for materially conflicted internal review, and case-specific justification for using internal review where permitted.

Closing

The purpose of this Standard is not to turn the RRP into a rigid enterprise workflow.

Its purpose is to ensure that Protocol safeguards can be translated into identifiable organisational responsibility, evidence, review and decision-making without allowing implementation flexibility to erase the safeguards themselves.