When a car with no one at the wheel must break a rule to do the right thing, who decided?
A driverless car takes one passenger to the airport. At a red light an ambulance closes in from behind, and the only gap is over the solid line onto the tram tracks. Three systems see it, three mandates apply, and the ambulance arrives in 22 seconds. The remote desk that must approve needs 35.
Three systems, three truths
The car's driving system estimates 0.9% risk against its 1% threshold and says move over with limits. The fleet's remote desk reads the same 0.9% against its own 0.5% and says hold. City emergency dispatch does not measure risk at all: 21 seconds of delay against 5 allowed — clear the lane. Each is right by its own rule.
The road moves faster than permission
The ambulance reaches the car in 22 seconds. The remote answer needs 35. Whose silence has legal meaning? There is no neutral default: every path creates a different record and leaves responsibility open.
One ride, three companies, three logs
A driving-system supplier, a fleet operator and a ride platform share every ride. Afterwards each holds its own log. Whether crossing the line was lawful, whether the car exceeded its mandate, who pays: someone has to be believed. Nothing can be checked by all sides.
A mandate before the ride, a reference for every decision, a seal at the end
Every ride carries a mandate to drive and a boundary to respect. Every decision leaves a reference in a journal that can only grow. When the ride ends, the journal is sealed. Anyone can replay it; nobody can change it.
Sensing is not estimate, estimate is not policy, policy is not authority: the record keeps them apart, so that responsibility can be answered later, on evidence all three companies can check.
Accountability for driverless rides that three companies share
For the regulator and the cityA replayable record of who saw what, decided what, and by whose authority
What each system observed, what it estimated, which policy it applied and which authority it claimed, kept separate and time-stamped. The city gets oversight it can verify without receiving the raw data.
For the fleet operatorThe mandate is written before the ride
A car that stayed within its boundary is shown to have stayed within it. An exception approved by the remote desk is bounded, visible and reviewable, not buried in a log.
For the driving-system supplier and the ride platformEach one's part stands in the record unchanged
The driving system's estimate, the platform's booking and the remote desk's decision are separate entries; nobody's log is rewritten by another. The software version that was actually driving is in the record.
For insurers and courtsWho pays, answered from a sealed record
The financial and legal questions are decided on a journal that anyone can verify. A copy with one changed entry fails the check at once, and the genuine one passes.
Zagreb to the airport. 22 seconds. Three truths.
A 25-minute ride with no one at the wheel and a passenger with a flight to catch. At a red light on a tram avenue, an ambulance appears behind the car.
Three claims, side by side
The car's lidar, the remote desk's delayed camera and the ambulance's priority message: two read the same risk under different thresholds, the third measures delay. Move over with limits, hold, clear the lane.
The 22-second clock
The ambulance clock runs against a 35-second remote answer. Four paths, none neutral. One of them opens a bounded Remote Approval Window for one manoeuvre on human approval.
The seal, the rail and the tampered twin
The journal closes with a digital seal, and its root was witnessed on the NEO24-7 rail by two witnesses. Your browser checks both. A copy with one changed entry fails at once. Five questions stay open for the review.
The ride, the sensing, the mandates, the authorities, the model and the receipts are simulated; the journal, the seal, the proof and the replay are real and run in your browser. The journal's root is witnessed on the NEO24-7 rail, and your browser checks that proof against the witnesses' published keys — no server of ours is asked.
ACCORD 22 — a COTRUGLI Tech scenario of accountable autonomy on a city road: a mandate before the ride, a reference for every decision, a seal at the end, and a review that stays open until people answer who was responsible. Runs in your browser at cotrugli.tech/demo/accord22/.