HCBM — Harm Containment Boundary Module

OOF® Origin Open Foundation®

Independent Methodological Authority

Canonical Definition

The HCBM — Harm Containment Boundary Module governs how the operational
boundary required to contain further development of an already governed
Harm is established, structured, maintained, adapted, and related to the
Governed Harm Boundary.

HCBM determines where Containment must operate, what Harm pathways must
fall within Containment control, what unaffected or protected scope must
remain outside it, which interfaces and crossings require control, whether
the boundary covers the materially relevant Harm dynamics, and when
changing Harm reality requires Containment Boundary expansion,
contraction, segmentation, or redesign.

It establishes the transition:

Governed Harm Containment Action + Current Harm Dynamics → Boundary
Requirement → Boundary Formation → Pathway & Interface Coverage → Boundary
Adequacy → Governed Harm Containment Boundary

Its central question is:

Where must Containment operate so that the materially relevant pathways
through which Harm can continue, expand, propagate, compound, accumulate,
or cascade are actually brought under control?

Operational Role

HCNM determines:

what further Harm must be prevented.

HCAM-C determines:

what intervention can act against it.

HCBM determines:

where that intervention must establish effective control.

Its operational role is:

to translate a Containment action into an explicit operational boundary
capable of separating controlled Harm pathways from pathways through which
further Harm could continue.

Position Within HCOS

The HCOS governance flow is:

Containment Need → Containment Action → Containment Boundary → Containment
Persistence → Containment Verification

HCBM governs:

Containment Boundary

It receives:

Governed Harm Containment Need

Governed Harm Containment Action

and relevant:

Harm State

Propagation

Accumulation

Compounding

Cascade

and:

operational pathway information

It produces:

Governed Harm Containment Boundary

for Containment Persistence governance.

Governed Object

The primary governed object is:

Operational Boundary of Harm Containment

This is not necessarily identical to:

the physical location of Harm

the affected population

the responsible organization

the system producing Harm

or:

the formal Governed Harm Boundary

The Containment Boundary exists specifically to govern:

where further Harm development must be interrupted or prevented.

Foundational Boundary Principle

The foundational distinction is:

Harm Boundary ≠ Containment Boundary

HBS asks:

What belongs to the governed Harm?

HCBM asks:

Where must intervention operate to prevent that Harm from materially
continuing or expanding?

The Containment Boundary may therefore be:

inside

aligned with

outside

or:

distributed across

the Governed Harm Boundary.

Boundary Formation

A Containment Boundary must be derived from:

the Containment Need

the Containment Objective

the selected Containment Action

the Harm dynamic

and:

the pathways through which further Harm may develop

Conceptually:

Harm Dynamics + Containment Objective + Action Reach → Containment
Boundary

The boundary must not be established merely because an administrative,
technical, geographic, or organizational boundary already exists.

Boundary Adequacy

A Containment Boundary is adequate only where it covers the materially
relevant pathways necessary to satisfy the Containment Objective.

Therefore:

Defined Boundary ≠ Adequate Boundary

A formally declared perimeter that leaves a material Harm pathway
uncontrolled is incomplete.

Boundary Scope

The Containment Boundary may govern one or more dimensions simultaneously:

Physical

Digital

System

Network

Organizational

Geographic

Environmental

Dependency

Behavioral

Operational

or:

Composite

A Harm may require different boundaries across different dimensions.

Boundary Is Not Necessarily a Perimeter

Containment is not always spatial.

A digital Harm may require:

network segmentation

permission restriction

execution isolation

or:

dependency interruption

A financial Harm may require control over specific transaction pathways.

An autonomous-system Harm may require intervention across distributed
execution paths.

Therefore:

Containment Boundary ≠ Physical Perimeter by Default

Pathway-Based Boundary

Where Harm is propagating, the Containment Boundary should follow
materially relevant:

source points

interfaces

dependencies

transmission pathways

receiving points

and:

potential escape paths

The relevant principle is:

Containment must control the pathway, not merely surround the visible
manifestation of Harm.

Interface Governance

Harm frequently crosses boundaries through interfaces.

These may include:

system interfaces

network connections

physical access points

organizational handoffs

data transfers

supply-chain connections

agent-to-agent delegation

environmental pathways

or:

infrastructure dependencies

HCBM must identify materially relevant interfaces and determine whether
they fall under Containment control.

Boundary Crossing

A Containment Boundary Crossing occurs when a Harm-relevant pathway,
condition, effect, or mechanism moves across the governed Containment
Boundary.

Crossings may be:

Permitted

Restricted

Blocked

Monitored

Conditional

or:

Unknown

The existence of a boundary is insufficient if crossings remain
ungoverned.

Boundary Leakage

Boundary Leakage occurs where Harm can continue beyond the intended
Containment Boundary without the boundary having fully failed.

Examples include:

uncontrolled interface

unrecognized dependency

partial digital transmission

physical seepage

unmonitored organizational transfer

or:

uncovered downstream execution

Canonical principle:

Partial Boundary Integrity ≠ Complete Harm Containment

Boundary Escape

A Containment Escape occurs where the Harm dynamic materially bypasses,
penetrates, exceeds, or operates outside the intended Containment
Boundary.

Conceptually:

Contained Scope → Escape Path → Additional Harm Scope

An Escape must trigger:

Containment Boundary Reassessment

and potentially:

Containment Action Reassessment

Boundary Coverage

HCBM must establish what proportion or portion of the materially relevant
Harm dynamic falls within effective Containment control.

Coverage may be:

Complete

Partial

Conditional

Unknown

or:

Insufficient

Canonical principle:

Unknown Boundary Coverage ≠ Complete Containment Coverage

Distributed Boundary

A Harm may require a Containment Boundary distributed across:

multiple systems

agents

organizations

providers

locations

networks

or:

infrastructure components

Conceptually:

Boundary Point A + Boundary Point B + Boundary Point C → Distributed
Containment Boundary

No single perimeter is required.

What matters is whether the materially relevant Harm pathways are governed
collectively.

Composite Boundary

Composite Harm may require several different boundary mechanisms.

For example:

Physical Boundary + Digital Boundary + Organizational Boundary +
Dependency Boundary

may together form one:

Composite Containment Boundary

Canonical principle:

Multiple Boundary Components May Constitute One Governed Containment
Boundary.

Boundary Across Autonomous Execution

Autonomous systems may:

delegate

replan

spawn sub-agents

switch tools

change execution environment

or:

derive new operational paths

A boundary controlling only the original interface may therefore become
ineffective.

HCBM must account for materially derived execution paths capable of
continuing the Harm.

Canonical principle:

Execution Boundary ≠ Interface Boundary

Organizational Boundary

The organizational ownership of a system does not determine the limit of
Containment.

Harm may move from:

Organization A → Provider B → Infrastructure C → User D

The Containment Boundary may therefore cross several organizations.

Canonical principle:

Organizational Boundary ≠ Containment Boundary

Geographic Boundary

Administrative or geographic borders may be relevant but are not
automatically valid Containment boundaries.

Environmental, digital, infrastructural, economic, or societal Harm may
cross them.

Therefore:

Geographic Border ≠ Harm Containment Boundary by Default

Boundary Expansion

The Containment Boundary must expand where material Harm pathways extend
beyond its current reach.

Triggers may include:

new Propagation pathway

new affected scope

new cascade branch

new dependency

new execution path

Boundary Leakage

or:

Containment Escape

Canonical principle:

Containment Boundary must follow material Harm reality when Harm expands
beyond the intervention's original scope.

Boundary Contraction

A Containment Boundary may contract where:

Harm pathways cease

scope becomes durably controlled

dependencies are removed

Propagation is no longer materially possible

or:

continued broader Containment is unnecessary

Contraction must be governed.

It must not be based solely on:

elapsed time

administrative convenience

or:

absence of recent reports

Boundary Segmentation

Different parts of a Containment Boundary may require different controls.

For example:

Segment A — Blocked

Segment B — Restricted

Segment C — Monitored

Segment D — Unknown

HCBM must preserve this differentiated condition rather than presenting
the boundary as uniformly effective.

Boundary Adaptation

Harm dynamics may change after Containment begins.

The boundary may therefore need to adapt to:

changing Propagation direction

new Compounding relationships

cascade development

system reconfiguration

agent replanning

environmental movement

or:

newly discovered pathways

Canonical principle:

A static boundary cannot be presumed adequate for a dynamic Harm.

Boundary Persistence Relationship

HCBM establishes the boundary.

HCPM subsequently governs whether that boundary and its controls remain
effective over time.

Therefore:

Boundary Established ≠ Boundary Persisting

A correct initial boundary may later degrade.

Boundary Verification Relationship

HCBM may determine whether the boundary is structurally adequate.

It does not establish final Containment effectiveness.

HCVM determines whether further Harm development has actually been
contained.

Therefore:

Adequate Boundary ≠ Verified Harm Containment

Boundary and Mitigation

Containment Boundary controls further Harm development.

It does not define the scope of Mitigation.

Existing Harm may require Mitigation:

inside

outside

or:

across

the operational Containment Boundary.

Therefore:

Containment Boundary ≠ Mitigation Boundary

Boundary and New Harm

Containment actions or Boundary operations may themselves create
materially distinct Harm.

Where this occurs, the new Harm must enter appropriate HAGA™ lifecycle
governance.

The Containment Boundary must not be expanded conceptually to hide
intervention-induced Harm.

Canonical principle:

Containment Boundary Does Not Erase Harm Created by Containment.

Boundary Uncertainty

HCBM must preserve uncertainty where the complete Harm pathway is unknown.

Examples include:

unknown dependency

unknown downstream system

uncertain environmental pathway

unobserved agent execution

or:

incomplete organizational visibility

The boundary may therefore carry:

Known Coverage

Known Gap

and:

Unknown Coverage

simultaneously.

Boundary State

HCBM may represent boundary states such as:

Proposed

Established

Partially Established

Active

Incomplete

Degraded

Leaking

Escaped

Under Reassessment

or:

Released

These states describe the Containment Boundary.

They do not by themselves establish the overall Harm Containment State.

Minimum Implementation Framework

A minimum HCBM implementation requires eight capabilities.

Boundary Requirement Identification

Determine where Containment must operate based on the Containment Need,
Objective, Action, and current Harm dynamics.

Pathway & Interface Mapping

Identify materially relevant pathways, interfaces, dependencies,
crossings, receiving points, and potential escape routes.

Boundary Formation & Segmentation

Establish physical, digital, operational, organizational, geographic,
environmental, distributed, composite, or other required boundary
components.

Coverage & Adequacy Assessment

Determine whether the boundary covers the materially relevant Harm
pathways and explicitly represent partial, conditional, unknown, or
insufficient coverage.

Crossing, Leakage & Escape Governance

Govern boundary crossings and detect materially relevant leakage, bypass,
penetration, or escape.

Dynamic Boundary Adaptation

Expand, contract, segment, or redesign the Containment Boundary when Harm
dynamics materially change.

Boundary State & Uncertainty Control

Maintain boundary state, coverage uncertainty, known gaps, reassessment
triggers, and historical changes.

Governed Output

Produce a traceable Governed Harm Containment Boundary suitable for
Containment Persistence and Verification governance. 32. Use Case 1 —
Autonomous Harm Escapes the Visible System Boundary

An autonomous system is isolated at its primary interface after producing
Harm.

However, previously delegated sub-agents remain active in external
execution environments.

A boundary limited to the original system would appear complete while
leaving active Harm pathways outside its control.

HCBM therefore establishes a distributed Containment Boundary covering the
materially relevant delegated execution paths.

The governing principle is:

A Containment Boundary must follow execution capable of continuing Harm,
not merely the interface through which the Harm was first observed.

Use Case 2 — Environmental Harm Requires a Moving Boundary

An environmental Harm is initially contained within a defined physical
area.

Subsequent observation establishes that the harmful condition is moving
through an environmental pathway beyond the original perimeter.

HCBM does not preserve the initial boundary merely because it was
correctly established at the time.

The boundary expands and is redesigned around the current Harm pathway.

The governing principle is:

A Containment Boundary that no longer corresponds to the Harm's material
pathway is no longer an adequate Containment Boundary.

Governance Requirements

HCBM requires that:

the Containment Boundary derive from a Governed Harm Containment
Need

and Action; - Harm Boundary remain distinct from Containment Boundary; -
administrative, technical, organizational, or geographic borders not
automatically define Containment; - the boundary cover materially relevant
Harm pathways rather than only visible Harm manifestations; - materially
relevant interfaces and crossings remain governed; - Boundary Leakage and
Escape remain detectable; - unknown coverage not be treated as complete
coverage; - distributed Harm support distributed Containment boundaries; -
multiple boundary components remain governable as one Composite
Containment Boundary; - autonomous and derived execution paths remain
within boundary analysis where capable of continuing Harm; -
organizational separation not break Containment continuity; - boundary
expansion occur where Harm expands beyond current control; - boundary
contraction require a governed basis; - segmentation preserve differing
control states; - the boundary adapt to material Harm dynamics; - boundary
establishment remain separate from Persistence; - structural boundary
adequacy remain separate from final Containment Verification; -
Containment Boundary remain separate from Mitigation scope; -
intervention-induced Harm remain independently governable; - boundary
uncertainty and historical changes remain explicit.

Governance Logic

HCBM applies the following logic:

Does a Governed Harm Containment Action exist?

If no:

→ no formal operational Containment Boundary is established through HCBM.

If yes:

→ identify the Harm dynamic and Containment Objective.

Then ask:

Where can the targeted Harm dynamic continue?

→ map relevant pathways and interfaces.

Where must intervention control operate to interrupt those pathways?

→ establish the Containment Boundary.

Then determine:

Does the boundary cover every materially relevant known pathway?

If no:

→ identify gaps and establish Partial or Insufficient Boundary Coverage.

Are relevant pathways unknown?

If yes:

→ preserve Unknown Coverage and Monitoring requirements.

Can Harm cross, bypass, leak through, or escape the boundary?

If yes:

→ adapt, expand, segment, or redesign the boundary.

Is the Harm dynamic distributed or composite?

If yes:

→ establish distributed or composite boundary components.

The output becomes:

Governed Harm Containment Boundary → Containment Persistence Governance

Throughout:

Harm Boundary ≠ Containment Boundary

Defined Boundary ≠ Adequate Boundary

Physical Perimeter ≠ Containment Boundary by Default

Organizational Boundary ≠ Containment Boundary

Known Coverage ≠ Complete Coverage

Boundary Established ≠ Boundary Persisting

Adequate Boundary ≠ Verified Harm Containment

Governance Outputs

HCBM may produce:

Governed Harm Containment Boundary

Containment Boundary Requirement

Containment Boundary Scope

Containment Boundary Map

Boundary Segment

Boundary Interface

Boundary Crossing State

Boundary Coverage State

Known Boundary Gap

Unknown Boundary Coverage

Boundary Leakage

Containment Escape

Distributed Containment Boundary

Composite Containment Boundary

Boundary Expansion Requirement

Boundary Contraction Requirement

Boundary Adaptation Requirement

Boundary Reassessment Trigger

and:

Containment Boundary State

The principal output is:

Governed Harm Containment Boundary

Critical Distinctions

Canonical Boundary

The HCBM — Harm Containment Boundary Module governs where and across what
operational scope Containment must operate to prevent further development
of an already governed Harm. It governs Containment Boundary requirements,
formation, scope, segmentation, pathway and interface coverage, crossings,
leakage, escape, distributed and composite boundaries, expansion,
contraction, adaptation, adequacy, uncertainty, state, and reassessment.
HCBM does not determine the Governed Harm Boundary, establish whether Harm
originally exists, determine Containment Need, select or execute the
Containment Action, govern long-term Containment Persistence, establish
final Containment effectiveness, perform Mitigation, govern Recovery,
Residual Harm, Resolution or Finality, determine general causation, or
assign accountability, responsibility, or liability.

Canonical Closing Statement

Harm cannot be contained by drawing a boundary where it is convenient to
govern. The boundary must exist where Harm can actually continue.

It may cross systems, organizations, interfaces, physical spaces,
dependencies, and autonomous execution paths that do not align with any
existing administrative perimeter.

HCBM makes the Containment Boundary follow the material pathway of Harm
rather than forcing Harm to fit the boundary already available.

A boundary contains Harm only when the Harm pathways that matter are
actually brought within its reach.