ARIA Home

Figure 1 — ARIA Home five-layer architecture. Layer 1 (Human Governance) is the authority layer — all permissions originate here and all overrides operate here. Layer 2 (Permission + Audit Engine) is the enforcement layer — no device action executes without passing through it. Layer 3 (Local Intelligence Core) provides automation, inference, and protocol translation. Layer 4 (Device Modules) contains all physical devices, each accessed only through permission gates. Layer 5 (Optional Cloud) is dashed — explicit opt-in only, never required for core operation.

Figure 2 — Permission access class taxonomy. Seven classes from Disabled (0) to Auto-Policy (6). Every device module is assigned a class by the resident; the default assignments shown reflect the principle that authority should increase conservatively — access control, health, and safety devices default to restrictive classes. Every action in Class 3 and above is logged with explanation. Class 5 (Emergency) triggers are strictly defined and cannot be expanded without resident re-authorization.

ARIA Home Certification — Nonprofit Licensing Framework v1.0

Purpose. The Foundation licenses the ARIA-Ready mark to manufacturers, installers, and system integrators who demonstrate compliance with the ARIA Home governance architecture standard. The mark signals to consumers that a product or installation meets the Foundation's published ethical and technical requirements. The mark does not warrant device reliability, sensor accuracy, or safety performance.

Revenue structure. Three fee tiers apply:

Anti-capture governance. Consistent with the Foundation's transparency policy: no single manufacturer or affiliated group may constitute more than 15% of annual certification revenue. Device manufacturers receive no authority over standards committees, certification criteria, or Foundation governance. All manufacturer relationships are publicly disclosed in the annual report. The standards committee that defines ARIA-Ready criteria is composed of independent technical and ethics reviewers, not certification fee payers.

Open-source baseline. The core ARIA Home architecture specification — permission taxonomy, audit log format, role and identity framework, network security baseline — is published without restriction. Anyone may implement it. The certification mark is what is licensed, not the specification itself. This prevents the Foundation from creating a proprietary standard that enriches it while constraining the ecosystem.

Revenue allocation. Certification revenue is allocated as follows: 40% to ongoing standards development and maintenance; 30% to Foundation general operations; 20% to a domestic abuse and elder safety advisory program; 10% to a reserved fund for independent security audits of certified systems.

Revenue projection (Year 3). At 50 device certifications averaging $5,000 each ($250K), 200 installer certifications at $500 ($100K), and 10 institutional licenses averaging $10,000 ($100K), total annual certification revenue would be approximately $450,000 — meaningful for a nonprofit research organization while remaining well below the scale that would create governance risk.

The Foundation has no regulatory authority. ARIA-Ready certification is a voluntary market signal, not a regulatory compliance designation. It cannot be represented to consumers as a government-endorsed safety standard.

Matter interoperability is incomplete. Matter 1.x addresses many device categories but significant gaps remain, particularly in medical alert, elder care, HVAC systems, and EV charging. The proposal's interoperability claims require qualification by category.

The eldercare module requires independent medical device regulatory review. In some deployment contexts, fall detection and health monitoring integration may trigger FDA oversight or HIPAA obligations. The Foundation will engage legal counsel before certifying eldercare deployments.

Without a governance architecture standard for residential AI, the default trajectory is continued consolidation around vendor-controlled ecosystems with opaque data practices, no audit trails, and no human sovereignty architecture. The domestic abuse risk compounds without any industry norm requiring independent resident access. Eldercare AI deployments will proceed without coercive control or false-positive emergency automation standards. The Foundation's contribution is not preventing AI in the home — it is ensuring that when AI is in the home, the home remains the resident's.

The Foundation should not launch Phase Three certification before completing: domestic abuse architecture review with advocacy organization partners; COPPA/HIPAA legal analysis for child and eldercare modules; independent security audit of the reference prototype; and publication of the open-source ARIA Home specification for community review. Each of these is a governance gate, not a timeline milestone.

If residents with ARIA-Ready certified systems demonstrate no measurable difference in perceived AI transparency, trust, or control compared to residents with conventional smart-home systems — measured through longitudinal survey at 12 and 24 months post-deployment — the governance architecture would not be delivering its claimed experiential benefit and the certification program's value proposition would require fundamental reconsideration.

If the domestic abuse risk cannot be adequately mitigated through architecture design — if consultation with domestic violence researchers concludes that no technically feasible architecture can prevent coercive control misuse of a residential AI permission system — the Foundation should not launch the certification program regardless of its other merits.

Final Clarification

ARIA Home does not propose a new technology. It proposes a new relationship between people and the technology already entering their homes. The hardware is available. The software is open-source. What does not yet exist is a governance standard that puts residents in structural authority over the systems sharing their domestic space.

The home is not a data center. It is a governed space. The architecture should reflect that.