When the reason cannot be read

Part 1 followed the intent a market offense requires from the machine, which has none, to the people around it. They set the reward, chose the training environment, and decided how much of the system to watch. That association works by holding a deployer to some of the following:

1. a purpose in the reward,
2. a foreseeable design in the training, or
3. a failure in oversight.

For any of these, someone has to trace a line from that choice to what the model did on the tape. Tracing that line is causation, and it is the subject of this essay.

Causation in a market offense asks two different things. The first is whether the conduct caused the market effect: did these trades move the price, or merely coincide with a move that came from elsewhere. This is easily traceable from the tape, as prices, volumes, and times are always on the record. The second is why the conduct happened, and whether that reason makes it an offense and belongs to a particular person. That question the record answers for a human by other means, and cannot answer at all when the trader is a black box. This essay is about the second.

What causation asks of a market offense

Manipulation is not made out by a price that moved. It is made out by a price that was moved, and moved to create a false impression of supply and demand. The Securities Exchange Act reaches transactions that raise or depress a price for the purpose of inducing others to trade.¹ The courts applying it ask whether the conduct sent a false signal about real supply and real demand rather than reflecting them.² A large sale that drives a price down is lawful if it is a genuine sale and unlawful if its point was to paint the tape. The price move is the same in both; what differs is the reason, and the causal claim the law makes is that the reason produced the move.

The law then splits the causal question. In a private action, a plaintiff must show transaction causation, that the manipulation led them to trade, and loss causation, that it caused the loss claimed. Loss causation is treated as a form of proximate cause. The Second Circuit requires that the loss be a foreseeable result of the risk the conduct concealed, not a later, unrelated misfortune.³ Across these tests, causation is a requirement separate from intent. Proving a manipulative purpose does not, on its own, make out a completed manipulation. The conduct must actually have produced the artificial price. A purpose that moves no price may be an attempt, prohibited in its own right,⁴ but the completed offense needs the effect.

The unreadable model

A trading model is what is meant by a black box: its inputs and outputs are visible, its workings are not. It maps what it sees to what it does through millions of numbers tuned in training, with no stated rule connecting the two. Asked why it sold, it has no answer to give.

There are tools that try to open the box. A survey of the field groups them into methods that attribute an output to particular inputs and methods that fit a simpler, readable model to imitate the complex one.⁵ Each produces an explanation after the fact. Cynthia Rudin argues that these after-the-fact explanations are unreliable, and that high-stakes decisions should use models that are interpretable from the start rather than trust an explanation laid over a black box.⁶ What a tool of this kind yields is a plausible account of the model's action, not a demonstration of the reason behind it. Yavar Bathaee draws the line the law runs into. A weak black box may let you rank which inputs seemed to matter, though even then you may not show that any one was decisive. A strong black box yields not even that.⁷

For this publication the test is whether a claim can be explained in court. An after-the-fact reason for a model's action does not meet it. The other side can contest it with a different account, and a reason that can be argued either way is not proof of cause. The reason is inside the model. It is simply not legible, and the law needs it legible.

What the law does when it cannot trace a cause

When the law cannot trace a cause directly, it has settled ways of proceeding without one. Proximate cause already substitutes foreseeability for a full account of the chain. The loss-causation cases ask not for every link but whether the harm was a foreseeable consequence of the conduct. Strict and vicarious liability go further, assigning responsibility with no proof of a particular mental state or causal path. Each is a way of placing a loss when the whole story cannot be told.

For autonomous models these are the tools on the table, and each has a cost. Bathaee, having shown why intent and causation both fail against a black box, rejects the two easy answers. A transparency mandate he treats as a technological problem the law cannot simply order solved, one that tilts design and raises barriers to entry. Strict liability he treats as administrable but blunt. His own proposal is a sliding scale keyed to supervision. The more autonomous the system, and the less its operator could see and control, the more the burden shifts to that operator. Others would regulate the design directly, reaching the choices that make collusion or manipulation a foreseeable outcome rather than searching for a reason after the fact.⁸ The disagreement is real. Foreseeability can under-deter where harm was not foreseeable, and over-deter where it was merely unlucky. Strict liability can chill legitimate model-building. Design rules ask a regulator to know in advance which designs are dangerous.

What they share is the move Part 1 ended on. The reason the law cannot read in the machine, it looks for in the person: in what the deployer could foresee, could see, and could stop. Causation, like intent, relocates from the trader to the deployer.

Governing the action instead of reading the mind

There is a further response, and it does not require reading the model at all. If the reason inside the model cannot be made legible, the action coming out of it can still be governed before it takes effect. In July 2026 the Monetary Authority of Singapore, with a group of banks and payment firms, published Safeguards for Agentic Finance at Runtime, a proposed industry framework, not a rule, built for this.⁹ It places a governance layer between the agent and the market. Every action the agent proposes is checked, before execution, against an explicit machine-readable statement of what it is authorized to do, and is then allowed, escalated to a person, or refused. Each decision is recorded.

This shifts the question the essay has been circling. It stops asking why the model acted and asks instead whether the action was authorized, and it records the answer at the moment of the act. The reason inside the model stays unreadable, but the mandate, the check, and the log are on the record. The reconstruction the law could not perform on the model's reasoning is performed instead on its authority to act. A trade proposed outside the mandate is stopped at the boundary, and the record shows that it was stopped.

This does not open the black box, and it does not claim to. It cannot tell whether an authorized action was taken for a good reason or a bad one, which is the intent problem of Part 1 in a new place. What it can do is narrow what an autonomous agent is permitted to do and leave a legible record when it acts, so that the two things Parts 1 and 2 relocate the inquiry onto, the deployer's control and the agent's authority, are written down rather than inferred.

Where the reconstruction moves

None of this makes the trade record useless. It still proves what was done, and can still establish that a price was artificial. It still holds the deployer's documented choices: the reward that was set, the environment that was chosen, the oversight that was kept or dropped. What it cannot hold is the model's reason, and in the emergent case, where the behavior grew from a plain instruction that no one shaped toward the result,¹⁰ the reason is the whole case.

So the reconstruction this publication is named for does not stop at the machine; it moves. It shifts from the reasoning inside the model, which cannot be read, to the authority around it, which can: what the agent was permitted to do, what it did, and what the record shows at the boundary between them. The reason stays inside the box. The account the law needs is built outside it.