Constitution
The default architecture does not require SSDF to occupy a regulated intermediary seat.
This is the constitution — the never/may list and the commercial firewall. Money rails and processor adapters live on Settlement and Treasury. Acquisition (contracts, outreach, invoices) lives on Acquire.
Working hypothesis — not an opinion of counsel
Managed dispatch for a named motor carrier, paid by that carrier, under written appointment, working through brokers, is a real commercial model. FMCSA determinations are fact-specific. Reverse-procurement (treating a public job posting as a sales lead) is cold commercial outreach built from a third party's data — CAN-SPAM applies; TCPA/DNC apply to phone and SMS. Get counsel before this goes live. The engineering objective is to remove prohibited activity from the business model, not to hide it behind a disclaimer.
Never
No freight in SSDF's name
Never accept freight in SSDF's own name when SSDF is not the authorized carrier or broker.
No carrier allocation
Never allocate one freight opportunity among unrelated carriers without broker authority.
Not the employer
Never represent SSDF as the employer of a carrier's driver unless SSDF deliberately enters an employment model.
No placement fees
Never sell driver placements as the default business model.
No employment-lead product
Never sell raw employment leads as a product.
No carrier-lead product
Never sell raw carrier leads as a product.
Source data is not SSDF data
Never represent an opportunity discovered from a third-party source as SSDF-owned data.
No source circumvention
Never circumvent source-provider access restrictions. Adapters are not scrapers.
Capability is not authority
Never allow an agent to decide SSDF has authority merely because it has technical capability.
Money does not define the role
Never allow payment flow alone to determine commercial role. Conduct does.
No freight through SSDF processors
Never collect, escrow, or split transportation proceeds on Stripe, bank rails, Coinbase, or x402. Those adapters collect SSDF service revenue only.
No SSDF driver payroll by default
Never sit SSDF between a carrier and its driver as the compensation principal unless SSDF deliberately enters an employment model.
No implied authority
Never infer regulatory authority from connectivity, data access, technical capability, payment capability, or a relationship with a different participant.
Match is not assignment
Never treat a capability match, a recommendation, or a score as a transportation assignment. The authorized party decides.
Integration is not representation
Never let a broker, carrier, or driver connection collapse identities or create a marketplace that SSDF operates.
No authority, no execution
Never execute a high-risk transportation action without an attributable actor, relationship, contract, AuthorityRecord, and transaction. When authority cannot be established, halt.
Integration is not authority
Never treat a connection, OAuth grant, webhook, observation, last-known, reconciliation, or adapter credential as an AuthorityRecord. Integration feeds the machine. Authority governs it. A provider saying yes is an input, not a completeness condition.
May
- Discover permitted market signals.
- Analyze opportunities against SSDF capabilities.
- Sell SSDF software, operations, intelligence, and evidence.
- Provide carrier-controlled dispatch tooling as a bona fide agent under written appointment.
- Provide carrier-controlled driver workflow — the carrier hires.
- Connect systems through authorized integrations.
- Let the customer retain control of regulated transactions.
- Charge subscription and service fees for SSDF capabilities — not commissions merely because something was discovered.
- Keep an auditable record of authority, contract, permission, money flow, and execution state.
- Collect SSDF invoices on Stripe, bank, Coinbase, or x402 — never freight money.
- Connect independently authorized brokers, carriers, and drivers without merging their identities.
- Record who authorized what, for whom, under which contract, with which limitations.
- When authority cannot be established, halt — do not invent a regulated seat to keep the machine moving.
- Reach a driver on whatever hop is alive. The CommunicationRecord is the production object. The hop is replaceable.
- Treat CONNECTED, DEGRADED, OFFLINE, STALE, and RECONNECTED as known states. Offline is not unauthorized. Online is not authorized.
- When a hop, ELD, TMS, or webhook fails: known transition → safe degraded mode → human visibility → recovery → evidence. Do not invent state.
- A carrier may leave. Produce an exit pack (trips, documents, evidence, communications, authority, commercial records), then revoke execution. Records remain attributable.
- Treat CONNECT, AUTHENTICATE, INGEST, NORMALIZE, VERIFY, STORE, RECONCILE, MONITOR, RETRY, DEGRADE, DISCONNECT, RECONNECT, and OFFBOARD as Integration-machine states. They do not grant DISPATCH.
- A provider yes or no is an external input. Completeness of the machine does not wait on it.
- Integration failure does not revoke authority. Authority revocation does not disconnect integration. Two machines.
Fire the commercial firewall
These are the paths the drafts warned about. Press them. The machine should refuse.
The pipeline every opportunity must survive
DISCOVER → IDENTIFY → RELATE → CONTRACT → AUTHORIZE → OBSERVE → REALITY → RECOMMEND → PARTY DECIDES → PERMISSION → EXECUTE → EVIDENCE → ECONOMICS → RECONCILE → BOOKS
The question is not “can we make money from this?” It is “what exactly are we being paid to do, under whose authority, for whom, with whose money, using whose data, and which rail governs the transaction?”
Not legal advice. Transportation counsel should review actual agreements and transaction flows before launch. Florida CAN-SPAM/TCPA/telephone rules still apply to outreach. Human approval before first contact. Do-not-contact registry: 0 entries.