Enforcement Integrity in Pre-Execution Authorization

Abstract

Enforcement Integrity in Pre-Execution Authorization is a FERZ, Inc. technical note on a requirement that enforceable AI governance has carried without specifying: what establishes that the mechanism responsible for pre-execution authorization is beyond the unauthorized control of the system it governs? A runtime authorization boundary may mediate every declared execution path, condition release on its verdict, fail closed, and produce independently reconstructable authorization artifacts while remaining open to modification or interference by the governed system. Complete mediation, verdict-conditioned release, fail-closed behavior, and reconstructable verdicts do not, by themselves, establish the independence of the mechanism that provides them. The note defines enforcement independence as a configuration-bound property of the control relationship among the governed system, the enforcement mechanism, the declared authority rules, and the capabilities available to the governed system. The definition includes a protected set: the elements of enforcement-relevant state whose alteration must require authority the governed system cannot supply or substitute. An authority model that assigns the governed system authority over a protected element fails the definition on its face, so independence cannot be defined away by assignment. Principal contributions A scoped definition of enforcement independence. The note separates effective control (a reachability property), authority under the declared rules, unauthorized control, and enforcement independence, and defines the property as a condition on the mechanism rather than on executions. Four enforcement-independence obligations. Unauthorized modification of enforcement-relevant state and dependencies; unauthorized disabling or lifecycle alteration; conditioning release on a verdict from a source the authority rules do not designate; and acquisition of control through an actor who relays the governed system's request rather than decides. Each is stated with its prohibited control, allowed interaction, failure consequence, evidence, residual assumption, and reassessment trigger, preceded by a protected-set authority check. Five analytical counterexamples, labelled A to E. Hypothetical configurations show that mediation and independence are separable in both directions; that an unauthorized restriction of policy defeats independence without any unauthorized release, because verdicts whose justification depends on the alteration lack authority lineage; that substitution of the verdict source is a release-control violation; and that control can be acquired through an operator who acts as a conduit for the governed system's request. The assurance record. An eight-field illustrative template (claim and obligation, covered configuration, control relationship, failure scenario, supporting evidence, residual assumptions, evidence outcome, reassessment triggers), positioned as the content of the trust-assumption record the ABIM Evidence Requirements already call for rather than as a new framework. The Evidence Transfer Criterion. A proposed assurance rule, not a derived theorem, stating when evidence gathered at one configuration continues to support a claim at a later one: only where a documented change assessment establishes that every claim-relevant difference preserves the applicability of the original evidence, including newly introduced execution paths, enforcement dependencies, administrative interfaces, and delegated capabilities. Configuration change alone establishes neither defeat nor preservation. Relationship to existing work The note builds on classical reference-monitor requirements and on FERZ's published work on execution-time authorization, boundary completeness, authority, and the Authorization Boundary Integrity Model (ABIM). It distinguishes enforcement independence, a property of the enforcing mechanism, from Output Integrity, the ABIM property of executions, and from the evidence supporting either. It also separates three findings: an enforcement-independence failure, a release-control violation, and an Output Integrity failure witness. A demonstrated capability to alter what the mechanism relies on defeats the independence claim but does not by itself establish that an unauthorized effect occurred; conversely, a correctly reconstructed verdict does not establish that the mechanism was beyond unauthorized control. Scope and limitations The note is mechanism-agnostic. Its definitions, propositions, and counterexamples are analytical, and every assurance claim is relative to a declared configuration, scope, authority model, and capability model. It reports no deployment tests, certifies no implementation, and does not claim that enforcement independence is sufficient for security. It does not conclude that AI systems can be controlled; it concludes that a claim to have controlled one has a specific content, and that the content can be checked. The note adds no integrity property to ABIM and no test to the Five Tests Standard (5TS). It supplies the evidence required to evaluate an assumption the existing architecture already carries: that the governed system cannot exercise unauthorized control over the mechanism enforcing its runtime authorization boundary. Author: Edward Meyman (FERZ, Inc.; ORCID 0009-0008-8012-6100)Publisher: FERZ, Inc.Publication type: Technical noteVersion: v1.0, October 2026License: Creative Commons Attribution 4.0 International (CC BY 4.0)Version of record: https://doi.org/10.5281/zenodo.23438040 (concept DOI 10.5281/zenodo.23438039)