The Authorization Boundary Integrity Model
A complete authorization boundary satisfies three independent properties: output integrity, input integrity, and replay integrity. A model for locating any AI governance architecture by the properties it satisfies, and the ones it only appears to.
The series was one argument
Three pieces, three claims, each made on its own.
"Watching Is Not Stopping" argued that nothing should reach the world without a verdict, and that the boundary which enforces this cannot be bypassed.
"The Trust Boundary Has Two Sides" argued that no verdict should rest on evidence whose origin cannot be established.
"A Signature Is Not a Reconstruction" argued that a verdict means little unless an outside party can re-derive it from the record.
They read as three concerns. They are not three concerns. They are three properties of a single object, an authorization boundary, and a boundary is sound only when it holds all three. This piece names the object and the properties, shows that the three are independent, and shows that the independence is what lets you locate any governance architecture by the properties it satisfies and the ones it only appears to.
Three properties
An authorization boundary is the point at which a proposed action is judged against policy and then permitted, refused, or held. Name its three properties by what each one governs.
Output Integrity. An unauthorized action cannot execute. No path reaches the world without passing the boundary. This is the property "Watching" was about.
Input Integrity. A verdict cannot rest on evidence whose admissible origin is not established. The boundary refuses to ground a decision on inputs it cannot warrant. This is the property "Two Sides" was about.
Replay Integrity. A verdict can be independently reconstructed from the bound inputs, the policy and version state that applied, the authority chain, and the proposed action. A third party holding the record and lacking access to the system reaches the same answer. This is the property "A Signature" was about.
Three questions, stated plainly. Can an unauthorized action execute. Was the verdict allowed to rest on this evidence. Can the verdict be reconstructed by someone who was not there.
The substrate underneath
One thing sits below the three, and it is not a fourth property.
For a verdict to be reconstructed, the system has to have recorded and bound which inputs the decision used. Call this Input Binding. It is the recording layer. Without it there is nothing to replay against, and nothing over which to judge admissibility either.
Binding is easy to mistake for input integrity, and the mistake is worth killing on sight. Binding records which inputs were used. It does not establish that those inputs should have been used. A system can record its inputs perfectly, bind them into the verdict, and reconstruct the decision flawlessly years later, over inputs that were fabricated. The record is faithful. The evidence is junk. Binding gives you replay. It does not give you admissibility.
So binding is a substrate, not a property. It is what the record is made of. The properties are the demands placed on that record and on the boundary that produced it.
Why the three are independent
This is the part that does the work, so it is worth being exact.
The three properties are orthogonal. Holding one tells you nothing about whether you hold the others. Take them in pairs.
A boundary can be unbypassable and still authorize on fabricated evidence. Output without input. A figure no one warranted, ruled on by a gate that could not be gone around. The action could not bypass the boundary. The evidence walked straight through it.
A boundary can refuse inadmissible evidence and still leave a path around itself. Input without output. Spotless evidence, judged correctly, on the decisions that happened to pass through, while other actions reach the world by a side door the boundary never sees.
And the subtle one. A boundary can reconstruct its verdicts perfectly and still have authorized on evidence that should never have been admitted. Replay without input. This is the binding-versus-admissibility line again. A faithfully bound, fully reproducible verdict over fabricated inputs has complete replay integrity and no input integrity. The replay confirms the verdict followed from the inputs. It says nothing about whether the inputs earned their place.
Run the other directions and the same independence holds. Three binary properties give eight combinations. Every one is reachable. Every authorization architecture lives in exactly one of them.
The classification
That is what turns this from a vocabulary into a tool. If the properties are independent, you can locate any product by which ones it satisfies, and you can locate an entire class by which one it structurally cannot.
| Property | The question it answers | The class that fails it |
|---|---|---|
| Output Integrity | Can execution bypass authorization? | Observability and advisory guardrails. They watch and they warn. Nothing about watching prevents the action. |
| Input Integrity | Was the evidence admissible? | Policy engines that authorize on caller-asserted facts. The rules are enforced correctly, on premises the caller supplied and no one warranted. |
| Replay Integrity | Can the verdict be reconstructed independently? | Signed logs and receipts. They establish that a verdict was issued. They do not let anyone re-derive it. |
Each class is competent at what it does. Each is also located. Observability is a different layer of the stack and does not claim to be the boundary; it fails the output question by construction. A policy engine that authorizes caller-asserted facts can be perfectly deterministic and perfectly bypass-proof and still fail at the input. A signed-logging system can record everything and reconstruct nothing. None of these are bad at their jobs. They are complete at one or two properties and incomplete as authorization boundaries, and the incompleteness stays invisible until you have the three properties to test against.
The distinguishing variable matters, and it is easy to state unfairly. A deterministic policy engine does not fail input integrity by being deterministic. It fails when it authorizes on facts the caller asserted and the boundary never warranted. The remedy is not less determinism. It is admissibility enforced at the boundary. Same engine, one property added.
From a feature to a model
The category began with one claim: authorization has to be enforced at runtime and cannot be bypassed. That claim is correct, and it is one property of three. Stated alone, it invites the reply that a competitor's gate is also hard to bypass, and the argument collapses into a feature comparison.
The three properties move the discussion off the feature and onto the boundary itself. The question is no longer whose gate is harder to bypass. It is whether a given architecture can stop an unauthorized action, refuse inadmissible evidence, and produce a verdict an adversary can reconstruct. A boundary that cannot do all three is not a strong control with a gap. It is an incomplete boundary that looks complete from the side you are standing on.
This is a model of what a complete authorization boundary requires. It is not a claim that any one system already satisfies every cell. The properties are uneven in maturity, in this corpus and everywhere else. Output and replay rest on established ground. Input is the newest of the three and the least built, by anyone. Naming the three does not ship them. It states what has to be true for an authorization boundary to deserve the name, and it gives a way to see which property a given system is quietly missing.
Three questions, one boundary
A boundary is complete when it can answer for all three. Can an unauthorized action execute. Was the verdict allowed to rest on this evidence. Can the verdict be reconstructed by someone who was not there and has no reason to trust you.
Most systems answer one of these well, build their story around it, and leave the other two implicit. The implicit ones are where the failures live, because a property no one names is a property no one tests. The Authorization Boundary Integrity Model is the set of questions that does not let any of the three stay implicit.
Three properties. One boundary. It is only as complete as its weakest unanswered question.