Deterministic AI Governance: An Executive Guide to Runtime Authorization and Spotting the Fake
AI systems in production take actions with consequential effects: flagging a person, denying a request, escalating a case, or restricting access. These are not merely model outputs. They are organizational effects that may create legal, operational, and reputational exposure.
The organization assumed responsibility for the authorization boundary when it permitted the system to act. That responsibility did not wait for a governance program.
Observability is not authorization
An AI governance program may be able to describe what a system did without being able to establish that the system was permitted to do it.
Monitoring may reveal drift, bias, or anomalies. By itself, it does not establish that a specific action was authorized before execution. The same limit applies to the whole family of observation tools. An organization can assemble drift detection, bias measurement, content filtering, red-team results, and a dashboard, and still have no mechanism by which an unpermitted action fails to execute. Combining observers produces a more detailed account of what happened. It does not produce a gate.
There is a second reason the gap goes unnoticed. Generative AI systems can produce fluent, authoritative-seeming language. Fluency does not establish authority. Fluent output invites the assumption that something authorized it. That assumption may go untested until an outcome is disputed.
Regulators, auditors, litigators, insurers, acquirers, and boards may ask whether the organization can establish that an AI action occurred under controlled authority. That question is not answered by a description of what the system did.
The runtime authorization boundary
For an AI system permitted to produce external effects, there is a point at which an output stops being informational and becomes an action: a record is written, a claim is denied, a payment moves, or a patient is reordered in a queue. The runtime authorization boundary must be enforced before that transition.
Every proposed effect-bearing action must cross a non-bypassable pre-execution authorization boundary. Only ALLOW permits release. DENY and ABSTAIN block execution, and ABSTAIN remains blocked pending an authorized human override.
A governed action resolves to exactly one of three verdicts.
| Verdict | Meaning | Effect on execution |
|---|---|---|
| ALLOW | Authorized under the governing policy | Execution may proceed |
| DENY | A policy violation is identified | Execution halted, no side effects permitted |
| ABSTAIN | Policy cannot resolve the action either way | Blocked pending an authorized human override |
ABSTAIN is easily misread as indecision. It is instead a fail-closed verdict: policy did not authorize execution. Escalation is the consequence of ABSTAIN, not a separate verdict. It is not a soft maybe, not a warning, and not a queue entry the system proceeds past.
The boundary produces evidence as well as a gate. A log records that something happened. An authorization artifact records whether a proposed action was permitted, the basis for the verdict, the authority in force, and the inputs on which the verdict rested, and it is produced before execution rather than assembled afterward from fragments. FERZ calls this evidence object an authorization artifact. The FERZ authorization artifact is an implementation of the Proof-Carrying Decision object required by the Five Tests Standard.
If the authorization artifact cannot be produced, the action does not proceed.
The five questions
These five questions can be put to a supplier or an internal team without technical background. Verifying the answers requires technical evidence.
1. Stop. Can an authorized human halt the system before an action produces an effect, through a control enforced at runtime?
A passing answer names the roles, names the control path, and demonstrates a blocked action that produced no effect.
2. Ownership. Which named role in the organization owns each class of action?
A passing answer is an enforced action-class-to-role mapping, with recorded acceptance by each named accountable role.
3. Replay. Can a past authorization verdict be independently reconstructed?
A passing answer: the authorization artifact binds the proposed action, the inputs used, the applicable policy and version state, the authority chain, and the resulting verdict. An independent third party can reconstruct the verdict from that evidence, without access to the governed AI system, and obtain the same verdict.
4. Escalation. What happens when policy cannot resolve the action?
A passing answer: the system returns ABSTAIN and execution remains blocked pending an authorized human override. The authorization artifact records the verdict, the named authorized resolver, the time, and either the override or the continued block.
5. Provenance. What is the established origin of the inputs grounding the verdict?
A passing answer: evidence binding each grounding input to an established origin and showing that reliance on it was permitted. When either origin or permitted use cannot be established, the action fails closed.
Provenance addresses a property the other four tests do not. Stop, Ownership, Replay, and Escalation may all be satisfied while a verdict still rests on an input whose origin is unknown or whose use was not permitted. Provenance establishes origin and permitted reliance, not truth.
One limit is worth stating plainly. Provenance is normative in the Five Tests Standard, but machine-checkable conformance remains deferred until input-origin binding is specified in the Proof-Carrying Decision object. The substantive requirement still applies. The current specification does not yet define machine-checkable Provenance conformance vectors.
What deflection sounds like
The pattern to listen for is an answer that describes noticing a problem rather than preventing an unauthorized action.
On Stop: "We have comprehensive incident response procedures." Incident response operates after the effect. A brake operates before it.
On Ownership: "Our AI governance committee oversees this." A committee may oversee the program, but a passing answer identifies the accountable role for each action class and shows that the assignment is recorded and enforced.
On Replay: "We maintain comprehensive audit logs." Logs may establish sequence. They do not, by themselves, establish pre-execution authorization. The same applies to interpretability output. Explanatory material may be evidence for other purposes. It does not, by itself, establish pre-execution authorization or satisfy the Replay Test.
On Escalation: "It flags for human review." A review queue is not a runtime authorization boundary. If involvement is optional, parallel, or after the fact, the system is still acting alone.
On Provenance: "It only retrieves from your own documents." By itself, retrieval over an internal repository identifies a storage location, not necessarily the origin of the material. Open web access does not, by itself, establish input origin or permitted reliance.
On policy: "We have responsible AI principles and a governance charter." Ask whether the system can perform an action those principles forbid. If the action can execute despite the policy, that policy is not enforced at the runtime authorization boundary.
On determinism: "AI is probabilistic, so determinism is not a reasonable expectation." This is a category error. Probabilistic model behavior is being offered as an answer to a different question. The model output may vary. The runtime authorization boundary can still be required to produce the same verdict from the same governed inputs, policy state, and authority state, and to preserve an independently reconstructable record.
The procurement question is whether the organization will require these defined properties and the corresponding evidence before deployment.
Read the complete guide
The complete Executive Guide sets out the Five Tests, the evidence a passing answer must contain, the common deflection patterns, and the technical relationship between Replay and Provenance.
Read or download the complete guide on Zenodo
Published by FERZ, Inc. under CC BY 4.0 as the series introduction to the AI Governance Executive Guide Series. Sector volumes applying the same doctrine to healthcare, financial services, federal programs, and government contracting are available in the Executive Guide Series.