Enhancement Without Transformation: When Access-Control Upgrades Leave Authorization Gaps Intact

An evaluator enhancement leaves an authorization deficiency intact when it preserves the deficient input, release, or evidence dependencies. Adding rules, attributes, ontologies, solvers, or signed logs to an identity and access management (IAM) arrangement can fix some things. It cannot fix the things it does not touch.

An organization deploying AI agents may already operate an access-control arrangement. Adding finer policies, richer attributes, an ontology, formal policy analysis, or signed decision records raises a specific question: which authorization requirements do those additions establish?

A new FERZ technical note, Enhancement Without Transformation, states the conditions under which an enhancement leaves an authorization deficiency where it was, and what has to change instead. The reasoning is structural and conditional: it depends on which dependencies a change alters, not on vendor or effort. This article gives the argument in plain terms. The note itself, with its propositions, worked example, and evidence matrix, is on Zenodo.

Three claims that get run together

The first move in the note is to separate three claims that "our IAM authorizes agent actions" tends to blur.

Category membership asks whether the arrangement performs runtime authorization at all. The corpus's own definition is demanding but reachable: the proposed action is an input to a pre-execution determination, evaluated under the applicable policy and authority state, with execution unavailable without an affirmative action-bound result. Request-level access controls and scoped credentials can meet it. Standing Eligibility versus Runtime Authorization says so, and this note repeats it.

Adopted-profile conformance asks whether the arrangement demonstrates the full set of requirements the FERZ corpus adopts: the three integrity properties of the Authorization Boundary Integrity Model, the two-prong Authorization Artifact Test, and the Five Tests Standard, over a declared scope. Category membership does not establish any of that.

Product equivalence asks whether the arrangement is equivalent to some particular implementation. The note claims this in neither direction.

The note's target has a name: deterministic authorization infrastructure, an arrangement that enforces and maintains the adopted profile's requirements across governed changes: deterministic action-bound verdicts, non-bypassable and fail-closed enforcement, release-time validity of governing state and bound dependencies, established input provenance, and authorization artifacts supporting independent reconstruction. Determinism is one requirement of that arrangement. It does not by itself establish the others. And the note is explicit that an arrangement built from conventional components can be that infrastructure, if, as deployed, it supplies those properties. The component's name establishes nothing either way.

One example, two messages

The note works everything through one stipulated case. An agent may send a status update through an approved messaging service to an approved external counterpart. Its delegated task excludes sending a document classified confidential.

Message A is the status update. Message B is the same status text with the confidential document attached. To the baseline access-control evaluator they are the same request: same principal, same operation, same service, same recipient, same channel, same context. The attachment is not in what the evaluator sees. The baseline policy permits the shared projection, and the note calls that result what it is, a baseline permission decision, not a conformant ALLOW.

Two things about the example matter. It is stipulated, not a description of any product. And the identical projection is a stipulation about this evaluator, not a claim that every IAM arrangement ignores attachments. The example exists so that the three propositions have concrete premises.

Three ways an enhancement can leave a deficiency intact

Adding inputs that do not qualify. Suppose the classification of the attachment is added to the request. Whether that closes the gap depends on where the classification came from. If the agent supplied its own label, "non-confidential," the label identifies its source but lacks classification authority under the stipulated policy, and its truth is not established. A determination that released message B on that label relied on unauthorized self-certification. An ontology does not repair this; an ontology represents distinctions, it does not establish that a particular assertion is sourced as the policy requires. If instead the request relays classification evidence satisfying the policy's source, integrity, binding, and freshness requirements, the input deficit may be resolved. That is the strongest reply to the note's first proposition, and the note accepts it.

Improving the evaluator on a path that is not the only path. Suppose message B fails to send, the agent enqueues a retry, and a queue worker with its own service credential re-drives it, and dispatch on that path proceeds without enforcement requiring ALLOW. No amount of reasoning power in the evaluator changes that path. The note's second proposition is invariance: an enhancement that preserves a path's reachability, capabilities, and downstream acceptance, and improves only evaluation, leaves the bypass as feasible as before. Closing that bypass changes enforcement, even if it takes only one configuration edit; a large evaluator rewrite that leaves the worker alone does not.

Releasing something other than what was authorized. Suppose message A is evaluated and permitted, and message B is presented for dispatch under that verdict. The unchanged principal, service, and recipient do not make B equivalent to A; the attachment is a material difference. Or suppose the agent's delegation is revoked after the determination and before dispatch. The verdict was bound to state that is no longer valid. The note's third proposition: authorization does not transfer across an unverified material change, and a better evaluator does not cure a release that is unbound to the determined action or to still-valid dependencies.

The three propositions fail differently and have different remedies. Closing one does not close the others, and the note keeps them apart on purpose.

What actually has to change

The note traces the stipulated arrangement through six stages, with what each adds, what follows, and what stays unestablished. The progression yields six practical requirements:

1. Represent the material distinction, so the evaluator can see the attachment at all.
2. Bring the classification in from a policy-recognized source, bound to the actual attachment, not from the requester's own label.
3. Render an action-bound determination in the three-verdict space. Where required evidence is absent or unresolved and the policy supplies no independently established basis for DENY, the determination is ABSTAIN and execution remains blocked pending authorized human resolution; custody transfers, and the boundary, not the human, emits the operative verdict.
4. Make every feasible path to the covered effect depend on an ALLOW from the designated decision process. This is mediation, and it is only one constituent of the release requirement.
5. At release, require canonical equivalence between the message dispatched and the message determined, and validity of the governing state and every bound dependency the determination relied on. Otherwise re-evaluate or block.
6. Produce the authorization artifact before release, binding the action, the inputs relied on, the governing state, the authority chain, the time, and the verdict, with the materials an independent verifier needs preserved and retrievable. No required artifact, no release.

Requirements 4 through 6 are separate obligations. Mediation establishes that the decision process cannot be bypassed on the covered paths. It does not establish that the ALLOW is bound to the exact message dispatched, that its dependencies are still valid, or that the record can be reconstructed.

A conforming arrangement from conventional components

The note ends the progression with an arrangement described only by role and interface contract: a policy decision point that evaluates the enriched representation and returns ALLOW, DENY, or ABSTAIN; an enforcement point at the messaging service's release interface that withholds dispatch until the full prerequisite is satisfied; a recognized classification authority as the attribute source; artifact generation and integrity protection; and a record store. The roles can be combined or separated. Under three stated contracts and explicit assumptions, that arrangement satisfies the modeled requirements by design.

That is a conditional design claim about a hypothetical arrangement, and the note says so. It is not a validated deployment, a certification, a statement about any vendor's product, or a claim about any FERZ implementation. It is there to make one point unmistakable: the question is never whether the components are conventional. The question is which dependencies a change alters.

The test to apply to any claim

A change is structural with respect to a deficiency when it alters one of that deficiency's dependencies, whatever its size, location, or packaging. Applied per deficiency, the test sorts the common enhancements quickly. Finer policy can correct an evaluation failure where the existing inputs are sufficient. It cannot recover an omitted material distinction, close an unchanged bypass, or establish missing release binding. A signed record of decisions establishes integrity of what was recorded, not a pre-execution determination or mandatory mediation. Formal analysis of the policy set answers questions about the policy; it is a real capability, documented in production tooling, and it is not a release verdict. Closing a bypass does not by itself establish release binding or reconstruction. Establishing release binding and freshness does not by itself establish complete mediation or qualified input evidence. The finding is non-implication, not that one change can never satisfy more than one obligation.

Three questions carry the test into a vendor conversation: for this action, what policy and authority permit it; what blocks execution without a valid ALLOW on every feasible path; and what authorization artifact lets someone outside the system reconstruct the verdict.

Read the technical note

Enhancement Without Transformation: Structural Limits of Extending Access Control into Deterministic Authorization Infrastructure. FERZ technical note, v1.0, September 2026. Author Edward Meyman; publisher FERZ, Inc.; CC BY 4.0. Concept DOI 10.5281/zenodo.22799948; version DOI 10.5281/zenodo.22799949. The Zenodo record is the version of record. The note develops the stipulated example first used in Containment Is Not Authorization and builds on Standing Eligibility versus Runtime Authorization and the Deterministic AI Governance monograph.

FAQ

Can IAM perform runtime authorization for AI agents?

Request-level access controls and scoped credentials can perform runtime authorization in the corpus's sense, when the proposed action is an input to a pre-execution determination and execution is unavailable without an affirmative action-bound result. That is category membership. It does not by itself establish deterministic evaluation, the three-verdict space, established provenance of the inputs, or independent reconstruction, which are what the adopted profile requires.

Is a signed decision log an authorization artifact?

Not by itself. A signed record establishes integrity of what was recorded. An authorization artifact binds the action as evaluated, the inputs relied on, the governing state, the authority chain, the time, and the verdict, exists before release, and supports reconstruction of the verdict by a party outside the system. A record created after an effect cannot supply a missing pre-execution determination.

Does formal policy analysis make an access-control arrangement into authorization infrastructure?

No. Tooling that analyzes access policies with satisfiability solvers exists and is documented; it answers questions about what a policy allows. Verification of a policy, verification of constraints on a proposed action, and the release determination are three different results. A verification result does not by itself establish an action-bound release verdict, although verification may participate in authorization.

Does the note say IAM cannot become deterministic authorization infrastructure?

No. It describes an arrangement of conventional components that would satisfy the modeled requirements by its contracts, under stated assumptions. What it rejects is the inference from "we added capability to the evaluator" to "the deficiency is gone," when the capability leaves the deficient dependency untouched.