On the Impossibility of Observability-Based Authorization: A Formal Impossibility Result for Ex-Ante AI Governance
A new formal impossibility result for regulated AI deployment.
By Edward Meyman, Founder & CEO, FERZ, Inc. Published April 20, 2026
The Question Regulated AI Must Answer
As AI systems move from content generation into consequential action — writing to production databases, issuing payments, modifying infrastructure, rendering clinical decisions — the question regulators and enterprises are being forced to answer is no longer whether an action occurred but whether it was permitted before it occurred.
That shift is more consequential than it looks. Regulated environments do not treat execution as a fact to be documented. They treat it as a privilege to be authorized. An action that executes without prior authorization is not retroactively legitimized by a well-constructed audit trail. It is an unauthorized action with a thorough record attached.
This is why the ex-ante authorization requirement — embedded in frameworks ranging from the EU AI Act's human-oversight provisions under Article 14 to GDPR's restrictions on solely automated decision-making under Article 22 to HIPAA's technical-safeguards requirement under 45 C.F.R. § 164.312 — is becoming the regulatory center of gravity for AI governance. Each points, in different language and with different force, toward the same structural requirement: consequential actions must be authorized before execution, with the authorization represented in an artifact that an independent verifier can check.
A new formal impossibility result, now published by FERZ, establishes that an entire class of architectures currently marketed as AI governance cannot satisfy this requirement. The result is structural, not a matter of implementation quality. The architectures in question — monitoring systems, observability pipelines, guardrails, and human-in-the-loop approval workflows — describe, filter, or interrupt AI behavior. They do not authorize it. The distinction is not one of sophistication or latency. It is architectural, and it is permanent.
The paper, On the Impossibility of Observability-Based Authorization: A Formal Impossibility Result for Ex-Ante AI Governance, is available at https://doi.org/10.5281/zenodo.19647543.
Two Kinds of Architecture, Two Kinds of Output
The impossibility result turns on a precise definitional distinction that has been developed across the FERZ research corpus over the past year and that the note now formalizes.
An observability architecture is any system whose inputs are properties of the governed system — its internal states, traces, self-evaluations, or output patterns — and whose operation is to characterize those properties. Dashboards, log aggregators, drift monitors, and content filters all fall within this category. So do human-in-the-loop approval workflows that observe the proposed action and render a judgment based on that observation. So do guardrails that inspect model outputs after generation. What unites them is not interface or latency. It is structural: the architecture's inputs are signals from the governed system.
An enforcement architecture is any system whose inputs are policy, context, and proposed action specification received as artifacts existing independently of the governed system, and whose operation is to evaluate a candidate action against externally specified policy. An enforcement architecture does not characterize the system. It evaluates a candidate against rules it received from somewhere else.
This distinction — developed doctrinally in Observability Is Not Enforcement, architecturally in From Monitoring to Authorization, and categorically in Execution-Time Authorization for AI Agents — has been the organizing principle of FERZ's research program. What the corpus did not yet contain was the formal proof that the separation between the two classes is structural rather than contingent. That is what the new note supplies.
The Theorem
Stated informally, the result is this: no observability architecture can produce the authorization artifact required by an ex-ante regulatory regime. Not because current observability architectures are immature. Because the class of observability architectures is structurally incapable of producing such an artifact, and no improvement in latency, sophistication, or intervention capability changes that.
The proof runs in three lemmas, each closing a specific escape route.
Lemma 1 establishes that observability signals are causally posterior to the governed system's generation of the action they would authorize. An observation of an event cannot precede the event. If the architecture's inputs are derived from how the system produced a candidate action, then those inputs exist only after the system has begun producing it. They cannot support a pre-execution verdict in the sense that an ex-ante regime requires.
Lemma 2 establishes that even if an observability architecture could in principle produce a pre-execution verdict, the resulting artifact could not be verified independently of the governed system. An ex-ante regime requires that a third party in possession of policy, context, and proposed action specification — and the artifact — be able to recompute the verdict identically, without access to the governed system. An architecture whose verdict depends on observational characterization cannot satisfy this requirement, because reconstructing the verdict requires re-running the observation, which requires access to the system. The failure modes in Lemmas 1 and 2 are structurally independent: an architecture can fail either without failing the other. Observability architectures fail both.
Lemma 3 closes the composition escape route. No combination, aggregation, filtering, or cryptographic signing of observational outputs transforms them into an independently constituted authorization verdict. A signature over a report produces a signed report. It does not produce a verdict. The theorem's two corollaries extend the result across latency and intervention. Zero-latency observation remains observation. An observability architecture that halts execution upon observing an unauthorized attempt has prevented the action, but prevention is not the authorization artifact the regime requires. The halt is not a verdict.
What This Means for Specific Architectures
The impossibility result is categorical. Architectures that fall within the observability class fail ex-ante authorization regardless of what they are called in product marketing. Each of the following approaches is commonly presented as governance. Each fails for a different structural reason.
Monitoring and observability platforms fall within the observability class by definition. Their inputs are signals from the governed system — logs, traces, metrics, drift indicators. Their outputs are characterizations of behavior. Audit trails document what occurred; they do not authorize what may proceed. A well-engineered monitoring system is still a monitoring system.
Guardrails and content filters fall within the observability class. They inspect AI outputs and either permit or block them based on pattern matching or classifier scoring. The inputs are system outputs — properties of the governed system. These architectures may prevent a subset of unauthorized actions. They do not produce the artifact demonstrating that any specific action was authorized. A block is a prevention; it is not a verdict rendered against policy.
Human-in-the-loop approval systems fall within the observability class in most deployments. The reviewer observes the proposed action, the context, and often the system's reasoning trace, then renders a judgment. This is observation followed by judgment. The reviewer's approval constitutes the authorization artifact an ex-ante regime requires only if the approval is itself rendered under an externally specified policy with reproducible evaluation criteria, bound to a specific policy version, and verifiable without access to the system. Without those properties, the approval is an observer's judgment, not a verdict derived from policy.
AI safety overlays that log, sign, and timestamp decisions fall within the observability class. They produce tamper-evident records of what happened. They do not produce the pre-execution evidence that the action was authorized. A signature on an audit bundle is a signature over history. A signature on an authorization verdict is a condition for the future. A signature over a report produces a signed report. It does not produce a verdict.
None of this is a criticism of the value these systems provide. Monitoring, observability, filtering, and human review each serve real functions. The impossibility result does not claim they are without value. It establishes that they do not, and cannot, substitute for authorization when the regulatory regime requires authorization.
Why the Distinction Is Structural
The temptation, on encountering this argument, is to look for a technical fix. Could a faster observability system close the gap? Could a richer signal set turn observation into authorization? Could a cryptographic technique — zero-knowledge proofs, hardware attestation, threshold signatures — transform an observation-based verdict into an independently verifiable one?
The theorem's structure shows why no such fix exists. Lemma 1 is not about latency; it is about causality. An observation of an action cannot precede the generation of that action regardless of how fast the observation runs. Lemma 2 is not about cryptographic technique; it is about the verifier's input set. An independent verifier by definition does not have access to the governed system. If the verdict depends on observational characterization, the verifier cannot reproduce it regardless of what cryptographic wrapper the original system placed around it.
These are structural properties of the two architectural classes, not engineering limitations of current implementations. A more sophisticated observability architecture is still an observability architecture. A sufficiently clever observational overlay is still an overlay. The impossibility result establishes that the separation between observability and enforcement cannot be closed from the observability side.
Positioning Relative to the Broader FERZ Research
The new note provides the formal backbone for conclusions that FERZ has been developing across multiple complementary treatments.
A Taxonomy of AI Governance Approaches distinguishes three fundamentally different governance problems — visibility, alignment, and authorization — and argues that the AI governance market conflates them. The taxonomy establishes authorization as a distinct architectural category rather than a variant of monitoring.
Observability Is Not Enforcement formalizes the doctrinal distinction along five architectural axes — enforcement locus, signature semantics, failure behavior, bypass resistance, override governance — and introduces a six-criterion Enforcement Test Protocol. The paper establishes that observability and enforcement are structurally distinct categories, not positions on a maturity spectrum.
From Monitoring to Authorization analyzes the shift across jurisdictional regulatory consultations (EU, U.S., and Asia-Pacific) and specifies the Minimum Authorization Boundary Contract: non-bypassable runtime gating, deterministic verdict semantics, fail-closed defaults, policy-state binding, portable evidence artifacts, independent replay capability.
Execution-Time Authorization for AI Agents formalizes authorization as a distinct architectural category with a mathematical model and six required invariants: determinism, fail-closed enforcement, non-bypassability, decision artifact completeness, replayability, and time-bounded evaluation without fail-open.
The Authorization Threshold establishes the threshold concept itself — the dividing line between governed and ungoverned actions — and introduces the evidence-versus-proof distinction as the epistemic framing for what an authorization artifact must provide.
Across these papers, the claim is consistent: observability documents behavior; enforcement determines permissibility. The new impossibility note provides the formal proof that the distinction is structural.
What This Means for Buyers and Regulators
For enterprise buyers evaluating AI governance solutions in regulated sectors, the result produces a specific diagnostic question. Not "does this system monitor, filter, or alert?" Not "does this system produce comprehensive logs?" Not "does this system sign its audit trail?" The question is: can this system produce an authorization artifact, prior to execution, that an independent verifier can check without access to the system?
If the answer is no, the system is an observability architecture under the definitions. It may provide genuine value. It does not satisfy the ex-ante authorization requirement.
For regulators, the result provides a formal basis for enforcement decisions that distinguish governance-adjacent compliance from governance-grade compliance. Systems that document what happened are not equivalent to systems that demonstrate, before the fact, that what happened was permitted. The distinction has been argued doctrinally; it is now provable formally.
For AI vendors making governance claims, the impossibility result raises a specific standard. A system that processes observational inputs — however sophisticated — cannot be marketed as an authorization architecture without either misrepresentation or a reframing of the claim. The test is not whether the system is well-engineered. The test is whether its inputs are artifacts independent of the governed system and whether its outputs can be verified without access to the governed system.
The Structural Implication
As AI agents move into healthcare, financial services, defense, and critical infrastructure, the distinction between observation and authorization becomes a liability boundary rather than a philosophical one. Deterrence-based security models assume the governed entity can be influenced by the threat of consequences. AI agents lack fear, reputation, and career concerns. They require architectural constraints — enforcement that does not depend on the governed entity's willingness to be governed.
Observability architectures depend on observing what the governed system does. Enforcement architectures depend on rulings against externally specified policy. Only the latter produces the artifact an ex-ante regulatory regime requires. The impossibility note proves formally that the two cannot be reduced to each other.
The question for regulated AI deployment is not whether to adopt observability. Observability remains necessary for operational visibility, incident response, and retrospective audit. The question is whether observability is where governance ends or where it begins. If regulators require proof that specific actions were authorized before execution, observability ends at describing. Enforcement begins where authorization must be proven.
Read the Full Paper
The complete technical note, including the formal theorem, three lemmas, two corollaries, and the mapping to the Enforcement Test Protocol, is published open-access on Zenodo:
On the Impossibility of Observability-Based Authorization: A Formal Impossibility Result for Ex-Ante AI Governance Edward Meyman · FERZ, Inc. · April 2026 · Version 1.3.2 DOI: 10.5281/zenodo.19647543
The full FERZ research corpus on deterministic AI governance is available at https://zenodo.org/communities/ferz/.
Related Research
- A Taxonomy of AI Governance Approaches — Visibility, alignment, and authorization as distinct governance problems
- Observability Is Not Enforcement — The doctrinal framework and the six-criterion Enforcement Test Protocol
- From Monitoring to Authorization — The Minimum Authorization Boundary Contract and the cross-jurisdictional regulatory trajectory
- Execution-Time Authorization for AI Agents — The formal architectural category with six required invariants
- The Authorization Threshold — The evidence-versus-proof distinction and the threshold concept
FERZ develops deterministic governance infrastructure for AI systems in regulated environments. Learn more about FERZ's work on runtime authorization and deterministic AI governance methodologies.