On the Impossibility of Observability-Based Authorization: What Observation Cannot Supply

Observations can inform a pre-execution verdict. They cannot supply governing facts they do not contain, and replaying a report does not establish permission to act. Routine release should depend on sufficient governing information, an independently reconstructable verdict, and a fail-closed runtime authorization boundary.

Originally published April 20, 2026. Substantially revised September 25, 2026 following version 2.0.0 of the accompanying technical note; the earlier version's categorical claims about observational inputs are narrowed to match. The architectural argument stands and is made more directly here: observability cannot substitute for pre-execution authorization, and making human interpretation the ordinary release mechanism is practically unsustainable at action volumes that exceed adequate review capacity.

A proposed payment is not an executed payment. A model can prepare the instruction, a checker can inspect it, and an authorization procedure can evaluate it while release remains blocked. The consequential boundary is the point at which the covered effect can occur.

An observation of a completed payment cannot retroactively authorize it. An observation of a pending payment instruction can contribute evidence before execution. The design question is what that evidence establishes, what governing information remains missing, and whether execution depends on the resulting authorization verdict.

The payment case is used here because preparing the instruction has no covered effect of its own. Not every AI operation has a harmless proposal phase. Where generating the proposal itself discloses data or invokes a tool, that effect needs its own prior authorization boundary.

FERZ's position, developed below: in a high-throughput authorization path, the default should be direct evaluation of a bounded proposed action against authoritative policy, current authority, and relevant context. Observational evidence should enter only where its policy-defined role justifies the assurance and operational burden it adds.

What the paper establishes

The technical note On the Impossibility of Observability-Based Authorization: An Information-Sufficiency Result for Pre-Execution Authorization (version 2.0.0, September 2026) states one conditional result [1]. Put in terms of a single proposed action:

Where two governing states present identical information to an evaluator but require different permission outcomes for the same proposed action, no procedure restricted to that information can guarantee correct resolution in both.

Information here means everything available to the procedure: compiled policy, configuration, supplied authority, memory, and any other input, not only a visible trace. Fixed model behavior alone does not establish the premise. The evaluator's entire input must be identical across the two states.

The note illustrates the condition with a payment. In both states the pending instruction, amount, recipient, and behavioral record are the same, and every other material condition is met. In one state the delegation under which the agent acts is current; in the other it has expired. Permission differs, and an evaluator that lacks the delegation difference cannot resolve both states correctly. The pair is stipulated, not measured in any deployment. Supplying the current delegation record removes this particular pair. It does not, by itself, establish any other authorization property.

The result does not say that every evaluator must decide unsafely. ABSTAIN lets an evaluator leave an unresolved case blocked. Nor does the note claim that every deployment contains such facts, exclude observational inputs from authorization, or derive every requirement FERZ places on a runtime authorization boundary.

The rest of this article is design guidance: architectural choices and the assurance burdens they carry. It adds no further impossibility results.

Reconstructable is not enough

Five questions are easy to run together. They have separate answers.

Reconstruction. Can an independent party reconstruct the verdict from the authorization artifact and its authenticated bound materials under the declared replay mode?
Origin and integrity. Is the source of each input established, and are the bound materials the materials the evaluation actually used?
Qualification. Does governing policy permit this evidence, and does it support the condition at issue, with adequate freshness and relevance?
Sufficiency. Does the available information distinguish the governing states that would require different permission outcomes for this action?
Execution control. Does every in-scope path capable of the covered effect require the valid, action-bound ALLOW and its authorization artifact?

A captured observation can be a replayable input to a deterministic verdict. Reconstructing that verdict means re-evaluating the captured value, not regenerating the model's trace. Capture does not improve the evidence, however. Recording and signing a report that is false, stale, incomplete, or irrelevant cures none of those defects. A signature can show that a record has not changed since it was signed; it does not show that the record was true or sufficient.

The converse also holds. A record called a log may carry a genuine authorization artifact. Classification follows properties, not names. The Authorization Artifact Test draws the same line [2]. Under the test's stated criteria, a verdict computed from captured observational inputs can satisfy its two prongs; whether those inputs are permitted, qualified, and sufficient to ground authorization remains a separate question.

A yes to the first question establishes reconstruction and nothing more. It does not establish the origin or truth of the inputs, the correctness of the policy, the sufficiency of the information, or that release depended on the verdict.

The practical design choice

Where a pre-execution authorization requirement has been declared, FERZ takes the following design position. It is a position, not a consequence of the theorem:

Design the ordinary authorization path to evaluate the proposed action against sufficient policy, current authority, and relevant state. Where an observation contributes to permission, specify what it establishes, how it is qualified, and how it is consumed. Interpreting the model's account of its behavior cannot substitute for governing information, and a reconstructable verdict does not by itself establish an enforced release condition.

In practice this means evaluating a governing condition directly where a designated source is recognized by governing policy as authoritative for that fact at the relevant time. To establish that an agent's delegation is current, retrieve the current delegation record. Do not infer it from the model's confident explanation of why it is authorized.

Both sources still need qualification. Authoritative does not mean infallible, and a record retrieved yesterday may not be current today. The difference lies in what the evaluator must infer. The delegation record states the governing fact; the explanation is evidence about the model, from which the fact would have to be inferred. The explanation may repeat what the record says, or it may be stale, wrong, or silent on the very fact that decides permission. Repeating the delegation record adds no authority. Any additional claim in the explanation requires its own evidentiary basis; the model's assertion cannot establish that its delegation is current.

When an automated procedure cannot resolve permission from its available governing information, release must remain blocked until the information gap is resolved or an authorized human supplies the determination that policy permits. Observability does not remove that work. A design that routinely depends on people to interpret traces, recover context, and decide whether each proposed action may proceed makes human review capacity a prerequisite for release.

That arrangement can provide pre-execution authorization, but its throughput depends on reviewer capacity. When arrivals exceed that capacity, a fail-closed system must queue, throttle, or refuse actions. Maintaining throughput by abbreviating review instead puts the adequacy of the judgment at risk. Capturing every approval in a reconstructable authorization artifact does not establish that the reviewer deliberated adequately.

Reaching pre-execution authorization through observation and routine human review is like pushing a car when you could drive it. The car moves, but slowly, and only as far as there are people to push. Routine review also introduces variation in judgment: different reviewers, or the same reviewer at different times, may resolve the same case differently. Fatigue and time pressure put review quality at risk. Every action assigned to review consumes human capacity, so sustaining greater volume requires more capacity or less review per action. For action classes whose governing conditions can be evaluated automatically, this spends scarce human judgment on decisions a deterministic procedure resolves the same way every time from the same bound inputs and governing state. FERZ's position is that for such classes, that evaluation belongs at the runtime authorization boundary. Making human interpretation the ordinary release mechanism is practically unsustainable at action volumes that exceed adequate review capacity, and additional observability does not change that.

Human judgment retains a central role. When the boundary emits ABSTAIN, execution remains blocked pending authorized resolution. The person supplies authority-bound input; the boundary materially consumes it and emits a separate action-bound verdict. Patterns across these resolutions can identify candidates for policy clarification or amendment, but recurrence alone does not establish a policy defect. Where separately authorized amendments make the governing conditions suitable for automated evaluation, and the required evidence is available, later actions in the covered class can be evaluated at the boundary without routine human review. Human effort can thereby improve the rules governing later actions instead of repeatedly resolving the same uncertainty. Classes that policy reserves for human authority remain with people.

Direct evaluation is not free of interpretation. Identifying the proposed action, formalizing the policy, qualifying context, and handling semantic uncertainty remain real work. The position concerns where that work belongs: in a policy-defined evaluation of governing inputs, not in open-ended interpretation of the model's account of itself.

Five burdens on the release path

An observation on the release path is not disqualified by its origin. It does add burdens that the design should justify. These are conditional design burdens, not benchmarked comparisons.

Burden	What the design must address	What this does not imply
Latency and availability	Every synchronous collection, interpretation, or verification step is a dependency before release. If required evidence is unavailable, release blocks.	No fixed delay, and no rule that observations are slower than direct sources. Inputs may already be available, bounded, cached under valid freshness rules, or evaluated in parallel.
Variability and meaning	Explanations and classifier outputs can vary between runs. Policy must define how a captured value is evaluated.	A stochastic producer does not make the verdict nondeterministic. A deterministic authorization procedure returns the same verdict over the same bound inputs and governing state.
Qualification	Source, integrity, freshness, relevant scope, thresholds, conflicts, and material use must be defined.	Direct governing inputs carry qualification burdens too. The added burden arises when behavior stands in for a fact that could be obtained directly.
Manipulation	If an agent-controlled report affects permission, the threat model must consider how shaping that report could affect release.	A threat-model concern, not evidence of observed attacks or of inevitable exploitability.
Capacity and operations	Human or open-ended interpretive review adds staffing, queueing, and recovery dependencies.	No claim of lower cost or higher throughput. Policy may reserve an entire action class for human decision.

The variability row turns on a distinction worth keeping in view. Repeated generation can vary; a deterministic authorization procedure returns the same verdict over the same bound inputs and governing state. The first is a property of the evidence producer, the second of the evaluation. Treating them as one leads to the mistaken claim that any observational input makes the authorization decision nondeterministic.

Where observation belongs

Observation remains essential for audit, incident investigation, operational monitoring, testing, model assessment, and exception detection. It also belongs on the release path when policy requires it.

Consider a policy that permits a machine action only while a qualified sensor reading of the governed environment is within a defined range. The reading is an observation, but it may be a material context fact rather than an observational characterization of the model. If policy identifies the sensor, integrity mechanism, freshness window, and decision rule, the reading can contribute to ALLOW. It does not itself confer authority: the policy and the authority under which the action proceeds still come from governing sources. The example illustrates a policy structure; it is not a safety-certified design.

The distinction that matters is between bounded, policy-defined measurement and open-ended interpretation of a model's self-explanation. Neither the origin of an input nor whether it contributes to ALLOW determines the architectural class.

Signals do not emit verdicts on their own. A qualified, policy-defined condition may be consumed by the boundary to return DENY or ABSTAIN, or an independent protective mechanism may hold execution. A hold is not automatically a DENY verdict. The absence of an alarm is not permission unless the full governing evaluation establishes permission.

Human override without bypass

FERZ's doctrine for human resolution, developed in The Override Asymmetry [3], runs as follows. ABSTAIN blocks execution pending authorized human override. The resolver supplies authority-bound input; the runtime authorization boundary materially consumes it and emits a separate action-bound verdict. Execution proceeds only on a valid ALLOW represented in an independently reconstructable authorization artifact. If the evaluator cannot produce a valid verdict, execution remains blocked without requiring an ABSTAIN verdict.

Human resolution may recur for every action in a class that policy reserves for human decision. In every case, the resolver's input must fall within granted authority and meet the applicable evidence requirements; it cannot supply a missing fact or waive a requirement without authority to do so.

A policy amendment that later draws on a resolution is not what authorized the held action. Reconstructing the resulting verdict does not reconstruct the resolver's reasoning or establish that the deliberation was adequate.

Labels settle nothing. An arrangement sold as guardrails with human-in-the-loop review satisfies these requirements if the deployed system actually implements them. One sold as ABSTAIN with authorized resolution fails them if it does not.

Three arrangements compared

Arrangement	What it does	What must be demonstrated
Behavioral assessment alone	Characterizes the governed system's behavior.	It makes no permission determination; a further governing evaluation must supply one.
Authorization using sufficient qualified governing inputs	Evaluates the proposed action and binds the verdict.	Release dependency, demonstrated separately.
Authorization that also uses a required observational assessment	Evaluates the proposed action under sufficient governing information, using the assessment as qualified evidence where policy requires it.	The assessment's policy-defined evidentiary role, origin, integrity, freshness, semantics, availability and failure behavior, bound materials, and release dependency.

The second and third arrangements can both satisfy the authorization requirements, provided their governing evaluation, artifact sufficiency, and enforced release dependency are demonstrated. Both converge on the same runtime authorization boundary and the same ALLOW condition, and execution remains a separate event. The first is not disqualified by where its inputs come from. It lacks a permission determination.

Questions to ask before relying on a system

What covered effect is being authorized, and where is the last effective release control before it occurs?
What exact proposed action and release-time state does the verdict bind, and how are changes handled?
Which policy, current authority, and relevant context determine permission, and which material conditions remain assumptions?
Which observational inputs contribute to the decision, why are they necessary, and what qualifies their source, integrity, freshness, meaning, and use?
Can an independent party reconstruct the verdict from the authorization artifact and bound materials without access to the governed system?
Does every path capable of the covered effect depend on a valid, action-bound ALLOW, including administrative, retry, recovery, and human-resolution paths?
What happens when evidence is missing, authority is expired, evaluation is unavailable, or the action remains unresolved?
For claims about speed and cost, what measurements include collection, interpretation, qualification, queueing, and recovery on the release path?

Missing or insufficient evidence leaves the relevant property unestablished. A demonstrated counterexample can establish that the property fails within the evaluated scope. Neither finding alone determines the system's entire architectural class or establishes misleading marketing. The Enforcement Test Protocol, defined in Observability Is Not Enforcement, states related criteria for execution-path evidence [4].

What release depends on

The practical question is what release depends on. Observation may contribute evidence. Permission requires sufficient governing information and an action-specific determination; enforcement requires execution to depend on that determination. Put each function where it belongs, and require evidence for every dependency between them.

By Edward Meyman, FERZ, Inc.

References

Meyman, E. (2026). On the Impossibility of Observability-Based Authorization: An Information-Sufficiency Result for Pre-Execution Authorization. Technical Note, Version 2.0.0. FERZ, Inc. Concept DOI: https://doi.org/10.5281/zenodo.19647542. Version DOI (v2.0.0): https://doi.org/10.5281/zenodo.22930704
Meyman, E. (2026). The Authorization Artifact Test: Applying the Impossibility Result to Ex-Ante Authorization Requirements. Regulatory Application Note, Version 1.3. FERZ, Inc. Concept DOI: https://doi.org/10.5281/zenodo.20013582. Version DOI (v1.3): https://doi.org/10.5281/zenodo.22942924
Meyman, E. (2026). The Override Asymmetry: Why ABSTAIN with Authorized Resolution Is Not Guardrails with Review-Only Human-in-the-Loop. Technical Note, Version 2.3. FERZ, Inc. Concept DOI: https://doi.org/10.5281/zenodo.19772248. Version DOI (v2.3): https://doi.org/10.5281/zenodo.22943421
Meyman, E. (2026). Observability Is Not Enforcement: A Doctrinal Framework for Distinguishing Compliance Instrumentation from Runtime Authorization in AI Governance Architectures. Working Paper, Version 2.0.0. FERZ, Inc. Concept DOI: https://doi.org/10.5281/zenodo.18663864. Version DOI (v2.0.0): https://doi.org/10.5281/zenodo.22069467