Proof-Carrying Decisions

A Proof-Carrying Decision (PCD) is the proof object defined by the Five Tests Standard: a tamper-evident record produced for every authorization verdict, representing the verdict, binding it to the policy evaluated, the inputs considered, and the runtime authorization boundary that issued it, and carrying the cryptographic attestations the standard requires. The record is produced so that the verdict can be reconstructed independently of the system that produced it; whether a particular deployed implementation satisfies the standard's requirements is a question of conformance.

FERZ uses "authorization artifact" as the doctrine-level class term; a Proof-Carrying Decision is one standard-specific implementation form of an authorization artifact under the Five Tests Standard.

A FERZ-defined proof object originating in the Four Tests Standard (4TS), first published in October 2025, and subsequently developed under the Five Tests Standard (5TS).

What a PCD records

A PCD is produced at the moment an AI action is authorized, denied, or abstained from. It records the verdict (ALLOW, DENY, or ABSTAIN), a reference to the policy evaluated, a binding to the inputs considered, and the cryptographic attestations the standard requires, binding the record to the runtime authorization boundary that issued it. The record is produced at the authorization moment, before execution. It is not a log entry written after execution. It is not a trace reconstructed from observation. It is the record that represents the verdict, rendered as a portable artifact; execution depends on the verdict, not on the existence of the record.

Independent verification

Because the record binds the policy reference, the input binding, and the verdict, and is tamper-evident, verification does not require access to the executing environment. A 5TS PCD includes the cryptographic attestations required by the standard. Independent reconstruction uses the record and its bound materials under the declared replay mode; signature verification additionally requires the applicable verification keys and trust assumptions. Whether a particular deployed implementation satisfies those requirements is established by conformance evidence, not by the name of the record. The FERZ corpus refers to this property as structural independence: the authorization verdict is severable from the system that produced it.

Same shape across three verdicts

Every PCD carries the same record structure regardless of verdict. The canonical verdict space contains three verdicts: ALLOW, DENY, and ABSTAIN. A DENY is as reconstructable as an ALLOW. An ABSTAIN verdict, which is fail-closed and blocks execution pending authorized human override, produces a PCD with the same record structure and required attestations as any other verdict. The verdict space has three values. The artifact space has one shape.

How it differs from logs, traces, and audit records

PCDs are not audit logs, observability traces, or forensic records. Logs and traces are produced after the fact and require trust in the recording system. A PCD is produced at the authorization moment and is reconstructable without trust in the executing environment. PCDs also differ from identity and access management artifacts: IAM tokens authorize principals to access resources; a PCD records the authorization of an AI action against encoded policy. Observability describes what happened. Logs record events. A PCD represents the verdict and carries what is needed to reconstruct it.

Where it sits in the framework

PCDs are the artifact output of execution-time authorization at the runtime authorization boundary. Where the boundary specifies the structural location of authorization and execution-time authorization specifies the temporal moment, the PCD specifies the form in which each verdict is recorded and made independently reconstructable. Together with the verdict space and the principle of non-bypassable governance, Proof-Carrying Decisions complete the artifact layer of the runtime authorization framework.

References

  1. Meyman, E. (2026). Five Tests Standard (5TS), v1.2.0. FERZ, Inc. https://doi.org/10.5281/zenodo.21040295 (edition relied upon: https://doi.org/10.5281/zenodo.21040296)
  2. Meyman, E. (2026). On the Impossibility of Observability-Based Authorization: An Information-Sufficiency Result for Pre-Execution Authorization, v2.0.0. FERZ, Inc. https://doi.org/10.5281/zenodo.19647542 (edition relied upon: https://doi.org/10.5281/zenodo.22930704)
  3. Meyman, E. (2026). Execution-Time Authorization for AI Agents: A Formal Framework for Deterministic Governance Boundaries, v3.1. FERZ, Inc. https://doi.org/10.5281/zenodo.18764561 (edition relied upon: https://doi.org/10.5281/zenodo.22261326)
  4. Meyman, E. (2026). The Authorization Artifact Test: Applying the Impossibility Result to Ex-Ante Authorization Requirements, v1.3. FERZ, Inc. https://doi.org/10.5281/zenodo.20013582 (edition relied upon: https://doi.org/10.5281/zenodo.22942924)

The full FERZ corpus is available at /research/papers, on Zenodo, and on SSRN.

Related concepts

Frequently Asked Questions

What is a Proof-Carrying Decision?
The proof object defined by the Five Tests Standard: a tamper-evident record produced for every authorization verdict, representing the verdict, binding it to the policy evaluated, the inputs considered, and the runtime authorization boundary that issued it, and carrying the cryptographic attestations the standard requires. It represents the verdict; it is not the verdict, and execution depends on the verdict rather than on the record.
How is a PCD different from an audit log?
An audit log records that something happened after the fact and requires trust in the system that produced the log. A PCD is produced at the authorization moment and can be reconstructed independently of that system. Logs describe events. A PCD represents a verdict and supports its reconstruction.
Can a PCD be verified without access to the executing system?
Yes. Independent reconstruction uses the record and its bound materials under the declared replay mode; signature verification of the attestations the standard requires additionally requires the applicable verification keys and trust assumptions. This property, called structural independence in the FERZ corpus, is what makes PCDs usable by regulators, auditors, and counterparties.
What does a PCD contain?
At minimum: the verdict (ALLOW, DENY, or ABSTAIN), a reference to the policy evaluated, a binding to the inputs considered, and the cryptographic attestations the standard requires, binding the record to the runtime authorization boundary that issued it. The Five Tests Standard specifies the proof object's required contents; whether a deployed implementation meets them is a question of conformance.
Is a PCD produced for an ABSTAIN verdict?
Yes. PCDs are produced for every verdict in the canonical verdict space. An ABSTAIN PCD records that execution was blocked pending authorized human override. The record structure and required attestations are identical across all three verdict types.
Cite this page

FERZ, Inc. (2026). Proof-Carrying Decisions: Definition and Architecture. https://ferz.ai/governance/concepts/proof-carrying-decisions

BibTeX 
@misc{ferz2026pcd,
 author = {{FERZ, Inc.}},
 title = {Proof-Carrying Decisions: Definition and Architecture},
 year = {2026},
 month = {May},
 publisher = {FERZ, Inc.},
 url = {https://ferz.ai/governance/concepts/proof-carrying-decisions}
}