Governance that can be bypassed is not governance

The position

FERZ governance is a non-bypassable runtime authorization boundary evaluated before execution. Three conditions make the boundary non-bypassable, and each is a structural fact about the deployment rather than a property of the policy. The boundary is in the path of every covered action, so no covered action reaches its effect without traversing it. Release depends on the boundary's verdict, and a failure to evaluate produces no ALLOW: fail-closed is definitional, not tier-dependent. And the governed system has no unauthorized control over the mechanism that enforces authorization, its dependencies, or the conditions under which it governs release.

The independence condition was previously carried as an environmental assumption in the FERZ works examined. A control can sit in every execution path, release only on ALLOW, and fail closed while reading its policy from a store the governed system can write. In that configuration, complete mediation holds, but enforcement independence fails because the governed system can change enforcement-relevant state. Execution-Time Authorization identifies the governed agent as the primary threat actor; Enforcement Integrity specifies the evidence required to assess the control relationship. Where the capability is demonstrated, independence is defeated. Where the evidence is insufficient, independence is not established.

The consequence is a test rather than a label. A product that describes itself as deterministic, runtime, or fail-closed has made a claim about position, and the claim is checked by asking whether any covered action can reach its effect without the verdict, whether a failure can produce an ALLOW, and whether the governed system can change what the boundary relies on. A demonstrated bypass or unauthorized control capability defeats the corresponding claim. Where supporting evidence is insufficient, the claim remains not established. Such controls may still provide useful monitoring, advice, or partial enforcement, but they do not establish a non-bypassable runtime authorization boundary under the FERZ doctrine.

Counter-positions

“Defense in depth makes bypass improbable.” Correct as a risk statement, and the doctrine does not dispute it. Reducing the probability of bypass is a risk posture; non-bypassability is a structural property established relative to a declared scope, authority model, and capability model. A probability is evidence about a configuration; it is not a demonstration that no covered path avoids the boundary. Where the demonstration is absent, the claim of governance is not established, whatever the layers contribute to risk.

“Every control can be bypassed by a sufficiently privileged actor.” Also correct, and the doctrine is scoped accordingly. Non-bypassability is asserted relative to a declared configuration and capability model, with residual assumptions stated: the boundary's independence from the governed system within that model, not immunity from every actor in the world. An actor outside the declared model is a stated assumption, and a change to the configuration reopens the question. What the doctrine rejects is a control whose bypass lies inside the governed system's own reach, or inside the authority the rules assign to it.