Mediation is not independence

The position

Two questions are asked of a runtime authorization boundary. Whether every covered action traverses the boundary is a question about execution-path closure, one necessary condition of boundary completeness. Whether the governed system can alter the mechanism, its dependencies, or the conditions under which it governs release is a question about control, answered by enforcement independence. Complete mediation does not imply independence, and independence does not imply complete mediation: a gateway in every path can read its policy from a store the agent can write, and a mechanism beyond the agent's reach can sit beside a path that never reaches it. A claim that a boundary is non-bypassable requires both bodies of evidence.

Independence has two parts, assessed relative to a declared configuration, scope, authority model, and capability model. The authority model must reserve the protected elements to authority the governed system cannot supply or substitute: the designation of the boundary as the source of the verdicts on which release depends, the condition that release depends on that verdict, the source of governing authority, and the rules for modifying any of these, including the amendment procedure itself. An authority model that assigns the governed system a protected element, directly or by delegation, fails on its face; independence cannot be defined away by assignment. And within the declared capability model, including actors whose actions the governed system can obtain, the governed system must have no unauthorized control over what the boundary relies on.

Three outcomes are kept apart. A prohibited authority assignment, a demonstrated reachable capability, or an observed unauthorized exercise defeats independence; the first two do so without any observed change. Insufficient evidence leaves the claim not established. Absence of a failure witness is not affirmative evidence. Independence is not sufficient for security: a mechanism may be beyond the governed system's reach while the policy is wrong, the inputs inadmissible, or the covered scope incomplete. It replaces none of the other integrity requirements.

Counter-positions

“The gateway sees every call, so nothing gets past it.” Seeing every call does not, by itself, establish mandatory mediation. Even if every covered action traverses the gateway, that establishes a fact about execution paths, not who can change the rules the gateway applies, suspend it, or redirect release to another verdict source. In the configuration above, the agent that writes the policy store gets nothing past the gateway. It changes what the gateway lets through. Enforcement independence fails while mediation remains intact.

“The agent is authorized to update its own policy, so the change is not unauthorized.” Under that authority model the change is authorized, and that is the defect. The protected set exists because an authority model can place the policy that governs the agent inside the agent's own authority; a test based solely on whether changes were authorized would then report independence while the mechanism is under the governed system's control. An authority model that assigns the governed system a protected element, directly or by delegation, fails the definition on its face. The authority model is part of the claim, and a claim that does not disclose it is not established.