This glossary collects the canonical terminology used across the FERZ corpus, doctrine, and architectural comparisons. Each term is defined as it is used in FERZ publications. The glossary is organized in six sections: verdicts and authorization decisions, architectural commitments, frameworks and corpus concepts, determinism pathways, contrasted categories that share surface features with FERZ but operate in different architectural classes, and general technical terms as FERZ applies them.
Definitions are derived from the FERZ corpus and from the canonical wording locked across the doctrine and comparison pages. Where a term originates in a specific paper, the paper is cited in the entry's see-also line and listed in the references below. The two corpus papers underlying the bulk of the framework are The Authorization Artifact Test (Meyman, 2026; DOI 10.5281/zenodo.20013582) and A Taxonomy of AI Governance Approaches (Meyman, 2026; DOI 10.5281/zenodo.18275969). FERZ itself is a runtime AI-action authorization architecture with built-in action canonicalization, governed state, ABSTAIN-with-override semantics, and a tamper-evident authorization artifact.
Verdicts and authorization decisions
The objects produced by FERZ at the AI action proposal boundary: the canonical three-verdict space, the artifacts that carry each verdict, and the explicit override path for fail-closed cases.
ABSTAIN verdictABSTAIN
The third verdict in the FERZ canonical verdict space, emitted when encoded policy cannot resolve a proposed action to either ALLOW or DENY. Carries explicit fail-closed semantics: execution is blocked pending authorized human override. The verdict is part of the authorization artifact and is reconstructable from policy, action specification, and governed state.
The verdict in the FERZ canonical verdict space that permits a proposed action to execute. Issued when encoded policy resolves the action as authorized against the current governed state and policy version. Accompanied by an authorization artifact reconstructable by third parties.
The record that represents a verdict emitted by a runtime authorization boundary before execution. The artifact binds six elements to the single proposed action: the action itself, the inputs materially relied upon, the applicable policy and its version state, the authority chain, the authorization time, and the verdict. It is tamper-evident, so that post-issuance alteration of any bound element is detectable, and it permits independent reconstruction of the verdict. Release depends on the verdict, not on the existence of the record. Published evidence specifications add the materials reconstruction needs in practice, such as the evaluator version and the canonicalization specification, carried in the artifact or referenced through authenticated bindings. On first reference in formal contexts the full name is "tamper-evident authorization artifact"; subsequent references use the short form.
An explicit, identified, role-scoped action that overrides a FERZ ABSTAIN verdict. The override produces its own authorization artifact attached to the ABSTAIN verdict it overrides; the artifact records who issued the override, on what authority, with what justification. Distinguished from human approval by Override Asymmetry: the override is itself authorized; an approval is the authorization.
The verdict in the FERZ canonical verdict space that blocks a proposed action from executing. Issued when encoded policy resolves the action as not authorized against the current governed state and policy version. Accompanied by an authorization artifact reconstructable by third parties.
A Proof-Carrying Decision (PCD) is the vendor-neutral evidence object used by 5TS to carry the information needed to reconstruct a governance decision: policy version, canonicalized action specification, governed state, evaluator version, and resulting verdict. FERZ authorization artifacts implement this evidence-object pattern. The Authorization Artifact Test requires an ex-ante authorization artifact; 5TS expresses that evidence object as a PCD.
The FERZ canonical verdict space consists of exactly three verdicts: ALLOW, DENY, and ABSTAIN. There is no separate ESCALATE verdict; ABSTAIN with authorized human override is the canonical mechanism for governance cases that cannot be resolved by policy alone.
The structural properties that define FERZ as an architectural class. These are commitments, not configurations: they cannot be disabled by setting.
Action canonicalization
The transformation of a proposed AI action into a canonical specification that allows policy evaluation to be deterministic and reproducible. Without canonicalization, the same semantic action expressed in different forms could yield different verdicts; canonicalization is a structural requirement of policy-based AI-action authorization and is part of the FERZ authorization-layer vocabulary.
The class of decisions about whether a proposed AI action is permitted by encoded policy, evaluated against canonicalized action specification and governed state, before the action executes. The architectural class that FERZ exemplifies. Distinct from monitoring, observability, identity authorization, attack detection, content filtering, and human review.
The output of action canonicalization: a stable, structured representation of a proposed AI action that uniquely identifies the operation, its parameters, and its context. Used by FERZ as one of the inputs to policy evaluation and carried as part of the resulting authorization artifact.
Before the fact; before execution. FERZ produces authorization artifacts ex-ante: the verdict precedes the action. Contrasted with post-hoc systems (such as SIEM and AI Observability) that operate after execution. The ex-ante property is what distinguishes authorization-class systems from observation-class systems.
The architectural commitment that authorization decisions are evaluated and enforced before the proposed AI action executes, not after. The authorization verdict precedes execution; if the verdict is DENY or ABSTAIN, the action does not execute. The opposite of post-hoc compliance reporting.
The architectural commitment that, when governance conditions are not met or cannot be resolved, execution is blocked by default. FERZ is fail-closed by architectural design rather than by configuration: there is no opt-in setting for fail-open behavior. Contrasted with monitor-only or alert-only systems where the default response to ambiguity is to allow execution.
The structured representation of the system state that policy evaluation can reference. FERZ policy evaluation takes the proposed action specification and the governed state as inputs; the governed state determines which conditions apply to the action being evaluated. The state is versioned alongside policy and carried in the authorization artifact.
The identifier of the policy snapshot active at the time of authorization. Authorization artifacts carry the policy version as part of their reconstructable evidence; this allows verdicts to be reproduced and audited against the exact policy that was in force, not against later revisions.
The architectural surface at which authorization decisions are evaluated and enforced. In FERZ, this surface is the AI action proposal boundary: the point at which a proposed AI action would otherwise cross from intent to execution. The boundary is non-bypassable by architectural commitment.
The analytical frameworks and formal results developed in the FERZ corpus, used to evaluate architectures and to position the work relative to adjacent categories.
Architectural class
The category of system determined by what kind of decision the system makes, what artifact it produces, and what failure mode it exhibits. Architectural class is structurally determined; it is not changed by adding features. The architectural-class test, formalized in The Authorization Artifact Test, is the basis for the FERZ comparison set.
The property that every governed decision remains evaluable, for as long as it must be retained, under the exact semantics that governed it at the moment it was made. Established in Versioned Meaning: How to Make Ontologies Audit-Stable (Meyman, 2026; DOI 10.5281/zenodo.18328587; v1.6 DOI 10.5281/zenodo.21209853). It holds only when four invariants are satisfied: decision-bound semantics, non-retroactivity, reproducibility, and drift visibility. By binding each decision to an immutable semantic snapshot, it prevents a later change to a definition from silently restating a decision already made, the failure mode known as definition laundering. Audit-stable meaning is the semantic substrate beneath authorization, not the enforcement layer itself.
A two-prong, regime-neutral test for ex-ante AI-action authorization, derived from the impossibility result (Meyman, 2026; DOI 10.5281/zenodo.20013582). Prong One (Pre-Execution Emission): does the architecture emit an authorization artifact before the action executes? Prong Two (Independent Verifiability): can the artifact be reconstructed and verified without access to the executing system? An architecture is an ex-ante authorization architecture only if both prongs are satisfied.
A vendor-neutral published standard defining five necessary conditions for governed AI: Stop (halt before side effects), Ownership (named accountable authority), Replay (deterministic reconstruction), Escalation (transfer of control at policy boundaries), and Provenance (established input origin). In v1.2.0, Provenance is normative, while Provenance conformance and full five-test conformance are not yet assertable. The current v1.0.2 conformance bundle verifies Stop, Ownership, Replay, and Escalation. The standard is available at github.com/edmeyman/4ts-standard. The specification is licensed under CC BY-NC-ND 4.0, and the conformance bundle is licensed under MIT.
The condition in which an AI pipeline makes release decisions, deciding what evidence is sufficient, what to surface, and what to withhold, without an explicit authorization boundary that owns those decisions. Because the decisions are made through retrieval heuristics, validators, and confidence thresholds, they are observation-class and bypassable: the system is default-release with retrospective checks. Implicit authorization has the surface of a release boundary without its architectural commitments; it is authorization in form, not in substance.
The formal result, established in On the Impossibility of Observability-Based Authorization (Meyman, 2026; DOI 10.5281/zenodo.19647542), that authorization cannot be derived from observability alone. Observation-class systems cannot produce authorization-class artifacts; the architectural-class boundary is not crossed by adding observability features.
The structural asymmetry between authorized override (FERZ) and human approval (human-in-the-loop workflows), established in Override Asymmetry (Meyman, 2026; DOI 10.5281/zenodo.19772248). The override is itself authorized and carries its own authorization artifact; the approval is the authorization. The asymmetry is the architectural-class boundary between ABSTAIN-with-override and HITL.
The requirement that the inputs grounding a verdict have an established origin. Provenance is origin, not truth: it does not establish that input content is true, complete, current, or substantively sufficient under a domain policy. In 5TS v1.2.0, Provenance is normative, but mechanical conformance is deferred until input-origin binding and validation vectors are defined.
The framework distinguishing the three categorically distinct AI governance problems: Visibility (what the AI did), Alignment (what the AI should do), and Authorization (whether a proposed action is permitted). Established in A Taxonomy of AI Governance Approaches (Meyman, 2026; DOI 10.5281/zenodo.18275969). FERZ addresses Authorization; adjacent categories typically address Visibility or Alignment.
The five architectural mechanisms associated with deterministic assurance across FERZ engines. Each pathway names a distinct assurance mechanism associated with one engine in the FERZ stack. The five pathways together support the architectural-class taxonomy that distinguishes FERZ from observability and probabilistic governance.
Semantic Determinism
The assurance mechanism associated with LASO(f): meaning and coherence. The architecture specifies that semantic interpretation is constrained through a multi-tier coherence framework with bidirectional propagation, so that for the same input under the same codified rules, the same governance decision is produced. A governance decision in one dimension cannot quietly contradict a decision in another.
The assurance mechanism associated with DELIA: bounded executable constraints. The architecture specifies a flat constraint set with no hierarchical propagation between rules and priority-based deterministic resolution where constraints overlap, so that every governed output is evaluated against the active constraint set before it leaves the system.
The assurance mechanism associated with the FERZ Behavioral Engine: deterministic bounded adaptation. The architecture specifies that behavioral adaptation responds to operational context within mathematically bounded constraints, so that adaptation remains inside the codified governance envelope rather than drifting outside it.
The assurance mechanism associated with CausaCore: deterministic causal modeling across complex multi-tier and cross-domain systems. The architecture specifies that under the same input data, the same engine selection, and the same parameters, the same causal structure is produced, and every causal claim is traceable to the evidence and reasoning that produced it.
The assurance mechanism associated with Constitutional Blockchain: distributed deterministic authority. The architecture specifies that deterministic oversight is achieved across distributed authorities through cryptographic consensus and constitutionally bounded intervention protocols, so that no single authority can override the governance constraint and every consensus decision is independently reconstructable.
Adjacent categories that share surface features with FERZ but operate in different architectural classes. Each has its own canonical comparison page; the entries here define the category on its own terms, with cross-links to the corresponding comparison.
Agent framework
An orchestration library that wires up AI agents: loads tools, manages prompts, executes tool calls, and coordinates multi-agent workflows. Common implementations include LangChain, AutoGen, and CrewAI. Agent frameworks compose with FERZ rather than substitute for it; the framework provides composition while FERZ provides authorization.
The descriptive instrumentation layer for AI systems: dashboards, traces, metrics, and alerts describing what AI systems did. Produces records of behavior after the fact. AI Observability is observation-class; FERZ is authorization-class. The architectural-class boundary cannot be crossed by adding observability features (impossibility result).
A class of supervisory mechanisms that intercept AI inputs or outputs to filter unsafe content, using pattern matching, classifiers, or content-evaluation models. Representative systems include Guardrails AI, NeMo Guardrails, and Llama Guard. Guardrails address content; FERZ addresses action.
A category of workflows in which a human reviewer makes or approves AI-action decisions. The human is the decider, invoked routinely at sampled, threshold-triggered, or every-action checkpoints. Distinguished from FERZ ABSTAIN-with-authorized-override by Override Asymmetry: FERZ delegates the decision to policy and invokes humans only at the ABSTAIN-override boundary.
The architectural category that authorizes identity-to-resource access: it answers whether a principal may access a resource. The decision basis is identity attributes, role and group membership, and access control rules. IAM gates who can interact with the AI system; FERZ gates what the AI may do.
A general-purpose policy decision point that evaluates caller-provided queries against caller-provided rules. Typical examples include OPA, Cedar, Drools, and IBM ODM. A policy engine can be a useful component within an AI-action governance architecture but does not by itself constitute one; the properties that distinguish AI-action authorization are architectural commitments, not policies that can be added.
A class of security tools that detects and blocks attacks at runtime by inspecting requests, function calls, and data flows against attack signatures or behavioral baselines. RASP asks whether an action is an attack; FERZ asks whether an action is authorized by policy. The architectural class remains security and attack-detection regardless of what is being protected.
A class of platforms that aggregate security events from enterprise systems, apply correlation rules, and generate alerts for human investigators. Common platforms include Splunk, Microsoft Sentinel, and IBM QRadar. SIEM is post-hoc; FERZ is ex-ante. The architectural class remains post-hoc event aggregation regardless of which events are being ingested.
Terms in general technical use that appear across FERZ materials, defined as FERZ applies them.
Artificial intelligenceAI
The general technical category for machine-based systems that generate outputs such as predictions, classifications, recommendations, content, decisions, or proposed actions by inference from the inputs they receive. FERZ uses the term as a class designation: membership is established from a system's properties, and the term makes no claim about the system's level of capability.
Also written "Super Intelligence"; abbreviated SI. A level of machine intelligence characterized by capabilities substantially exceeding human cognitive performance across a broad range of domains. The term appears in scientific, industry, and policy discussions, but lacks a generally accepted operational definition, standardized measurement criteria, and agreed thresholds for establishing that a system qualifies. Applied to a particular system, superintelligence is a capability claim. A nomenclature choice does not by itself establish a capability level. FERZ accepts the claim only where the term is defined against testable capability criteria and the system has been demonstrated to meet them through independently examinable evidence. FERZ retains "artificial intelligence" (AI) as the general technical category. "Artificial intelligence" identifies a class of systems; "superintelligence" asserts a level of capability.
Meyman, E. (2026). The Authorization Artifact Test: Applying the Impossibility Result to Ex-Ante Regulatory Regimes. Zenodo. https://doi.org/10.5281/zenodo.20013582
Meyman, E. (2026). A Taxonomy of AI Governance Approaches: Distinguishing Visibility, Alignment, and Authorization. Zenodo. https://doi.org/10.5281/zenodo.18275969
Meyman, E. (2026). On the Impossibility of Observability-Based Authorization: A Formal Impossibility Result for Ex-Ante AI Governance. Zenodo. https://doi.org/10.5281/zenodo.19647542
Meyman, E. (2026). Observability Is Not Enforcement: A Doctrinal Framework for Distinguishing Compliance Instrumentation from Runtime Authorization in AI Governance Architectures. Zenodo. https://doi.org/10.5281/zenodo.18663864
Meyman, E. (2026). Override Asymmetry: Structural Differences Between Authorized Override and Human Approval. Zenodo. https://doi.org/10.5281/zenodo.19772248
FERZ Governance Doctrine: the canonical positions on what is not authorization and what is not a runtime authorization boundary, which establish the foundational distinctions underlying the glossary terms.
Governance Concepts: reference pages for the architectural vocabulary, including extended treatments of terms defined here.
Authorization Artifact: the concept page for the class term, stating the six bound elements and the three integrity conditions.
Architectural Comparisons: eight comparison pages distinguishing FERZ from adjacent categories. Each contrasted category in this glossary has a corresponding comparison page.
Five Tests Standard repository: the published standard repository on GitHub. Vendor-neutral; specification CC BY-NC-ND 4.0, conformance bundle MIT.
Cite this page
FERZ, Inc. (2026). Glossary of FERZ Governance Terms. https://ferz.ai/governance/glossary
BibTeX
@misc{ferz2026glossary,
author = {{FERZ, Inc.}},
title = {Glossary of FERZ Governance Terms},
year = {2026},
url = {https://ferz.ai/governance/glossary},
note = {FERZ Canonical Reference}
}