FERZ research argues that AI governance is an enforcement problem, not a monitoring problem. The corpus develops this thesis across four areas: the impossibility of observability-based authorization, the authorization framework that follows from that result, the architectural substrates that make authorization work in practice, and the broader taxonomy of governance approaches and their failure modes. All papers are open-access through the Zenodo FERZ community.
Begin with the unified monograph and synthesis paper. The sections below develop specific claims and provide standards and supporting materials.
A Unified Derivation of the Runtime Authorization Boundary, Authorization Artifact, Integrity Model, and Five Tests Standard
The unified monograph. Consolidates the corpus into one account of deterministic AI governance: the enforcement thesis, the runtime authorization boundary, the three-verdict space, the authorization artifact, and the Five Tests Standard, with a glossary of the corpus vocabulary.
Argues that governable AI requires separating proposal generation from authorization as distinct control functions, and that the properties authorization needs belong to the authorizing arrangement rather than to any technology label. Distinguishes authorization artifact validity from permission and states requirements for independent reconstruction under a declared replay mode.
The theoretical foundation. Under the stated assumptions of the impossibility result, observability alone cannot produce an artifact that satisfies ex-ante authorization; the works here state that result, its operational test, and its general form.
A Formal Impossibility Result for Ex-Ante AI Governance
Establishes a formal impossibility result: under its stated assumptions, observability alone cannot produce an artifact that satisfies the ex-ante authorization requirement imposed by a regulatory regime. The theoretical foundation of the FERZ corpus.
A Doctrinal Framework for Distinguishing Compliance Instrumentation from Runtime Authorization in AI Governance Architectures
Names the structural conflation of compliance instrumentation with runtime authorization, and draws the doctrinal line between supervision-class and authorization-class systems.
Applying the Impossibility Result to Ex-Ante Authorization Requirements
States the two-prong Authorization Artifact Test: before execution, whether a verdict exists; and whether that verdict can be reconstructed by an independent third party without access to the governed system. Operationalizes the impossibility result for ex-ante regulatory regimes.
A General Result for Pre-Execution AI Governance
States a general non-substitution result for pre-execution AI governance and supplies a three-question screen for classifying mechanisms offered as substitutes for authorization.
The architectural framework. What authorization is, where it sits in the execution path, and what its required properties are.
A Formal Framework for Deterministic Governance Boundaries
Defines execution-time authorization as a deterministic enforcement layer that evaluates canonicalized action instances against versioned policy and governed system state prior to execution, producing a replayable authorization verdict.
The Structural Shift in Agentic AI Governance
Names the structural shift in AI governance as systems move from content generation to autonomous execution. The governance problem changes from observing behavior to authorizing action.
Defines the threshold at which AI action requires authorization rather than supervision. Governance is a property of specific decisions made under specific constraints, and only derivatively a property of systems in general.
The Missing Link Between Governing Judgment and Runtime Authorization
Defines authorization discipline as the institutional practice of converting governing judgment into approved, versioned, authority-traced inputs consumed by a runtime authorization boundary. Locates the upstream obligation on which runtime authorization depends.
Examines ABSTAIN with governed escalation and authorized human resolution. Human resolution supplies authority-bound input for evaluation; authority to emit the operative verdict remains with the runtime authorization boundary.
What MCP and AI Gateways Do Not Establish for Regulated Agentic AI
Defines the authorization boundary for agentic AI systems in regulated environments and examines what MCP and AI gateways do not establish. They are execution-path components; they do not, on their own, satisfy the authorization requirement.
Defines three orthogonal integrity properties of an authorization boundary: output integrity, input integrity, and replay integrity, with input binding as the substrate beneath them. Orthogonality is load-bearing: holding one property implies nothing about the others.
Defines when authorization qualifies as infrastructure: a scoped threshold claim, not a maturity ladder. Specifies reconstruction under both 5TS replay modes, the material-consumption requirement of the Composition Test, and fail-closed behavior across a declared execution-path scope with mandatory scope disclosure.
A Definitional Framework for AI Governance
A definitional framework separating Authority, Delegation, Policy, Authorization, and Enforcement. Authority determines who may authorize; authorization determines whether a specific proposed action is permitted; enforcement determines whether that authorization governs execution.
A Definitional Distinction for AI Governance
Distinguishes standing eligibility, the entitlement to act in general, from runtime authorization of a specific proposed action, and argues that the former cannot substitute for the latter at execution time.
One Authorization Boundary, Many Jurisdictional Presentations
Derives jurisdiction-specific evidentiary presentations from a single authorization artifact, subject to the limits of the source decision: a projection must remain traceable to the artifact and its bound materials, versioned, reconstructable, and scoped to the regime and evidence question it addresses, and derivation alone confers none of the source artifact's integrity properties.
Examines what changes when decisions distributed among licensed, accountable professionals are routed through AI systems that hold no license and owe no independent duty, and states three conditions for a defensible delegation.
Why an AI detector score is evidence about production, not a record of the production process
Distinguishes a detector's classification of a finished artifact from a record of how it was produced. Detection is posterior evidence about production; provenance is a record of the production process, and the one cannot stand in for the other.
Archival edition of the canonical web essay published at ferz.ai/articles/the-governing-question, cited by the monograph as a corpus source.
Research into the substrates authorization depends on: verification methods, audit-stable meaning, and cross-organizational alignment.
Verifiable Coordination Across Private AI Governance Domains
A problem formalization for cross-organizational AI governance: how autonomous agents operating under distinct, private policy regimes can verify mutual governance compatibility without disclosing the underlying policies. The CAGA evidence artifact is not an authorization artifact; it enters authorization only through each domain's local runtime authorization boundary.
The role of dependent types, refinement types, and proof-carrying code in the governance of AI systems deployed in regulated industries. Type-theoretic methods are verification substrates within authorization frameworks, not authorization frameworks in themselves.
A formal framework for audit-stable meaning in regulated AI and decision systems. Many compliance failures stem from semantic instability rather than incorrect execution: when ontologies and definitions shift, prior compliance dissolves.
The broader category. How to distinguish what is and is not governance, where governance is multi-dimensional, and how to identify the failure modes that compliance architectures exhibit.
Distinguishing Visibility, Alignment, and Authorization
Distinguishes three different problems collected under the label AI governance: operational visibility, behavioral alignment, and decision authorization. FERZ research addresses decision authorization.
Clarifies the conflation of deterministic computation with authorized decision-making. Physics-based simulators and constrained optimizers are deterministic, but determinism is not authorization.
A vendor-neutral framework for evaluating AI governance architectures in regulated environments. Execution-time authorization is necessary but not sufficient; deterministic governance has additional dimensions.
Names governance laundering as the umbrella practice and organizes the failure modes of AI compliance architectures into a taxonomy of families, beginning with policy theater.
Examines the claim that stacking guardrails, filters, and monitors amounts to authorization. Adding checks does not, by itself, establish a runtime authorization boundary: aggregated non-objection, a PASS from each participating layer, does not change PASS into ALLOW.
Boundary Completeness in Pre-Execution Authorization
Distinguishes an interception hook from the authorization boundary. A hook governs only the paths that pass through it; boundary completeness requires that every execution path to a governed effect is subject to pre-execution authorization.
Why Risk Tolerance Cannot Substitute for Pre-Execution Authorization
Names governance by post-mortem: the pattern in which an organization relies on post-execution observation as the operative control for a requirement that depends on pre-execution authorization. States the control-sufficiency precondition that risk-appetite language cannot displace.
Draws the category line between deterrence and authorization using a controlled study of governed LLM agents. A sanction prices a violation after the fact; authorization forecloses it before release of the proposed act.
Locating the Inline-Judge Pattern under the Authorization Boundary Integrity Model and the Five Tests Standard
Examines the use of a language model as an evaluator of proposed AI actions. A judge model produces an assessment; it does not constitute a runtime authorization boundary, and its output does not satisfy the authorization artifact requirement.
Examines peer review offered in place of pre-execution authorization, as one of the corpus's non-substitution results. Review produces an assessment of the work; it does not produce a pre-execution verdict at a runtime authorization boundary.
The Five Tests Standard, its explanatory paper and conformance materials, and the authorization artifact advisory.
The explanatory paper for the Five Tests Standard. Establishes the formal specification, theoretical foundations, and conformance framing for the five normative tests and the proof-carrying decision object.
The published standard and conformance repository, archived release. Specifies the five normative tests, Stop, Ownership, Replay, Escalation, and Provenance, and the proof-carrying decision object. Repository: github.com/edmeyman/4ts-standard.
Names the authorization artifact gap: the condition in which observability is relied upon to satisfy a requirement for pre-execution authorization. Surveys governance, regulatory, and audit frameworks for the gap and refers the closing threshold to the Authorization Artifact Test.
Evidence for Output, Input, and Replay Integrity Conclusions. A Supplement to The Enterprise AI Governance Buyer's Guide
The evidence procedure for ABIM property conclusions: scope declarations, thresholds, failure witnesses, and not-established states for Output, Input, and Replay Integrity.