GOVERNANCE

# ARCANA Governance — Overview

> The model proposes. The engine decides. The proof records.

Arcana is a governed autonomy runtime: an execution-security kernel that sits
between an AI agent and the outside world. The agent (any model) proposes
actions; a deterministic policy engine decides whether each action may run;
and every decision and outcome is recorded into cryptographically verifiable
evidence.

**Core invariant:** ¬Authorized(q) ⇒ ¬Executed(q)

Read it aloud: if a request q was not authorized, then q did not execute.
Not "usually", not "unless the model insists" — as a hard property of the
system, enforced at the effect boundary and proven by evidence.

## Why this exists

Autonomous agents fail in predictable ways: they run destructive commands on
partial information, they exfiltrate secrets through tool arguments, they
self-approve because a prompt told them to, and they cannot later explain
what they did or why. Arcana addresses all four failure classes structurally
rather than by prompt hygiene:

1. **Every consequential action becomes one canonical, hashable request.**
   Nothing executes "in passing"; there is always an object you can inspect.
2. **Authorization is deterministic.** The same request against the same
   policy snapshot always yields the same verdict — no model mood, no hidden
   state.
3. **Authority is never ambient.** The agent holds only capabilities that were
   explicitly granted, and delegation can only narrow them.
4. **Everything leaves evidence.** A RunProof can be exported and verified
   offline by anyone, including a hostile auditor.

## The eleven layers

| # | Domain | One-line summary | Reference |
|---|--------|------------------|-----------|
| 01 | [The Authorization Request](/governance/request.md) | Every consequential action becomes one hashable object | /governance/request.md |
| 02 | [PDP ⇄ PEP Split](/governance/pdp-pep.md) | Deciding and enforcing are never the same component | /governance/pdp-pep.md |
| 03 | [Risk Classes](/governance/risk.md) | Four levels, four intent requirements | /governance/risk.md |
| 04 | [Intent–Action Binding](/governance/intent.md) | Why is this request authorized? | /governance/intent.md |
| 05 | [Exact Durable Capabilities](/governance/capabilities.md) | The fundamental authority primitive | /governance/capabilities.md |
| 06 | [Delegation & Attenuation](/governance/delegation.md) | Authority can only get narrower | /governance/delegation.md |
| 07 | [Provenance & Sensitivity](/governance/provenance.md) | Where data came from — and how secret it is | /governance/provenance.md |
| 08 | [Scoped Approvals & Routing](/governance/approvals.md) | Exact, single-use, expiring, crash-recoverable | /governance/approvals.md |
| 09 | [Signed Envelopes](/governance/envelopes.md) | Ed25519 signatures over canonical serialization | /governance/envelopes.md |
| 10 | [RunProof](/governance/runproof.md) | Hash-linked events, verifiable offline | /governance/runproof.md |
| 11 | [Assurance & Boundaries](/governance/assurance.md) | What "proven" means, exactly | /governance/assurance.md |

Recommended reading order for agents: 01 → 02 → 03 → 04 → 05 → 06 → 07 → 08 →
09 → 10 → 11. Each layer builds on the vocabulary of the previous one.

## Scale of the guarantees

- 7 verification layers on every signed envelope
- 4 risk classes with distinct intent requirements
- 10 provenance labels across all data surfaces
- 4 sensitivity levels with strict ordering
- 4 approval states in a single-use lifecycle
- 3 replay modes over recorded evidence
- 0 ambient authority anywhere in the system

## Conformance evidence

These are not aspirations; they are machine-checked:

- **46 golden conformance vectors** (41 negative, 5 positive), verified by two
  independent implementations — TypeScript production and a Rust verifier that
  does not share code with it.
- **100/100** TypeScript golden crypto suite.
- **15 hostile-node fixtures, 0 bypasses** in the Phase D fail-closed matrix,
  plus a 9-fixture revocation hostile suite, also 0 bypasses.
- **4/4 certified adapter request-hash vectors** for AI SDK, MCP, Mastra, and
  LangGraph tool naming.
- Cross-language request-hash vector: the same AuthorizationRequest fixture
  hashes identically in TypeScript and Rust.

## Glossary (short form)

- **Agentic Zero Trust** — no agent, model, subagent, plugin, or content source receives implicit authority from identity or location.
- **Capability** — durable, exact, revocable authority to perform bounded actions on bounded resources.
- **PDP** — Policy Decision Point; pure deterministic policy evaluation.
- **PEP** — Policy Enforcement Point; fresh revalidation and effect-boundary enforcement.
- **Intent binding** — evidence that an exact request is required by the current user objective.
- **Provenance** — origin labels attached to data and authorization fields.
- **Sensitivity** — PUBLIC/INTERNAL/PRIVATE/SECRET classification.
- **Field lineage** — source-event and transformation history for consequential request fields.
- **Scoped approval** — exact, expiring, single-use user authorization for one request hash.
- **Attenuation** — the rule that delegated authority can only become narrower.
- **RunProof** — portable execution evidence with integrity, verification, reproducibility, and security profiles.
- **Trace health** — COMPLETE/DEGRADED/UNAVAILABLE evidence quality state.