This regulatory application note operationalizes the impossibility result established in On the Impossibility of Observability-Based Authorization (Meyman, 2026; Technical Note v1.4.0; DOI 10.5281/zenodo.19647542) for requirements that call for authorization before execution. It introduces the Authorization Artifact Test, a two-prong, regime-neutral instrument for determining whether a candidate governance architecture can, in principle, satisfy a pre-execution authorization requirement. The test asks whether a verdict exists before execution and whether an independent third party can reconstruct that verdict from the authorization artifact, governing policy, context, and proposed action specification, without access to the governed system. If either condition fails, the architecture cannot satisfy such a requirement, regardless of latency, automation, sophistication, or vendor description. Passing both prongs establishes a threshold, not complete conformance: non-bypassability, fail-closed enforcement, ownership of authority, governed escalation, and input provenance are assessed separately, including under the Five Tests Standard (5TS). The note applies the test, in conditional form, to contexts arising under the EU AI Act (Article 14), the General Data Protection Regulation (Article 22), the HIPAA Security Rule technical safeguards (45 C.F.R. § 164.312), DFARS 252.204-7012, and the NIST AI Risk Management Framework's GOVERN function. It does not interpret those instruments and does not assert that any of them expressly requires the artifact defined here. Whether pre-execution authorization is required is determined by the applicable authority or organization; the test determines whether the architecture can produce the corresponding authorization artifact. Where such a requirement has been established, the note derives the consequences of the impossibility result for architectures commonly described as guardrails, monitoring systems, observability platforms, and human review of system outputs. The dividing line is structural: a model-generated candidate held pending at a non-bypassable runtime authorization boundary may be the subject of a conforming pre-execution verdict; a verdict rendered only after release, or dependent on unreconstructable observation of the governed system, is not authorization. The contribution is classificatory rather than prescriptive. The note is an architectural analysis, not legal advice, a legal opinion, or a compliance determination, and it does not introduce new doctrine or prescribe implementation. It supplies an operational instrument for applying the formal result in regulatory hearings, conformity assessments, audits, supervisory reviews, and standards-body work, distinguishing architectures that produce pre-execution, independently reconstructable verdicts from those that do not. Version 1.1 clarifies the analytical status of the regulatory mappings, distinguishes proposed-action generation from effect-bearing execution, and situates the Authorization Artifact Test as a necessary threshold rather than a complete compliance determination. Intended audience: regulators, regulatory counsel, standards-body participants, and conformity-assessment bodies. This note is part of the FERZ research program on deterministic AI governance. The full corpus is available at https://zenodo.org/communities/ferz/.
Execution-Time Authorization for AI Agents formalizes execution-time authorization (ETA) as a deterministic governance boundary for AI agents and other autonomous systems whose proposed actions may produce real-world effects. The paper defines ETA as a pre-execution enforcement layer that evaluates canonicalized action instances against versioned policy and governed system state before execution, producing a replayable authorization verdict and a tamper-evident, independently reconstructable authorization artifact. The paper distinguishes ETA from adjacent categories often mistaken for governance enforcement, including guardrails, alignment techniques, identity and access management, observability tooling, agent orchestration, and policy engines. It argues that these systems may provide useful safety, visibility, policy-evaluation, or coordination functions, but do not by themselves constitute execution-time authorization unless they operate at a non-bypassable runtime boundary, fail closed absent an affirmative ALLOW verdict, and produce an authorization artifact sufficient for independent verdict reconstruction. Version 2.1 expands the February 2026 release by adding a structured relationship to access-control and policy-engine prior art, including the reference-monitor tradition, complete mediation and fail-safe defaults, XACML PDP/PEP architecture, OPA/Rego, Cedar, Zanzibar, and proof-carrying code. The paper narrows the novelty claim accordingly: ETA does not claim to invent access mediation, policy decision points, or proof-carrying evidence. It defines a specific architectural composition: a runtime authorization boundary that holds a concrete action instance before execution, binds the verdict to policy, state, and canonical action representation, fails closed under missing authorization, and emits an authorization artifact suitable for replay. This version also introduces a state-freshness and release-binding invariant. A conforming ETA implementation must address time-of-check-to-time-of-use risk by ensuring that the governed state has not changed in a governance-relevant way between authorization and release, and by verifying that the action released for execution is byte-equivalent, hash-equivalent, or otherwise canonically equivalent to the action authorized. A matching conformance test is added. The formal model specifies the authorization function, verdict semantics, determinism requirement, canonicalization requirement, fail-closed behavior, non-bypassability, authorization artifact completeness, replayability, time-bounded evaluation without fail-open behavior, and state-freshness / release-binding requirements. The verdict space is ALLOW, DENY, and ABSTAIN; ABSTAIN blocks execution pending authorized human override. The paper aligns the ETA framework with the Five Tests Standard (5TS): Stop, Ownership, Replay, Escalation, and Provenance. It treats Proof-Carrying Decisions (PCDs) as an implementation form of the authorization artifact, not as a replacement for the canonical authorization-artifact vocabulary. Version 2.1 corrects citation alignment, clarifies canonicalization equivalence, tightens the 5TS and prior-art treatment, and preserves the core analytical position of the original February 2026 release while extending the formal framework to address state freshness and release binding.
The rapid proliferation of “AI governance” solutions has created a structural conflation between compliance instrumentation and runtime governance. Many contemporary systems embed explainability artifacts, monitoring dashboards, drift detection, and cryptographic signing into development pipelines, improving audit readiness and regulatory traceability. However, these systems frequently do not enforce policy at the point of execution. This paper introduces a formal doctrinal framework that distinguishes: • Evidence-routing compliance systems (observability architectures that document and monitor AI behavior), and• Authorization governance substrates (runtime enforcement architectures that prevent unauthorized actions before execution). The paper formalizes the distinction along five doctrinal axes (enforcement locus, signature semantics, failure behavior, bypass resistance, and override governance) and introduces a six-criterion Enforcement Test Protocol that yields a binary classification: authorization governance present or absent. Fail-closed semantics are explicit: DENY blocks a requested action as impermissible, and ABSTAIN blocks execution pending authorized human override when evidence is missing, evaluation fails, or policy application is ambiguous. Through a running example in automated loan decisioning and analysis under the EU AI Act, GDPR Article 22, and the evolving U.S. federal AI policy landscape, the paper demonstrates that documentation volume does not equal enforceability. Systems that log, sign, and monitor may still fail open when governance conditions fail. The central thesis is architectural and testable: Governance without enforceability is advisory. The paper concludes with an integration doctrine: observability and authorization are complementary layers. Audit instrumentation improves traceability; authorization substrates prevent harm. Neither substitutes for the other. This working paper contributes a publicly usable evaluation protocol intended for enterprise buyers, regulators, auditors, and researchers seeking clear criteria for distinguishing monitoring-based governance claims from enforcement architectures. Version 1.1.0 (July 2026): updates U.S. federal policy references following the rescission of Executive Order 14110; migrates the standard citation to the Five Tests Standard (5TS) v1.2.0; clarifies fail-closed verdict semantics, with missing evidence and evaluation failure resolving to ABSTAIN; adds Enforcement Test Protocol scope notes on implementation tier and input integrity. The framework, taxonomy, and test criteria are unchanged from v1.0.
This paper defines the authorization boundary for agentic AI systems operating in regulated environments. As AI agents transition from generating text to producing side effects (writing to databases, submitting regulatory filings, executing transactions), the governance question shifts from "did the agent connect correctly?" to "was the agent's output authorized under governing policy, and can we prove it?" The paper introduces a distinction between access authorization (identity and scope verification, addressed by OAuth 2.1 and MCP authentication) and action authorization (evidence that a specific output complies with the specific policy version governing it at the time of the event). It argues that the emerging MCP gateway ecosystem, while solving necessary problems of interoperability, traffic management, and operational control, does not produce the independently verifiable authorization artifacts that regulated industries require. The paper presents minimum requirements for evidence-grade governance: deterministic evaluation under a defined governed state, version-binding with temporal validity, pre-execution evidence generation gated by release-credential issuance, and state freshness with release binding (the governed state must remain valid at release, and the action released must be canonically equivalent to the action authorized). It presents a minimum anti-laundering screen for distinguishing genuine deterministic governance from trust-based imitation, drawn from the Expanded Anti-Laundering Protocol (EALP), and references the Five Tests Standard (5TS), a published, vendor-neutral conformance specification for verifiable AI systems that supersedes the earlier Four Tests Standard (4TS). Its five normative tests are Stop, Ownership, Replay, Escalation, and Provenance. Version 2.0 (July 2026) aligns the paper with 5TS and the authorization-artifact vocabulary of the FERZ corpus, adds state freshness and release binding, clarifies the compatibility conditions for asynchronous artifact generation, and adds a companion-paper reference to Execution-Time Authorization for AI Agents (v2.1), which develops the formal architecture of the boundary. It supersedes Version 1.7 (February 2026). Intended audience: infrastructure architects, compliance officers, and policy makers evaluating governance requirements for enterprise agentic AI deployments. Keywords: AI governance, agentic AI, Model Context Protocol, MCP, authorization, authorization artifacts, proof-carrying decisions, deterministic governance, regulatory compliance, Five Tests Standard, AI safety
BACKGROUND: A special place among dermatological diseases is occupied by dermatoses affecting the oral mucosa, in particular pemphigus vulgaris. Constant damage to the mucous membrane, combined with the presence of abundant microflora in the oral cavity, leads to rapid variability in the primary or pathognomonic manifestations of specific diseases, making them look similar. Erosion and ulcers in the oral cavity are very difficult to treat and are accompanied by severe pain. The role of the oral microflora in the development and progression of pemphigus vulgaris has not been fully studied, however, it is known that the microflora of patients differs significantly from that of healthy individuals. Today, much attention is paid to studying the composition, properties and role of the microflora of the oral mucosa in the manifestation and course of pemphigus vulgaris. AIM: determination of the most effective combination of a three-component film biocoating based on sodium carboxymethylcellulose for patients with pemphigus vulgaris, by assessing and comparatively in vitro comparison of quantitative and qualitative characteristics of the oral microflora, as well as local oral protective factors (lysozyme titer, phagocytosis index neutrophils and the level of the secretory fraction of immunoglobulin class A) MATERIALS AND METHODS: A cross-sectional single-center study was performed among patients with pemphigus vulgaris (n=12). Oral fluid was collected by washing (rinsing) 4.5 ml of physiological solution from the oral mucosa. Subsequently, in the laboratory, a series of serial dilutions were prepared, some of which were inoculated by quantitative sectoral sowing on media intended for the cultivation of aerobic and anaerobic microbes. Microbiological and immunological sensitivity to films with different concentrations of mometasone furoate (20–40–80 mg) and propolis (2.5–5–7.5–10%) was determined. RESULTS: The most pronounced antibacterial activity was observed in the following 2-component forms (gel film and propolis at a concentration of 7.5%; gel film and mometasone furoate in an amount of 20 mg) and in 3-component gel films (gel film, propolis at a concentration of 5% and mometasone furoate 20 mg). According to the results of a comparative quantitative assessment of local factors protecting the oral cavity in patients with pemphigus vulgaris, their positive dynamics, characterized by the restoration of immunodeficiency, were most influenced by the three-component composition, including a gel film, propolis 5% and mometasone furoate 80 mg. CONCLUSION: The three-component composition of the film biocoating based on carboxymethylcellulose significantly reduces the quantitative and improves the qualitative indicators of microorganisms in the oral cavity, thereby having a positive effect on the treatment process for patients with pemphigus vulgaris.
