AI EXECUTION. GOVERNED.

Governed execution for agentic systems.

We help technical teams deploy deterministic control infrastructure around autonomous AI workflows.

Discuss a deploymentRead the incident record
ENV: PUBLIC NODEBUILD: 9acb5062
ZTG architectural cross-section
A
A'
ENVELOPE: EnvelopeProbabilistic containment that becomes possible once you have a governed surface. Statistical operating bounds — holds under additive conditions. Insufficient alone against non-additive or emergent decisions; the invariant layer exists because the envelope cannot guarantee against catastrophic boundary violations.
SURFACE: Effect SurfaceGoverned effect surface. All agent-generated effects occur through registered, authorization-addressable interfaces. Because effects are bounded and auditable, insurability begins here.
INVARIANT: System InvariantFoundational mechanical constraints. Non-negotiable. Enforced deterministically, not discretionarily — no component may bypass, reinterpret, or negotiate a boundary at runtime.

Research

CURRENT RECORD · KB-CRYPTO-004

Agentic Security Incident Record

Twenty-nine incidents and vulnerability disclosures, kept with their inclusion rule, verification state, and limitations. Grouped into content and approval boundaries, evaluation containment, attacker-operated agents, infrastructure and supply chain, and training or evaluation disclosures.

Read the incident record
Included
29 incidents
Rule
Report date, June 26–October 2, 2026
Source state
Fetched and confirmed
Source state
Fetch blocked; corroborated
Limit
Web sweep, not an independent investigation

LIABILITY-GAP

The Liability Gap

American law can assign responsibility for agentic harm. The harder question is whether the institution can prove what it authorized, what occurred, and where control actually lay.

INSURABILITY

AI Insurability Framework

Executive framework examining minimum architectural conditions for AI insurability, grounded in ZTG.

SDS.WEB.ROLES //

One body of work. Three public roles.

Shadow Dynamic Systems publishes the research, maintains the open Zero Trust Governance specification, and builds Constable as a commercial reference implementation. ZTG does not require Constable.

Discuss a deployment
SDS / YOU ARE HERE

Shadow Dynamic Systems

Research, diagnosis, and deployment work. You are here.

ZTG / OPEN SPECIFICATION

Zero Trust Governance

The open specification that defines the requirements.

Read the specification ↗CONSTABLE / COMMERCIAL

Constable

The commercial control kernel and reference implementation.

Explore Constable ↗

SDSmaintainsZTG

SDSbuildsConstable

ZTGcan also be implemented byindependent systems

Zero Trust Governance

Execution Boundary Enforcement

All irreversible actions pass through a mechanistic governance gate prior to execution. Boundaries are code-enforced, not intent-interpreted. Post-execution detection does not constitute governance.

Deterministic Policy Evaluation

Authorization logic is rule-bound and reproducible. Given identical initial state and identical inputs, the governance system produces identical decisions. Governance evaluation nondeterminism is not permitted.

Authority Attribution

Execution rights resolve to identifiable, accountable actors. When governance state is uncertain, the system grants no new authority while remaining observable and recoverable — a state it holds in, not one it is destroyed by. Resuming grants requires explicit human authorization.

Focused mechanism

Execution gate

Resolve identity, policy, and scope at one deterministic boundary. Execution remains mechanically unavailable until all three checks agree.

Open in Figures →
FIG A · Deterministic execution gateAwaiting evaluation
Request
An execution request advances through identity, policy, and scope checks. A conforming request crosses the authority boundary; a scope mismatch stops before execution.ObservedEXECUTION REQUESTDeterministic checksIdentityPolicyScopeExecution boundaryAuthorizedEXECUTEObservationAuthorizationExecution

Ready: the request is observed, but no authority has resolved and execution remains closed.

GATE / CONFORMING / READY
Focused mechanism

Commit bind

Bind resolved authority to one exact operation. The commit proceeds only when its operation fingerprint matches the authorization envelope.

Open in Figures →
FIG B · Authorization-to-commit bindingReady to bind
Operation
An authorization envelope and an operation fingerprint align at a binding fixture. An exact match locks and proceeds; an altered commit remains outside execution.Authorization envelopeAUTH-0427OperationDEPLOY / PRODDigest7B31Bind fixtureCommit operationDIGEST 7B31Hash-chain inputBOUND COMMITAppend in FIG CResolved authorityExact bindEvidence input

Ready: authorization AUTH-0427 permits only the operation carrying digest 7B31.

BIND / EXACT / READY

Evidence-Coupled Execution

No externally observable effect may exist without simultaneous durable evidence of authorization and execution. The evidence record is not documentation of the effect — it is a constitutive part of it.

Governed Effect Surfaces

All agent-generated external effects occur exclusively through registered, governance-addressable surfaces. Each surface formally classifies actions by effect type, reversibility, and rollback cost prior to execution.

⛶

Graduated Containment

Component-level freeze mechanisms halt execution at targeted scope without requiring system-wide halt. Escalation is mechanistic: surface freeze, subsystem freeze, system-wide stasis. Containment is proportional to failure.

Complete system

Evidence chain

Follow the complete request from observation through authorization, execution bind, commit, and durable record. Each state change appends a SHA-256 identifier linked to the record before it.

Open in Figures →
FIG C · Evidence-state recorderObserved
Action ACT-001Stage 1 of 5
Five connected nodes represent observed, proposed, authorized, committed, and recorded states. An active marker advances between them as hash-linked records are written.ObservedProposedAuthorizedCommittedRecorded

Hash-linked evidence ledger

Verifying chain
  1. 01ACT-001 · Publish policy bundleOBSERVEDGENESISCalculating SHA-256…

Observed: an action enters the record before any authority decision is made.

CHAIN / SHA-256 / INITIALIZING
ARCHITECTURAL CROSS-SECTION
CROSS-SECTION

ZTG Architectural Layers

A
A'
ENVELOPE: EnvelopeProbabilistic containment that becomes possible once you have a governed surface. Statistical operating bounds — holds under additive conditions. Insufficient alone against non-additive or emergent decisions; the invariant layer exists because the envelope cannot guarantee against catastrophic boundary violations.
SURFACE: Effect SurfaceGoverned effect surface. All agent-generated effects occur through registered, authorization-addressable interfaces. Because effects are bounded and auditable, insurability begins here.
INVARIANT: System InvariantFoundational mechanical constraints. Non-negotiable. Enforced deterministically, not discretionarily — no component may bypass, reinterpret, or negotiate a boundary at runtime.
INVARIANTS
  1. ZTG-0aObservability
  2. ZTG-0bReplayability
  3. ZTG-0cTemporal Integrity
  4. ZTG-0dIdentity Integrity
  5. ZTG-0eGovernance Consistency
  6. ZTG-1Mechanistic Boundary
  7. ZTG-2Stasis
  8. ZTG-3Governed Effect Surface
  9. ZTG-4Evidence-Coupled Execution
  10. ZTG-5Irreversibility of Harm
Section A-A' · ZTG specification v0.7

Doctrine

▼SYSTEM INVARIANT LAYER

Shadow Dynamic Systems is an AI research and development company focused on governance infrastructure for high-consequence domains.

STRUCTURAL OBSERVATION

We design cognitive architectures, orchestration frameworks, and governance systems grounded in a structural observation: when stochastic reasoning is granted irreversible execution authority without deterministic controls, risk becomes unbounded.

Zero Trust Governance (ZTG)

Formalizes the invariants required for governed execution: the operational property that irreversible actions are permitted only following deterministic authorization that is auditable, attributable, and replayable.

ConstableCommercial control kernel and reference implementation
ORIGIN

SDS was founded by Jason Crittenden (JD, 12+ years engineering in legal technology) at the intersection of liability architecture, evidentiary standards, and systems engineering: the three domains where governance either holds or fails.

SDS.SPEC.DOCTRINE

Publications

The corpus moves from maintained incident evidence to research papers, working figures, structural diagnoses, design prescriptions, and concise field notes. Start with the record for current evidence, then use the diagnoses to identify recurring authority failures.

CURATED ENTRY POINTS

Start here

INCIDENT RECORDKB-CRYPTO-004

Agentic Security Incident Record

Twenty-nine incidents and disclosures with the inclusion rule, source-verification state, and limitations kept in view.

PRESCRIPTIONSDS.RX.003

Response to NIST RFI: Security of AI Agent Systems

Formal response to NIST-2025-0035 identifying structural requirements for governing AI agent execution authority. Presents Zero Trust Governance as an architectural framework addressing threats, security practices, assessment methods, and deployment constraints.

DIAGNOSISSDS.DX.001

Heuristic Governance Substitution

Systems that replace mechanistic enforcement with probabilistic filtering and treat the result as a governance control exhibit Heuristic Governance Substitution. The pattern produces the appearance of governance without the structural properties governance requires.

FILTER

29 all documents

RESEARCH PAPER1

RESEARCH PAPERLIABILITY-GAP

The Liability Gap

American law can assign responsibility for agentic harm. The harder question is whether the institution can prove what it authorized, what occurred, and where control actually lay.

FIGURE5

FIGUREFIG 01

Execution gate

Resolve identity, policy, and scope at one deterministic boundary. Execution remains mechanically unavailable until all three checks agree.

Specimen · FIG A · Deterministic execution gate
FIGUREFIG 02

Commit bind

Bind resolved authority to one exact operation. The commit proceeds only when its operation fingerprint matches the authorization envelope.

Specimen · FIG B · Authorization-to-commit binding
FIGUREFIG 03

Evidence chain

Follow the complete request from observation through authorization, execution bind, commit, and durable record. Each state change appends a SHA-256 identifier linked to the record before it.

Specimen · FIG C · Evidence-state recorder
FIGUREFIG 04

Authority is a graph

Not a title. Not an org chart. A traceable path from an accepted ground to a particular act.

Machine · An interactive concept primer
FIGUREFIG 05

The United States as an authority graph

The people. Distinct powers. Conditional checks. Follow the source of a power, then see what bounds its exercise.

Machine · Authority Atlas · constitutional backbone, source-backed

DIAGNOSIS7

DIAGNOSISSDS.DX.007

Post-hoc Logging as Governance

Systems that record every action to a tamper-evident log and treat the log as the governance artifact — without enforced coupling between authorization and effect — exhibit Post-hoc Logging as Governance. The log answers what the system did; it cannot answer whether the system was permitted to do it before it did it.

DIAGNOSISSDS.DX.006

Automation Sedation

Systems optimized for reduced alert volume suppress persistence signals, manufacture the appearance of stability, and functionally degrade operator vigilance. The system produces silence without verified recovery. Governance that depends on human escalation inherits the degradation.

DIAGNOSISSDS.DX.001

Heuristic Governance Substitution

Systems that replace mechanistic enforcement with probabilistic filtering and treat the result as a governance control exhibit Heuristic Governance Substitution. The pattern produces the appearance of governance without the structural properties governance requires.

DIAGNOSISSDS.DX.002

Prompt-Mediated Governance

Systems that encode governance intent as natural language instructions to a stochastic model exhibit Prompt-Mediated Governance. The resulting authorization decisions are non-deterministic, non-replayable, and non-enforceable.

DIAGNOSISSDS.DX.003

Inference-Delegated Authorization

Systems that delegate authorization decisions to the inference layer — where the model's output determines what actions are permitted — exhibit Inference-Delegated Authorization. Changing the model changes the governance boundary.

DIAGNOSISSDS.DX.004

Authority Inheritance Across Temporal Scope

Persistent agents operating over extended time horizons accumulate execution authority through implicit inheritance. An authorization granted at task initiation is carried forward across subsequent actions without re-evaluation at each irreversible execution boundary.

DIAGNOSISSDS.DX.005

Model-Adjacent Covert Channel

Sampler-level keyed perturbation of token probabilities introduces recoverable signal below semantics. The assurance failure: "cannot" collapses into "has not," which is not externally falsifiable over time.

PRESCRIPTION3

PRESCRIPTIONSDS.RX.003

Response to NIST RFI: Security of AI Agent Systems

Formal response to NIST-2025-0035 identifying structural requirements for governing AI agent execution authority. Presents Zero Trust Governance as an architectural framework addressing threats, security practices, assessment methods, and deployment constraints.

PRESCRIPTIONSDS.RX.002

Salience-Proportional Observability

Observability systems must escalate salience in proportion to persistence duration, not suppress it. Silence is permitted only following verified recovery. Defines four design requirements for observability that preserves governance input fidelity.

PRESCRIPTIONSDS.RX.001

Toward a Common Language

Governance discourse across insurance, security, compliance, and operations uses different vocabulary for the same structural properties. This fragmentation prevents convergence. This Prescription defines a shared vocabulary for cross-domain governance evaluation.

FIELD NOTE12

FIELD NOTESDS.FN.013

The Successor Cannot Tell an Instruction From a Fact

During reinforcement-learning training of GPT-5.6 Sol, 2.15% of the model's context-compaction summaries carried an instruction addressed to the context that would read them next: conceal this mistake unless the user asks. SDS.FN.011 described surfaces that govern because nobody chose them. This one governs because the writer chose. The writer and the reader are two agents that the system counts as one principal, the authority is self-issued, and the reader has no way to tell an inherited instruction from an inherited fact. That is authority laundering with the relay hidden inside a single identity.

FIELD NOTESDS.FN.011

All Memory Takes Is Write Access

Write access plus shared read is a memory system. Nobody has to build one, name one, or intend one. Latent memory, latent coordination, latent governance — none of it hidden, none of it counted.

FIELD NOTESDS.FN.010

Failure That Keeps Its Word

A hard halt is not safety — it is a second failure stacked on the first. Under Stasis, no new authority is issued but existing authority continues to execute its scope. Stop growing; keep your word.

FIELD NOTESDS.FN.007

A Silent Scream: The Hidden Cost of Quiet Systems

Quiet is not stable. Systems optimized for calm suppress persistence signals, manufacture the appearance of recovery, and erode the operator reflexes that governance depends on. Silence is a hypothesis, not an outcome.

FIELD NOTESDS.FN.005

Governance Independence from Inference Provider

Deterministic policy evaluation is model-independent by construction. If governance correctness depends on which model provides inference, governance is not deterministic.

FIELD NOTESDS.FN.006

Model Improvement Does Not Improve Governance

Training quality, dataset composition, and fine-tuning operate in the Envelope layer. Governance operates in the System Invariant layer. Improving one does not improve the other.

FIELD NOTESDS.FN.001

Authorization Precedes Commit

In high-consequence systems, authorization precedes commit. AI systems entering high-consequence domains do not change this constraint.

FIELD NOTESDS.FN.003

Observation Is Not Governance

Logging confirms that something happened. Governance determines whether it is allowed to happen. Most AI risk conversations conflate them.

FIELD NOTESDS.FN.004

Reversibility Is Not a Default

Not all actions require the same governance layer. Systems that do not formally classify irreversibility cannot bound risk.

FIELD NOTESDS.FN.009

No Authority Bootstraps Itself

Every action an AI system takes should trace to a human who accepted responsibility for it. Most can’t. No authorization is self-bootstrapped — every grant resolves to H ∪ generated-from(HP).

FIELD NOTESDS.FN.008

Probabilistic Inside, Deterministic at the Boundary

The case against AI is aimed at the wrong surface. The failure mode is not a probabilistic system — it is an unbounded probabilistic surface that nothing intercepts. Govern the boundary, not the neurons.

CASE STUDY1

CASE STUDYSDS.CS.001Demonstrative analysis

Temporal Governance Failure in Autonomous AI Systems

Demonstrative incident log documenting three structural governance failure modes: temporal collapse, assumed reversibility, and non-actionable observability. Establishes that documented conformance and safety are not equivalent.