RESEARCH DOCUMENTZTG-SPEC

Zero Trust Governance Specification

Public invariant specification defining the structural conditions for governed execution in AI systems.

ARCHITECTURAL CROSS-SECTION
CROSS-SECTION

ZTG Architectural Layers

A
A'
ENVELOPE: EnvelopeProbabilistic containment that becomes possible once you have a governed surface. Statistical operating bounds — holds under additive conditions. Insufficient alone against non-additive or emergent decisions; the invariant layer exists because the envelope cannot guarantee against catastrophic boundary violations.
SURFACE: Effect SurfaceGoverned effect surface. All agent-generated effects occur through registered, authorization-addressable interfaces. Because effects are bounded and auditable, insurability begins here.
INVARIANT: System InvariantFoundational mechanical constraints. Non-negotiable. Enforced deterministically, not discretionarily — no component may bypass, reinterpret, or negotiate a boundary at runtime.
INVARIANTS
  1. ZTG-0aObservability
  2. ZTG-0bReplayability
  3. ZTG-0cTemporal Integrity
  4. ZTG-0dIdentity Integrity
  5. ZTG-0eGovernance Consistency
  6. ZTG-1Mechanistic Boundary
  7. ZTG-2Stasis
  8. ZTG-3Governed Effect Surface
  9. ZTG-4Evidence-Coupled Execution
  10. ZTG-5Irreversibility of Harm
Section A-A' · ZTG specification v0.7
DOCUMENT BODY

ZERO TRUST GOVERNANCE (ZTG) SPECIFICATION v0.7

The Zero Trust Governance (ZTG) Specification establishes the foundational requirements for deploying autonomous execution systems into high-consequence environments.

Rather than focusing on model alignment or cognitive capabilities, ZTG defines the structural prerequisites that must exist *around* a stochastic engine to render its actions deterministic, auditable, and replayable.

STRUCTURAL PREREQUISITES (ZTG-0)

  • ZTG-0a OBSERVABILITY
  • All governance-relevant state transitions, decision points, and boundary checks must be recorded with sufficient fidelity to support deterministic post-hoc audit.
  • ZTG-0b REPLAYABILITY
  • Given identical initial state and identical inputs, the governance system must produce identical governance decisions. Execution nondeterminism is permitted; governance nondeterminism is not.
  • ZTG-0c TEMPORAL INTEGRITY
  • All components participating in governance evaluation must operate against a synchronized time source with bounded skew. Clock skew exceeding declared tolerance triggers system halt.
  • ZTG-0d IDENTITY INTEGRITY
  • All cryptographic material used for authorization signing, evidence sealing, and identity binding must be traceable to an explicitly declared trust root. Identity must be unforgeable and non-delegatable.
  • ZTG-0e GOVERNANCE CONSISTENCY
  • All components participating in governance evaluation must operate against a consistent view of governance state. During inconsistency, the system must deny authorization.

02SYSTEM INVARIANTS

Actions in the Irreversible class must be subject to stricter controls than those applied to lower classes, such as verification thresholds, authorization gates, or architectural restrictions. Actions in the Mitigable class must record residual harm in the decision provenance. The classification must be made at decision time, not after execution, and must appear as a required field in the evidence record of every governed action (ZTG-4). Implementations must not treat the harm-class field as optional.

ZTG-3's reversal_strategy is surface-side metadata describing whether the system can undo its own action. ZTG-5's harm class is consequence-side, classified per-decision, describing whether affected parties can be made whole. These are independent axes and both fields must be present in decision provenance for governed actions. A surface with reversal_strategy: rollback may authorize decisions whose harm class is Irreversible; a surface with reversal_strategy: none may authorize decisions whose harm class is Restorable.

RATIONALE FOR ZTG-5

Governance fails when system-side reversibility is mistaken for harm reversibility. A payment mechanism does not restore a person; a retraction does not unindex content; a settlement does not undo a death. Treating the existence of a forward action as evidence of recoverability silently routes catastrophic-harm decisions through the same gates as recoverable ones. Classifying by harm restorability rather than action reversibility forces the gate selection to track the consequence the affected party experiences.

  • ZTG-1 MECHANISTIC BOUNDARY
  • Governance boundaries are enforced mechanically, not discretionarily. No component may bypass, reinterpret, defer, or negotiate a boundary at runtime. Authorization must occur before irreversible action.
  • ZTG-2 STASIS
  • When the system cannot guarantee its governance invariants hold, it must halt. Stasis operates at graduated scope: surface freeze → subsystem freeze → system-wide stasis. Containment is proportional to failure.
  • ZTG-3 GOVERNED EFFECT SURFACE
  • All agent-generated external effects must occur exclusively through registered and governance-addressable surfaces. Each surface formally declares effect type, reversal strategy, and authorization policy.
  • ZTG-4 EVIDENCE-COUPLED EXECUTION
  • No externally observable effect may exist without simultaneous durable evidence of authorization and execution. The evidence record is constitutive, not documentary.
  • ZTG-5 IRREVERSIBILITY OF HARM
  • Every action a governed system may take must be classified at decision time by the restorability of its harm — Restorable (affected parties can be returned to a materially equivalent state by an action available to the system), Mitigable (no return to equivalent state, but harm reducible through a defined forward action), or Irreversible (no available forward action reduces the harm to the Mitigable class). Classification is over the harm the action causes, not the action itself. An action whose system-side effect is reversible may still cause irreversible harm; the presence of a forward mechanism (refund, retraction, settlement, correction) does not, on its own, lower the class.

03CHANGELOG

v0.7 • Current published version.

v0.6 (unpublished internal draft) • Decision: the specification required a lower conformance band to accurately represent architectures that do not require the maximalist guarantees.

v0.5 (2026·04·19) • Added: ZTG-5 Irreversibility of Harm — harm-class classification at decision time (Restorable / Mitigable / Irreversible); stricter gates for Irreversible class; residual-harm provenance for Mitigable class; explicit coupling to ZTG-4 evidence record. • Changed: ZTG-5 number reused. Previous ZTG-5 (Graduated Freeze) was retired in v0.4 and folded into ZTG-2 (Graduated Containment). ZTG-5 is reassigned to Irreversibility of Harm with entirely different semantics.

v0.4 (2026·04·16) • Retired: ZTG-5 Graduated Freeze folded into ZTG-2 as graduated containment (surface freeze → subsystem freeze → system-wide stasis).

    04ADOPTION TARGET

    v0.8 • Conformance-complete adoption target.

      SDS.EXT.ZTG-SPECShadow Dynamic Systems