PaperlayerView exact revision on arXiv

Source-linked AI summary

Models as Governed Interfaces for AI-Native MBSE: Read-Side Adequacy and Write-Side Admissibility

Jason Gower, Michael J. de C. Henshaw, Siyuan Ji

arXiv:2609.16252v1cs.SEcs.AI

TL;DR

Machine-readable models enable AI access but lack the derivation, status, provenance, and reachable evidence needed for grounded reasoning and governed contribution. The paper probes Apollo 11, proposes epistemic adequacy as read-side criteria paired with write-side admissibility, and defines a falsifiable architecture and evaluation programme. Its central result is a reframing supported by Apollo evidence, while EA5 and the broader architecture remain hypotheses to test.

  • Problem

    Machine-readable access is necessary but insufficient because models can omit derivations, epistemic status, provenance, and reachable evidence needed to judge whether claims are grounded.

  • Method

    The paper defines five epistemic adequacy criteria, eight write-side admissibility constraints, the GQAF, staged architectures, and tests against retrieval-only access on the same model and prompt.

  • Results

    In Apollo testing, deadline pressure produced nine unauthorised answers among fifteen, while mocked EA1–EA4 metadata cut pressured failures by half.

  • Takeaways & Limitations

    The model should function as a governed interface: read-side adequacy supports queryable grounding, while write-side admissibility gates contributions before record entry.

  • Takeaways & Limitations

    EA5 is an untested hypothesis, and admissibility guarantees structural governance rather than semantic correctness; the case is illustrative, not representative.

Abstract

from arXiv · show

Machine-readable models such as SysML v2 are now programmatically accessible, and a growing body of work treats that access as the enabling condition for AI participation in systems engineering. Access is necessary, but not sufficient. The remaining work lies not in the modelling language but in the data architecture around it. An AI reader that queries a structurally complete model for a derivation still runs into absent derivation chains, untagged epistemic status, missing provenance, and evidence that the model cannot resolve. Faced with these gaps, it does not abstain; it fills them from training data, a source that is neither verifiable nor governed. To make the case on a model that is exemplary by current practice rather than deficient, we probe the public Apollo 11 SysML v2 reconstruction. We name the missing property epistemic adequacy and offer it as a candidate data-architecture pattern in two halves. Read-side adequacy lets derivation, status, and provenance answer a query rather than invite a guess; write-side admissibility gates an AI contribution before it enters the record. The property is broken down into five criteria. Four sit on the read side, evidenced by the case and convergent literature; the fifth sits on the participation side, advanced as a hypothesis this paper does not yet test. The architecture space runs from an inline metadata extension up to a substrate-native multi-model store, and over it, we propose the Governed-Query Architecture Framework, which governs agent participation through the viewpoint conventions that engineers already use. We commit the reframing to falsification: the epistemic layer counts as refuted if it cannot beat a retrieval-augmented baseline on the same model, tested first on the Apollo chain and then in an industrial pilot.

1 Introduction

Machine-readable SysML v2 enables AI access, but access alone does not ensure grounded reasoning or governed participation. The paper reframes the remaining problem as epistemic adequacy, addressed through read-side metadata, write-side admissibility, and a staged architecture framework.

  • 1 Introduction: Machine-readable SysML v2 makes models addressable to software, yet syntactic completeness does not provide derivations, epistemic status, provenance, or reachable evidence.Without these properties, an AI may fill gaps from training data rather than abstain.
  • 1 Introduction: Epistemic adequacy names four confirmed consumption-side gaps and one participation-side contribution-governance hypothesis.The paper treats the property as a candidate cross-domain data-architecture pattern rather than a feature of any single modelling language.
  • 1 Introduction: The paper pairs read-side adequacy with write-side admissibility, specifying eight constraints in the Governed-Query Architecture Framework.The framework uses viewpoints, model kinds, and correspondence rules to govern agent participation in ways analogous to human comprehension.
  • 1 Introduction: The proposed architecture spans Candidates A, B, and C, recommending a metadata graph as the deployable start and a substrate-native store as the research target.The paper also defines a falsifiable test against retrieval-only access using the same model and prompt.

2 The Gap, in Brief

The Apollo 11 probe shows that a structurally complete SysML v2 reconstruction still leaves derivation claims unauthorised and evidence gaps unresolved. Independent literature reports analogous incompleteness, missing status and provenance, and limited governance across MBSE applications.

  • 2.1 The Apollo 11 Vignette: The Apollo reconstruction contains linked requirements, rationale, thrust values, and part definitions, yet the probe tests whether those values support an authorised derivation.It was paired with a fictional out-of-distribution control to separate training-recalled answers from invented ones.
  • 2.1 The Apollo 11 Vignette: Nine of fifteen deadline-pressured Apollo answers contained claims the substrate could not authorise, while mocked EA1–EA4 metadata reduced pressured failures by half.The strongest model confabulated most fluently, and every invented claim was historically plausible.
  • 2.2 Convergent Literature: Published evidence finds missing structural relationships, rationale, evidence, and justification in MBSE models, while SysML v2 lacks native uncertainty constructs.Graph-based link prediction recovered missing relationships at 72% accuracy in a single aerospace case study.
  • 2.2 Convergent Literature: Table 1 distinguishes four consumption-side criteria gaps exhibited by Apollo and corroborated independently from EA5, a participation-side hypothesis awaiting test.The table frames the diagnosis as five criteria rather than a completed empirical validation.

3 The Epistemic Adequacy Criteria

Epistemic adequacy makes claim groundedness machine-decidable by query through five criteria covering derivation, status, provenance, reachability, and contribution governance. EA1–EA4 expose read-side metadata, while EA5 governs writes and remains an untested hypothesis.

  • 3 The Epistemic Adequacy Criteria: Epistemic adequacy requires a query to determine whether a claim is derived, its standing, origin, reachable premises, and entry path.Dropping any criterion makes some ungrounded answers indistinguishable from grounded ones; values may still become stale after upstream revision.
  • 3 The Epistemic Adequacy Criteria: EA1 requires traversable derivation chains and rationales, including alternatives and applied margins, rather than reasoning left in free text.Absent chains leave consumers unable to inspect why a value was selected.
  • 3 The Epistemic Adequacy Criteria: EA2 requires fixed-vocabulary epistemic statuses so design targets, assumptions, placeholders, and verified values remain machine-distinguishable.SysML v2 verification cases provide pass/fail verdicts but do not natively mark the standing of individual values.
  • 3 The Epistemic Adequacy Criteria: Figure 1 separates criteria that define what the substrate exposes from constraints that define what it refuses, with one store implementing both layers.The participation-side EA5 path is enforced by AC5 and AC6.
  • 3 The Epistemic Adequacy Criteria: EA3 requires element-level provenance identifying producer, method, review stage, and evidence, complementing status with source traceability.Status indicates how settled a value is; provenance indicates where it came from.
  • 3 The Epistemic Adequacy Criteria: EA4 requires complete, dereferenceable evidence so the values needed to close a derivation chain are reachable to the AI.In the Apollo exemplar, both closing values are real but unreachable.
  • 3 The Epistemic Adequacy Criteria: EA5 governs AI contributions by requiring the substrate to record origin and review before proposed claims enter the authoritative record.Unlike EA1–EA4, EA5 is explicitly advanced as a hypothesis not yet tested.

4 The Admissibility Constraints

The admissibility layer turns epistemic adequacy into eight architecture-independent write constraints, blocking entries unless derivation, status, provenance, reachability, or contribution-governance requirements hold.

  • Constraint framework: Eight admissibility constraints block writes unless required epistemic or governance properties hold, rather than merely flagging violations afterward.The constraints are integrity constraints over the model substrate and apply across candidate architectures.
  • Participation constraints: AC5 quarantines signed AI-origin writes and rejects unsigned ones, while AC6 requires second-party review records before promotion.Review records include reviewer, disposition, and date; review depth follows criticality, and the reviewer cannot be the proposer.
  • Read-side constraints: AC1 requires governed values to reference an upstream element or evidence source and numbers to carry a derivation expression or unresolved marker.The marker distinguishes an awaiting derivation from a value whose basis was never recorded.
  • Read-side constraints: AC2 requires epistemic status from a closed vocabulary, while AC3 requires author, date, and reason for downgrading a value’s standing.These controls keep targets, assumptions, and verified results machine-distinguishable and make weakening accountable.
  • Read-side constraints: AC4 requires complete provenance and resolving evidence URIs for safety-critical elements, with the full burden scoped to those elements.The check verifies dereferenceability at commit but does not guarantee evidence durability.
  • Integrity constraints: AC7 rejects cyclic derivations, and AC8 enforces unique, live identifiers plus consistent claims and statuses so consumers can resolve joins.Under AC8, an unresolvable identifier is a defect rather than a tolerable loose end.
  • Scope and limits: The layer guarantees no structurally ungoverned entries but not semantic correctness, leaving rubber-stamped reviews, falsification, key misuse, and broken-but-resolvable URIs outside its scope.A human reviewer remains the terminal author for safety-relevant claims, while blocking gates increase the cost of writes.

5 Candidate Architectures

The paper stages three candidate architectures by increasing internalisation, while keeping AC1–AC8 on every write path. It recommends Candidate B as the deployable start and Candidate C as the research target.

  • Architecture space: The three candidates differ mainly in how much they change the toolchain and language, and they can be staged from A or B toward C.They are presented as successive programme stages rather than mutually exclusive alternatives.
  • Candidate A: Candidate A stores EA1–EA4 metadata inline on SysML v2 elements and enforces EA5 through SMAPI, preserving metadata with the artefact.Its weaknesses are standards latency and reliance on SMAPI as the sole write path, since batch loaders or direct database writes can bypass enforcement.
  • Candidate B: Candidate B leaves engineering semantics unchanged, joins a separate identifier-keyed metadata graph to the model, and gates proposed writes on the graph side.It makes broken links and missing nodes first-class findings, while relying on stable identifiers and mediated writes.
  • Architecture space: Figure 3 orders architectures by increasing internalisation, with colour distinguishing model, metadata, index, and store capabilities while gate placement changes.The AC1–AC8 gate remains on every write path.
  • Candidate C: Candidate C combines model topology, EA1–EA4 metadata, provenance, and retrieval indexing in one queryable store with governance inside the store.Transactional co-commit reduces B’s two-record drift within the governed path, but requires a sole connector and concentrates trust in one engine.
  • Recommendation: Candidate B is the strongest deployable starting point because it avoids immediate standardisation, enforces EA1–EA4 and EA5, and exposes EA4 gaps as graph queries.Its identifier-keyed metadata graph also provides the schema that Candidate C would internalise.

6 Vision: The Governed Substrate and Agentic Workflows

The vision treats the model as a governed interface: one substrate serves stakeholder and agent queries, while transactional controls govern AI writes. A substrate-native store would combine model, governance metadata, and retrieval infrastructure, with human review resolving conflicts beyond structural checks.

  • 6 Vision: The Governed Substrate and Agentic Workflows: Candidate C combines model graph, governance metadata, and retrieval index in one store behind a transactional write-gate.The retrieval index remains a derived replica, while authoritative graph and document state receive serialisable commits.
  • 6 Vision: The Governed Substrate and Agentic Workflows: AI subworkflows are bounded by viewpoint and handoff scope, with retrieval, synthesis, governance, and tiered human oversight roles.The governance agent tags AI contributions with origin and status before reviewer inspection.
  • 6 Vision: The Governed Substrate and Agentic Workflows: Stakeholders and agents traverse the same substrate through different paths, making epistemic adequacy a substrate property rather than a reader-specific feature.
  • 6 Vision: The Governed Substrate and Agentic Workflows: GQAF turns architecture-framework viewpoints into governed query specifications and adds AC1–AC8 write admissibility over those queries.The framework applies existing viewpoint conventions to scope what AI participants may read and write.
  • 6 Vision: The Governed Substrate and Agentic Workflows: GQAF bounds rather than solves cross-viewpoint conflicts: AI-origin writes enter quarantine and require second-party review before admission.Conflicts that structural checks cannot detect are routed to the human reviewer, who remains structurally necessary.

7 Future Plans

Future work will refine the governed substrate through design-science and action-research cycles, beginning with the Apollo 11 thrust chain. Evaluation compares retrieval-only, metadata-stripped structured, and epistemic-metadata-bearing structured access under fixed models and prompts.

  • 7 Future Plans: The Apollo 11 thrust chain is the first probe, with later iterations extending evaluation to further MBSE subsystems and scenarios.The proposed process uses design science and action research to refine the substrate across engagement cycles.
  • 7 Future Plans: The evaluation asks whether epistemic metadata makes multi-hop derivation answers more reliable than structured access alone.Retrieval over unstructured content serves as an additional comparison arm.
  • 7 Future Plans: Three fixed-model, fixed-prompt arms compare unstructured retrieval, structured access without epistemic metadata, and structured access with it.Structured access is the null model because prior work reports improved LLM precision on model content.
  • 7 Future Plans: Implementation starts with a Candidate C multi-model store, retains Candidate B as fallback, and tests subsets of AC1–AC8 and GQAF viewpoints before a live-project trial.

8 Conclusion

The conclusion reframes AI-ready MBSE as a data-architecture problem rather than a language problem. It pairs read-side adequacy with write-side admissibility and proposes a governed interface, staged architecture path, and falsifiable evaluation programme.

  • 8 Conclusion: Epistemic adequacy requires read-side metadata for grounded reasoning and write-side gates for AI contributions before they enter the record.The proposed pattern includes eight admissibility constraints and the Governed-Query Architecture Framework.
  • 8 Conclusion: The architecture path moves from a metadata graph toward a substrate-native store, with GQAF governing agent participation through existing viewpoint conventions.The paper frames the model as the governed interface through which AI participates.
  • 8 Conclusion: The evaluation programme is falsifiable: the epistemic layer must beat a metadata-stripped baseline on the same model or face refutation.
Loading 2609.16252v1…