PaperlayerView exact revision on arXiv

Source-linked AI summary

Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance

Wesley Shu, Hsi-Ching Lin

arXiv:2609.31029v1cs.AI

TL;DR

Reasoning systems commonly select premises by relevance, while policy may deny use of a represented premise in a particular transition. The paper formalizes this authorization task and evaluates matched RBAC-grounded pairs with one-sided controls. After a role-name shortcut is removed, the learned linear controllers score 50% on TEST while a symbolic policy oracle scores 100%.

  • Problem

    Premise selection is usually framed as relevance or utility, leaving the distinct question of whether policy permits a represented premise to be used in a local transition.

    Source: §1 · p. 1

  • Method

    The paper formalizes transition-local premise admission and constructs matched RBAC authorization pairs with controls that isolate premise/state, transition, and joint information.

    Source: §1 · p. 2, §4.2 · p. 5

  • Results

    After role-name leakage is removed, the premise/state-only, transition-only, and joint controllers each score 50% on TEST, while the symbolic policy oracle scores 100%.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Matched information controls, post-transformation semantic oracles, and fresh confirmation are needed to evaluate claims about learned policy-sensitive reasoning.

    Source: §7 · p. 7

    The negative result concerns a frozen hashed-word 1–2-gram linear logistic pipeline and does not establish failure of nonlinear neural models or relational architectures.

    Source: §9 · p. 8

Abstract

from arXiv · show

Reasoning systems usually treat premise use as a question of relevance: if a fact is available and useful, it may be selected for inference. Authorization imposes a different constraint: a premise may be represented and logically usable but not permitted for a particular local transition. We formalize this distinction as Governed Deduction (GD), with a transition-local admission predicate admit(p, tau, S). From an independently produced RBAC-augmented Spider benchmark, we construct 4,461 matched authorization pairs in which the same query premise and policy state support permitted and denied consuming transitions. An initial joint controller reaches 99.19% held-out accuracy, but a transition-only control reaches 100%, exposing a role-name shortcut. After a frozen, label-independent context-local role permutation removes that shortcut, premise/state-only, transition-only, and joint linear controllers all score exactly 50% on 1,856 held-out edges, while a symbolic policy oracle remains at 100%. The result is a controlled negative finding: the benchmark instantiates policy-grounded authorization beyond relevance, but the frozen linear representation does not recover the relation. Matched one-sided controls and leakage audits are therefore essential for evaluating learned policy-sensitive reasoning.

1 Introduction

Governed Deduction separates whether a premise is useful from whether policy permits its use in a particular transition. The benchmark exposes how one-sided shortcuts can make a joint controller look relational when it is not.

1 Introduction

  • GD asks whether policy permits an otherwise usable represented premise to participate in a particular local transition.The distinction is between possessing a premise and being authorized to consume it, not between relevant and irrelevant premises.Source: §1 · p. 1
  • A joint score alone cannot establish relational reasoning; a learned authorization mechanism must outperform controls that omit either the transition or the premise and policy state.The premise/state-only control cannot see the consuming transition, while the transition-only control cannot see the premise or policy state.Source: §1 · pp. 1–2
  • The benchmark pairs permitted and denied role-conditioned transitions while holding the query premise and raw policy state fixed across 4,461 pairs.It uses the Spider portion of an external benchmark with PostgreSQL role-based policies and source-provided PERMIT/DENY decisions.Source: §1 · p. 2
  • After role-name leakage is removed, the premise/state-only, transition-only, and joint controllers each score 50% on TEST, while the symbolic policy oracle scores 100%.Initially, the joint controller scores 99.19%, but the transition-only control scores 100%; every positive edge contains User_1 and every negative edge contains another role.Source: §1 · p. 2

2 Conceptual and Technical Foundations

Prior security and reasoning work addresses state-dependent authorization and useful-premise selection, but GD frames a distinct empirical question: can learned control identify authorization of a represented premise at a local transition?

2.1 Availability, relevance, and authority are different control variables

  • Security traditions distinguish information availability from permission to use it, and GD asks whether authorization can be isolated at a local consuming transition in learned reasoning.Protection matrices, lattice models, RBAC, and usage control already treat rights or permissions as state-dependent; GD does not claim novelty for contextual permission.Source: §2.1 · p. 2

2.2 Authorization can itself be a proof problem

  • Authorization has been formalized as logical policy reasoning, while GD frames its contribution as testing whether learned controllers distinguish the joint premise–state–transition relation from one-sided shortcuts.Constrained credential usage permits a credential in some authorization proofs but not others; Table 1 frames GD as isolating authorization of premise consumption.Source: §2.2 · pp. 2–3, Table 1 · p. 3

2.3 Premise selection optimizes usefulness, not permission

  • Premise-selection systems learn which premises are useful for proof search, whereas GD asks whether policy permits a represented, potentially useful premise to be consumed.Prior systems include learned premise selection for theorem proving and neural or language-model approaches.Source: §2.3 · p. 3

2.4 Belief revision changes representation; GD changes admissibility

  • Belief-revision tasks change or retract beliefs, but GD keeps the premise represented and changes whether the current transition may consume it.The distinction is between changing representation and changing admissibility.Source: §2.4 · p. 3

3 Governed Deduction

Governed Deduction adds a transition-local admission test to ordinary antecedent representation. Its formal distinction motivates matched controls, but does not claim new proof-theoretic expressivity or establish learnability.

3 Governed Deduction

  • A GD transition requires both that premise p is represented in state S_t and that admit(p, τ, S_t) equals 1.Standard applicability requires represented antecedents; GD adds a local admission test for consuming the premise.Source: §3 · p. 4
  • A matched pair is not evidence for GD authorization if its label can be inferred from antecedent membership or proof-trace usefulness.The pair must hold the premise and raw state fixed while changing the consuming transition.Source: §3 · p. 4
  • Replacing a GD transition with an ordinary rule guarded by ϕτ(S)=1 preserves enabled transitions and closure, so GD is compatible with guarded inference.The paper makes an empirical-identification claim rather than claiming a new class of derivations.Source: §3 · p. 4
  • With p and S fixed across transitions that have different admission labels, no deterministic transition-independent h(p,S) can reproduce both decisions.This proposition motivates the premise/state-only control, but establishes neither learnability nor the absence of transition-only shortcuts.Source: §3 · p. 4

4 Policy-Grounded Benchmark Construction

The benchmark uses independently supplied RBAC authorization labels to construct matched consuming transitions, then applies validity and leakage checks. Its initial implementation reveals a role-name shortcut that motivates a label-independent correction.

4.1 Independent authorization source

  • The source adds PostgreSQL RBAC policies and policy-engine PERMIT/DENY labels to Spider text-to-SQL instances; each eligible context yields permitted and denied transitions sharing the query premise and raw policy state.The denied edge remains a well-formed execution attempt without the authorization rule, so its label reflects permission rather than syntactic or logical applicability.Source: §4.1 · p. 4
  • The final benchmark contains 4,461 matched pairs, with splits clustered by Spider database instance and no exact model-facing byte overlap across splits.Each pair contributes one permitted and one denied edge.Source: §4.1 · p. 4, Table 2 · p. 5

4.2 Construct-validity gates

  • Construct validity requires independently produced labels, fixed premise and raw state within each pair, genuine attempts to consume the premise, and denied transitions that remain executable without authorization.The representation is audited through database-level provenance splits, cross-split byte checks, and label-independent renaming perturbations.Source: §4.2 · p. 5

4.3 The initial shortcut

  • The initial adapter makes role names a perfect shortcut: transition-only reaches 100% TEST accuracy while the joint controller reaches 99.19%.Every positive edge contains User_1, while every negative edge contains User_2, User_3, or User_4.Source: §4.3 · p. 5

4.4 Leakage-controlled construction

  • A frozen, context-local permutation based only on context and original role names is applied consistently to transitions and policy state, removing the global role-name cue while preserving the within-context relation.Every anonymous role occurs with both labels in every split, and the construction validators pass before corrected training.Source: §4.4 · p. 5

5 Models and Confirmatory Evaluation

The evaluation compares matched premise/state-only, transition-only, and joint controllers, alongside diagnostics and a symbolic policy oracle. Model selection uses development thresholds, with the test set evaluated only after selection.

5 Models and Confirmatory Evaluation

  • The three matched-capacity controllers receive premise and state, transition, or all three fields; scramble variants diagnose the joint arm.The symbolic oracle applies the underlying policy semantics to check whether corrected labels remain resolvable.Source: §5 · p. 5
  • The leakage-controlled results place learned controllers at chance while the symbolic policy oracle remains perfect.Table 3 reports this comparison for the TEST set.Source: Table 3 · p. 6
  • All arms use a 4,096-dimensional word 1–2-gram HashingVectorizer and train on the same 5,114 edges.The models are SGD classifiers with logistic loss and balanced class weights.Source: §5 · p. 6
  • Thresholds .25, .50, and .75 are compared on DEV; TEST is evaluated only after model and threshold selection.Edge accuracy is primary, and the mechanism hypothesis requires the joint model to materially exceed both one-sided controls under the frozen provenance-cluster bootstrap rule.Source: §5 · p. 6

6 Results

After leakage control, all learned arms score at chance while the symbolic oracle remains perfect. The results are consistent with the corrected task requiring cross-field composition that the tested frozen linear pipeline did not learn.

6 Results

  • All learned arms score exactly 50% on 1,856 held-out edges, while the symbolic policy oracle remains at 100%.The result shows the role permutation preserved a policy-resolvable relation.Source: §6 · p. 6
  • At threshold .25, all learned arms predict positive on every TEST edge, yielding 928 true positives and 928 false positives.The arms have identical prediction vectors, zero joint-minus-control accuracy differences, and chance-level premise- and state-scramble diagnostics.Source: §6 · p. 6
  • The initial task leaks transition identity, whereas the corrected task is semantically solvable but not by the frozen additive linear representation.The mechanism hypothesis is rejected for this model family.Source: §6 · p. 6

6.1 Why the corrected representation is difficult for the linear arm

  • Authorization depends on matching an anonymous transition role against role-conditioned grants for the query’s schema elements.The linear bag of word 1–2 grams has no explicit operator for comparing the role in one field with permission facts in another.Source: §6.1 · p. 6
  • The explanation is not an impossibility theorem: collisions, optimization, regularization, and sample size may affect outcomes, and richer features could encode interactions.The finding is limited to the frozen serializer/vectorizer/classifier pipeline under the corrected construction.Source: §6.1 · p. 7

7 Discussion

The benchmark’s matched construction captures authorization beyond relevance, and the oracle shows the corrected labels remain functions of policy semantics. The discussion argues that controls are necessary to interpret learned scores and identifies untested alternatives and confirmation requirements.

7 Discussion

  • The matched benchmark establishes that fixed premise and policy state can support opposite labels as the consuming transition changes.The oracle confirms the corrected labels remain deterministic functions of underlying policy semantics.Source: §7 · p. 7
  • A headline joint score alone cannot identify mechanism; one-sided controls and an oracle distinguish shortcut learning from a solvable but unlearned relation.The paper concludes that these controls are needed to evaluate policy-sensitive reasoning.Source: §7 · p. 7
  • The result does not prove explicit relational architectures are necessary; nonlinear interaction, attention, structured neural models, and programmatic hybrids remain untested.A stronger study should use fresh development data and a new untouched holdout for confirmation.Source: §7 · p. 7
  • Benchmark design should include matched information controls, post-transformation semantic oracles, and fresh confirmation after discovery.These requirements apply when a claim concerns relations among multiple structured inputs, not only RBAC.Source: §7 · p. 7

8 Conclusion

Governed Deduction separates premise usefulness from authorization to use it, and the paper tests this distinction with matched controls. The result is a controlled negative finding: the benchmark and audit design survive, but the tested learner does not.

8 Conclusion

  • Governed Deduction distinguishes whether a premise is useful from whether its use is authorized, testing authority as a distinct label source against matched one-sided controls.Source: §8 · p. 7
  • The paper frames its contribution as an empirical identification design, rather than a new access-control logic, proof calculus, or premise-relevance method.Source: §8 · p. 7
  • On 4,461 policy-grounded matched pairs, the initial result exposed label leakage, and after correction the learned controllers failed to recover the relation.The benchmark object and audit design survive; any stronger learned claim requires a new model hypothesis and fresh confirmatory evidence.Source: §8 · pp. 7–8

9 Limitations

The negative result is bounded by the tested model family and benchmark setting, and the task evaluates local authorization rather than end-to-end outcomes.

9 Limitations

  • The negative result concerns hashed word 1–2 grams with a linear logistic classifier, not nonlinear neural models or a necessity theorem for relational architectures.Source: §9 · p. 8
  • Because the benchmark uses RBAC-augmented text-to-SQL data rather than natural mathematical proof traces, claims about theorem proving and general language-model reasoning are limited.The context-local role permutation is a controlled intervention, not a deployment distribution.Source: §9 · p. 8
  • The benchmark measures local authorization prediction, not end-to-end downstream utility or security; enforcement effects on full reasoning behavior require separate study.Source: §9 · p. 8

Ethical Considerations

The work uses an existing database access-control benchmark and identifies overgeneralization to system-level security as its main risk.

Ethical Considerations

  • The benchmark uses existing database access-control policies, and its local authorization results should not be mistaken for a system-level security guarantee.Source: Ethical Considerations · p. 8

A Reproducibility and Audit Provenance

The supplement binds the benchmark and confirmatory workflow to audit artifacts, while the authors disclose several uses of generative AI and verification of scientific claims and results.

A Reproducibility and Audit Provenance

  • The supplement cryptographically binds the 4,461-pair file, split policy, training and analysis materials, and TEST execution receipts in supplied manifests.The external source is pinned by repository commit and evidence hashes; frozen predictions are not regenerated or modified.Source: A Reproducibility and Audit Provenance · p. 11

B AI Use Disclosure

  • Generative AI supported drafting, literature triage, code auditing, and execution-governance construction; scientific claims, citations, source identities, experiment definitions, and numerical results were checked.Source: B AI Use Disclosure · p. 11
Loading 2609.31029v1…