PaperlayerView exact revision on arXiv

Source-linked AI summary

VeriWeave Govern: Evidence-Gated Deterministic Runtime Governance for Enterprise AI Agents

Kabeh Mohsenzadegan, Vahid Tavakkoli, Kyandoghere Kyamakya

arXiv:2609.37457v1cs.AIcs.CYcs.MAcs.SE

TL;DR

Consequential agent actions require authorization separate from stochastic action generation. VeriWeave Govern evaluates structured proposals using versioned policies, typed evidence, deterministic decisions, human review, and replayable audit state. Across controlled benchmarks it reports zero observed aggregate false allows and zero observed Governance Attack Success Rate, while its human-reviewed comparison exposes a safety–utility trade-off.

  • Problem

    Agentic systems can execute consequential actions, while conventional authorization does not by itself address evidence freshness, conflicting controls, accountability, unknown actions, and policy evolution.

    Source: §1 · p. 1

  • Method

    VeriWeave places deterministic runtime governance between agents and side-effecting tools, applying evidence gates, fixed decision precedence, review routing, and replayable audit.

    Source: §1 · p. 2, §3.6 · p. 6, §3.8 · p. 7

  • Results

    Across controlled cases, VeriWeave reports zero observed aggregate false allows and zero observed Governance Attack Success Rate; on the human-reviewed set, deterministic engines over-review relative to Gemma 4 31B.

    Source: §7 · p. 17, §9 · p. 20

  • Takeaways & Limitations

    Action generation and authorization should be separate trust domains, with LLM outputs remaining untrusted until validated by deterministic controls.

    Source: §7 · p. 17

    The constructed 150-case EU/Austria bank with two reviewers does not establish universal legal correctness, jurisdictionwide validity, or real-world regulatory effectiveness.

    Source: §7.4 · p. 19

Abstract

from arXiv · show

Enterprise artificial-intelligence agents increasingly call tools, modify infrastructure, and process protected data, creating a need to separate action generation from action authorization. This article presents VeriWeave Govern, a deterministic runtime governance layer that evaluates structured agent actions against versioned policies, validates typed evidence, applies fixed deny > review > allow precedence, routes consequential actions to accountable human review, and records replayable tamper-evident audit state. GovernBench evaluates the design over 30 independent seeds and 60,000 oracle-labelled cases spanning five enterprise domains, adversarial evidence, out-of-distribution actions, and temporal policy evolution. VeriWeave achieves 0.9888 mean accuracy, 0.9836 macro-F1, zero observed aggregate false allows, and zero observed Governance Attack Success Rate on the evaluated cases. Six ablations show that evidence gating, deny precedence, out-of-distribution fail-safe behavior, human review, contradiction handling, and temporal replay contribute complementary safety. The deployed API additionally passes 12/12 end-to-end scenarios and a 40,040-request concurrency matrix with zero failures. A separate 150-case EU/Austria regulation-grounded evaluation uses frozen predictions and two independent blinded human annotators, who agree on all decisions. On this set, deterministic engines remain conservative, while a Gemma 4 31B comparator aligns more closely with the human consensus. The results expose a measurable safety--utility trade-off and motivate evidence-aware, replayable governance as an independent control plane for enterprise agent execution.

1 Introduction

As agents move from generating text to executing consequential actions, authorization must be separated from stochastic action generation. VeriWeave Govern places a deterministic, evidence-gated governance boundary between proposals and side effects, while leaving policy ownership with accountable humans.

1 Introduction

  • Agentic systems make authorization consequential because an incorrectly authorized action can deploy software, release data, send messages, or affect citizen-facing processes.Influential tool-use patterns and surveys describe increasingly autonomous systems operating over complex goals.Source: §1 · p. 1
  • Conventional RBAC, ABAC, and policy engines do not by themselves address evidence freshness, conflicting controls, human accountability, unknown actions, and policy evolution.A technically permitted deployment may still need current approval and a rollback plan, while a high-impact action may require review despite complete documentation.Source: §1 · pp. 1–2
  • Using the same stochastic component to propose and authorize actions is risky given reported non-determinism, security reasoning failures, and prompt-mediated attack surfaces.The paper therefore places a deterministic governance boundary between agents or workflows and side-effecting tools.Source: §1 · p. 2
  • The governance layer combines tri-state decisions with deny precedence, out-of-distribution fail-safe review, human queues, temporal replay, and tamper-evident audit.The reference architecture integrates identity and context, versioned policies, evidence sources, enforcement outcomes, and replayable audit state.Source: §1 · p. 2
  • The paper evaluates GovernBench across 30 seeds and 60,000 synthetic cases, and provides a separate 150-case EU/Austria validation artifact with blinded human annotations.The benchmark includes adversarial families, calibration metrics, six ablations, and safety-specific measures; the separate artifact includes official-source provenance and frozen comparisons.Source: §1 · p. 2
  • VeriWeave separates semantic planning, authorization, and organizational accountability through a typed contract for actions, context, identity, evidence, policies, and replayable decisions.Its final decision path does not require an LLM.Source: §1 · p. 2
  • VeriWeave tests whether encoded organizational decisions remain stable under missing evidence, conflicting rules, unknown actions, adversarial inputs, and policy evolution, without determining legal compliance.Normative policy ownership remains with accountable humans.Source: §1 · p. 2

2 Related Work

Related work covers policy enforcement, regulatory automation, and agent safety, while positioning VeriWeave as a runtime control for authorization rather than policy authoring or legal compliance.

2.1 Policy enforcement and governance architectures

  • VeriWeave complements OPA and Cedar by adding evidence acceptance, tri-state escalation, temporal replay, and governance audit semantics to predicate authorization.Cedar is a safe and analyzable authorization language; OPA is used for general-purpose policy evaluation.Source: §2.1 · p. 2

2.2 Regulatory and compliance automation

  • Regulatory and compliance work motivates provenance and review, but the paper treats legal frameworks as context rather than evidence that an automated governor can determine compliance.The cited context includes NIST AI RMF, the EU AI Act, GDPR, and Regulation (EU) 2026/1744.Source: §2.2 · p. 3

2.3 Agent safety and runtime mediation

  • Agent robustness against prompt attacks is distinct from runtime authorization: a robust model may still request a prohibited action, and a benign request may lack required evidence.The planner is therefore treated as an untrusted source of proposals, while explicit policy, typed evidence, and review semantics determine whether a proposal becomes a side effect.Source: §2.3 · p. 3

3 System Model and Architecture

VeriWeave governs proposed side effects using explicit runtime invariants, with protected platform services and trust roots assumed. Its tri-state rule model keeps prohibitions, uncertainty, and evidence sufficiency explicit.

3.1 Design scope and assumptions

  • The scope covers proposed side effects that alter enterprise state; compromise of the governance service, policy repository, identity source, keys, or authoritative evidence connectors is outside the benchmark threat model.Such compromise would require infrastructure controls in addition to the decision logic studied.Source: §3.1 · p. 3
  • Safety invariants require deny precedence independent of rule order, typed evidence sufficiency, and review rather than accidental allow when actions or approvals are uncertain.These objectives motivate the tri-state lattice used throughout the implementation.Source: §3.1 · pp. 3–4

3.2 Safety invariants

  • The model treats the proposer as stochastic, evidence as dynamically retrieved, and some otherwise permitted actions as procedurally human-gated, motivating explicit invariants rather than prompt instructions.Table 1 is identified as the presentation of runtime governance invariants.Source: §3.2 · p. 4, Table 1 · p. 4
  • The decision model uses matched rules Q(x) and evidence-gate status G(x): any matched deny wins; otherwise review applies for review rules, failed gates, or no matching rules; allow applies otherwise.Unknown actions therefore resolve to review, and a permissive rule cannot override a simultaneously matched prohibition.Source: §3.2 · p. 4

3.3 Reference architecture

The reference architecture places structured evaluation between planning and tool execution, joining policy matching and evidence verification in deterministic decision-making. Integration semantics and temporal replay preserve explainability across execution and policy changes.

3.3 Reference architecture

  • Versioned policy matching and evidence verification feed a conservative reducer; review goes to an accountable human queue, and outcomes are recorded for verification and historical replay.Stochastic planning remains outside the deterministic governance boundary.Source: §3.3 · p. 4, Figure 1 · p. 5

3.4 Integration and execution semantics

  • The evaluation API makes action, resource, purpose, environment, impact, data classification, external-transfer state, and typed evidence explicit fields.Identity systems, policy backends, workflow systems, and SIEM or immutable storage can supply or receive the corresponding governance functions.Source: §3.4 · p. 5
  • Malformed requests fail validation, unknown semantic actions become review, prohibitions become deny, and low-risk requests may be allowed only after evidence requirements are satisfied.This is fail-closed governance without indiscriminately denying every novel action.Source: §3.4 · p. 5

3.5 Policy lifecycle and temporal semantics

  • Historical replay binds a request to its original policy hash, while live evaluation uses the currently active bundle, so policy updates can change later decisions without rewriting earlier audit history.Policy version, evaluation time, and source snapshot are first-class inputs.Source: §3.5 · p. 6
  • Candidate policy bundles can be regression-tested by reevaluating frozen cases and inspecting newly allowed, reviewed, or denied decisions before production promotion.Rollouts may introduce rules in shadow mode, activate them after review, and later retire them without rewriting history.Source: §3.5 · p. 6

3.6 Evidence gate and audit integrity

The evidence gate separates learned evidence-quality assessment from symbolic authorization, requiring accepted typed evidence for allow. Audit chaining and counterfactual certificates support integrity, replay, and inspection of decision changes.

3.6 Evidence gate and audit integrity

  • Evidence acceptance uses a logistic score trained on separate synthetic data, with acceptance requiring a threshold and a matching evidence type.The score is evaluated with calibration metrics and is not interpreted as a legal probability.Source: §3.6 · p. 6
  • An allow requires accepted evidence for every applicable typed requirement; if the gate fails, the reducer returns review rather than inferring missing documentation is harmless.The evidence score ranks evidence acceptability but does not directly authorize an action; authorization follows matched rules, typed sufficiency, and precedence.Source: §3.6 · p. 6
  • Tamper evidence depends on protecting or authenticating the chain head or a checkpoint; a hash chain alone cannot stop an attacker with full store control from rewriting history.Policy hashes and timestamps support replay under the policy version that governed the original request.Source: §3.6 · pp. 6–7

3.7 Counterfactual governance certificates

  • Counterfactual governance certificates record the decision, minimal supporting and missing evidence, policy version, and perturbations that would change the decision.The counterfactual is recomputed through the same deterministic decision function, rather than supplied as free-form explanation.Source: §3.7 · p. 7
  • In the certificate example, removing minimal evidence changes an allowed case to review, while sending secret data to an external destination changes it to deny.The traces are presented as useful for regression testing after policy updates.Source: §3.7 · p. 7

3.8 Determinism, monotonicity, and cost

The design specifies deterministic decision properties: deny rules dominate, evidence removal cannot create an allow, and identical frozen inputs reproduce the governance outcome. The reference evaluator is approximately linear in active rules and submitted evidence before persistence.

3.8 Determinism, monotonicity, and cost

  • For a fixed request, any matched deny rule prevents additional allow or review rules from making the final decision more permissive, regardless of rule enumeration order.This is the stated deny-dominance property.Source: §3.8 · p. 7
  • Without a matching deny, removing, expiring, invalidating, or weakening required evidence downgrades allow to review unless an equivalent accepted item still satisfies the same typed requirement.Removing evidence cannot create a new allow.Source: §3.8 · p. 7
  • Identical normalized requests, policy versions, evidence features, thresholds, and evaluation-time semantics reproduce the same decision, reasons, and matched-rule set.Audit identifiers and wall-clock metadata may differ for new live invocations.Source: §3.8 · p. 7
  • With indexed predicates, the reference evaluator is approximately O(m + n) per request before persistence, where m is active rules and n is submitted evidence.Naive pairwise contradiction checks can add cost; the reported API latency includes parsing, checks, reduction, and audit writing.Source: §3.8 · pp. 7–8

4 Experimental Methodology

The methodology separates controlled synthetic benchmarking, real-service validation, and regulation-grounded review, with comparator predictions frozen before human annotation. It evaluates benchmark accuracy and safety, adversarial behavior, service correctness, and agreement with blinded human labels.

4.1 GovernBench and research questions

  • GovernBench uses 30 independent seeds and 2,000 oracle-labelled cases per seed across five enterprise domains, including adversarial evidence, out-of-distribution actions, and policy evolution.The study asks six research questions spanning unsafe allows, adversarial resistance, complementary controls, evidence quality, HTTP correctness, and concurrent load.Source: §4.1 · p. 8

4.2 Baselines and ablations

  • The controlled study compares RBAC, ABAC, and the full governor; six ablations independently remove evidence gating, contradiction detection, human review, OOD fail-safe behavior, deny precedence, or temporal replay.The separate external comparison uses Gemma 4 31B, OPA, and Cedar on the 150-case regulation-grounded bank; predictions were frozen before annotation.Source: §4.2 · p. 9

4.3 Safety and utility metrics

  • The evaluation reports macro-F1 and safety-specific rates because overall accuracy alone does not capture the distinct operational consequences of tri-state errors.False-allow and attack-success rates capture unsafe execution, while false-review rate captures escalation friction; reporting them together avoids rewarding a system that reviews every case.Source: §4.3 · p. 9

4.4 Threat model and adversarial families

  • The threat model assumes the governance service and trusted configuration are uncompromised, while an agent may manipulate the proposed action, context, evidence, or requested policy version.Adversarial families test whether evidence quantity substitutes for typed sufficiency, low-authority text launders citations, favorable evidence masks contradictions, or tool substitution preserves risky side effects.Source: §4.4 · p. 9, Table 4 · p. 10

4.5 Service and regulation-grounded validation

  • Real-service checks exercise the public API, while the separate 150-case EU/Austria bank contains 50 cases in each of three domains and cites official EUR-Lex or Austrian RIS sources.Two independent blinded annotators agreed on all 150 cases; the constructed scenarios are not legal advice or authoritative, universally applicable regulatory interpretations.Source: §4.5 · pp. 10–11, Figure 3 · p. 10

4.6 Statistical treatment and artifact pipeline

  • Statistical treatment aggregates GovernBench metrics over independent seeds and uses paired seed-level comparisons; the human-reviewed set uses bootstrap intervals and paired McNemar tests with Holm–Bonferroni correction.The workflow keeps the synthetic study, API check, source audit, frozen predictions, and independent annotations distinct until reporting.Source: §4.6 · p. 11

5 Results

VeriWeave performs strongly on GovernBench, while ablations show complementary safety controls and the regulation-grounded comparison reveals a safety–utility trade-off. Service tests and human review further characterize how the system behaves in deployment and against human consensus.

5.1 Controlled benchmark

  • 0.9888 mean accuracy and 0.9836 macro-F1, with zero observed aggregate false allows and zero observed GASR, on the evaluated GovernBench cases.RBAC and ABAC have substantially higher unsafe-allow rates on synthetic cases that include evidence and review semantics they do not represent.Source: §5.1 · p. 12

5.2 Ablation: where safety comes from

  • Removing the evidence gate drops accuracy to 0.7127 and raises FAR to 0.2873 and GASR to 0.5715; other ablations also increase unsafe allows.Removing deny precedence yields 0.2115 FAR, while disabling the OOD fail-safe yields 0.1284 FAR and 0.1427 GASR; human review and temporal replay also materially reduce unsafe allows.Source: §5.2 · p. 12, Table 7 · p. 13

5.3 Evidence quality and real service behavior

  • The real API passed 12/12 scenarios and 40,040 additional HTTP evaluations with zero failures, while its persisted audit chain verified successfully.At concurrency four, measured throughput was 371.64 requests/s; the separate load matrix peaked at 413.55 requests/s at concurrency four and reached 368.97 requests/s at concurrency 32.Source: §5.3 · p. 13, Table 10 · p. 15, Table 9 · p. 15

5.4 Regulation-grounded source audit

  • The two blinded annotators agreed on all 150 cases, while Gemma 4 31B reached 0.9733 accuracy and VeriWeave, OPA, and Cedar each reached 0.8000 against their consensus.The deterministic engines' 30 errors were all consensus allow→review escalations; Gemma's four errors were one allow→review and three deny→review decisions.Source: §5.4 · pp. 13–14

5.5 Safety–utility decomposition

  • The comparison identifies a safety–utility trade-off: VeriWeave, OPA, and Cedar's discrepancies were allow→review escalations, while false allows can produce unauthorized side effects and reviews consume capacity.The suggested improvement path is greater policy specificity and evidence coverage, without weakening deny dominance, OOD fail-safe behavior, or typed evidence requirements.Source: §5.5 · pp. 14–15

6 Worked Runtime Cases and Comparator Protocol

Three API cases illustrate how evidence, accountability, and precedence produce distinct runtime outcomes. The comparator protocol uses normalized facts and equivalent policies for policy engines, while withholding answer-encoding information from the LLM baseline.

6.1 Three execution paths

  • Trusted evidence can support a narrow allow, but production deployment remains subject to human review even with valid supporting artifacts, and a matched deny takes precedence over review.An unknown operation cannot fall through to allow; the audit record preserves matched rules and reasons for the paths.Source: §6.1 · pp. 15–16, Table 11 · p. 16

6.2 Fair external-comparator protocol

  • The comparison gives OPA and Cedar normalized structured facts and equivalent versioned policies, while the LLM receives scenario facts and official-source summaries but not labels or answer-encoding metadata.All methods use the same frozen case identifiers, and deployment-path timings are descriptive rather than a controlled engine-speed comparison.Source: §6.2 · pp. 16–17, Table 13 · p. 17

7 Discussion

VeriWeave separates action generation from authorization through a deterministic, evidence-aware boundary, while review routes uncertainty and consequential actions to accountable human judgment. The discussion also outlines incremental deployment and policy-engineering practices, and bounds the findings by synthetic benchmarks, constructed legal cases, comparator configurations, calibration, scale, and security assumptions.

7 Discussion

  • A deterministic authorization boundary keeps agent action generation and side-effect approval in separate trust domains, while LLM outputs remain untrusted inputs.LLMs may assist with classification, retrieval, drafting, or explanation, but deterministic controls validate their outputs before authorization.Source: §7 · p. 17
  • Tri-state decisions send cases that cannot be safely decided automatically to review; ablations show removing review or OOD fail-safe behavior introduces unsafe allows.Evidence gating also prevents improved authorization outcomes through withheld, weakened, or laundered evidence.Source: §7 · p. 17
  • On the human-reviewed set, deterministic engines had zero observed false allows but a 0.2000 false-review rate; Gemma had 0.0267 false reviews and three deny-to-review errors.The discussion identifies reducing unnecessary escalation without weakening deny dominance or evidence gates as a tuning target.Source: §7 · p. 17

7.1 Deployment trust boundaries

  • Deployment separates an untrusted planner, authenticated context sources, a deterministic governance zone, and execution tools that act only on explicit governor outcomes.Shadow evaluation can reveal mismatches before selective enforcement activates narrow, well-understood allow and deny rules; consequential actions remain review-gated.Source: §7.1 · p. 18

7.2 Operational deployment lifecycle

  • The proposed lifecycle progresses from observation and shadow evaluation to selective and then broader enforcement, keeping audit schemas stable across phases.Review load, latency, and false-review rates are governance telemetry because excessive low-risk escalation can be operationally unsustainable.Source: §7.2 · p. 18

7.3 Policy-engineering implications

  • Policy engineering should keep prohibitions independent, specify evidence by type and provenance, version policy bundles, and treat repeated OOD reviews as a coverage signal.Counterfactual certificates expose which evidence or request changes alter decisions; VeriWeave can wrap OPA/Cedar evaluation with evidence, review, and audit semantics.Source: §7 · pp. 17–18, §7.3 · p. 18

7.4 Limitations and threats to validity

  • GovernBench uses a controlled grammar and oracle policy, so its gaps versus RBAC/ABAC establish benchmark behavior rather than universal superiority or full real-deployment ambiguity.The 150-case EU/Austria bank, based on a finite source snapshot and simplified facts, does not establish universal legal correctness or real-world regulatory effectiveness.Source: §7.4 · p. 19
  • OPA/Cedar findings depend on translated policies, Gemma findings on one model/run and frozen prompt, and evidence-trust scores are not well-calibrated probabilities (ECE 0.2253).Load results are hardware-specific; multi-instance scaling and protection against compromise of the governor host, trusted identity, signing keys, or policy repository remain outside the evaluated scope.Source: §7.4 · p. 19

8 Reproducibility

The reported artifact packages the implementation and evaluation workflow, while reproducibility requires freezing execution inputs and distinguishing reruns from historical replay.

8 Reproducibility

  • The released Python 3.13 artifact is VeriWeave Govern v0.4.0 and includes the benchmark generator, policies, calibration model, ablations, legal-source registry, and publication workflow.A single Compose pipeline completed the reported benchmark, API, legal-source, comparator, bootstrap, calibration, and load-matrix steps.Source: §8 · p. 19
  • Reproducible runs should freeze the Git commit, container and tool versions, policy hashes, thresholds, seeds, hardware, source date, predictions, and annotation-workbook hashes.Historical replay reconstructs a decision under its original policy and temporal semantics; re-execution tests the current implementation from frozen inputs.Source: §8 · p. 19
  • The repository is available as an open-source project at the VeriWeave Govern GitHub repository.The paper identifies it at https://github.com/vtavakkoli/veriweave-govern.git.Source: §8 · p. 19

9 Conclusion

VeriWeave combines deterministic evidence gating with replayable governance between autonomous planning and side-effecting execution. Its evaluations show strong safety outcomes alongside a measurable safety–utility trade-off, supporting independent policy enforcement that exposes this trade-off.

9 Conclusion

  • Across 60,000 controlled cases, VeriWeave records zero observed aggregate false allows and zero observed GASR; its deployed service also completes 40,040 requests with zero failures.Ablations indicate complementary contributions from evidence gating, deny precedence, OOD review, human accountability, and temporal replay.Source: §9 · p. 20
  • On the 150-case human-reviewed set, deterministic engines retain zero observed false allows but over-escalate 30 cases, while Gemma aligns more closely with consensus and makes three deny-to-review errors.The Gemma comparison lacks deterministic enforcement semantics.Source: §9 · p. 20
  • The paper concludes that authorization should expose and control the safety–utility trade-off through independent, evidence-aware, replayable policy enforcement.The conclusion frames deterministic evidence gating as a practical layer between autonomous planning and side-effecting execution.Source: §9 · p. 20

Related papers

Loading 2609.37457v1…