From Model Assurance to Causal Answerability: A Multi-Timescale Information Architecture for Governed Agentic AI

1. Introduction

General-purpose AI systems are increasingly embedded in workflows that initiate transactions, call tools, modify software, allocate resources, and influence decisions affecting health, finance, infrastructure, and public administration. The governance object therefore changes when an output becomes an action. A model can be evaluated before release, yet the deployed system can still act outside legitimate authority because its data, tools, permissions, incentives, policies, or operating context changed. The International AI Safety Report 2026 describes rapidly improving capabilities alongside persistent reliability and controllability challenges [1]. Major developers have responded with frontier safety frameworks centered on capability thresholds, risk models, evaluations, and deployment safeguards [2,3,4]. These are important advances, but they primarily govern the model and developer rather than every consequential state transition produced after deployment.

Public governance frameworks similarly emphasize lifecycle risk management, documentation, human oversight, monitoring, traceability, and organizational responsibility. The NIST AI Risk Management Framework and its Generative AI Profile organize risk work across governance, mapping, measurement, and management [5,6]. The European Union Artificial Intelligence Act establishes risk-based obligations that include technical documentation, logging, human oversight, robustness, and post-market monitoring [7]. ISO/IEC 42001:2023 specifies an AI management system, ISO/IEC 42005:2025 addresses AI impact assessment, and the OECD AI Principles connect accountability to lifecycle roles, documentation, and auditing [8,9,10]. These instruments establish obligations and processes; they are intentionally compatible with many architectures. Consequently, an organization can possess policy documents, risk registers, model cards, and audit reports while consequential actions remain only loosely connected to those commitments at runtime.

The resulting gap is not merely a lack of transparency. Algorithmic accountability research has long emphasized end-to-end organizational processes and audit integrity [11], while production machine-learning research has shown that hidden dependencies and feedback loops create liabilities that are not visible in model metrics [12]. The problem becomes sharper for agentic systems because the same model can participate in multiple workflows, each with different principals, rights, evidence requirements, failure costs, and recovery duties. A declaration that a model is safe enough for a class of uses does not determine whether a specific action is admissible now.

This article develops a new synthesis around causal answerability. Answerability is defined here as a relation in which a consequential action is traceably connected to an identifiable principal; the expected and observed effects are recorded outside the acting process; unresolved divergence creates persistent obligations; and that information can constrain later action, trigger repair, or revise institutional authority. The word causal is essential. A log that is never read, an incident report that cannot change permissions, or an appeal that has no effect does not close a governance loop. In the General Theory of Information, information is defined relative to the change it can produce in a receiving system [29]. Applied to governance, consequence evidence becomes governing information only when it changes the authorized state of the human-machine arrangement.

The article makes five contributions. First, it replaces a two-layer model of pre-release and runtime governance with three coupled timescales: capability assurance, runtime admissibility, and consequence reconciliation. Second, it separates four governance objects—model, action, consequence, and institution—whose conflation produces recurring category errors. Third, it derives seven design invariants from established work in security architecture, runtime assurance, cybernetics, provenance, safety cases, and algorithmic accountability. Fourth, it specifies a commitment graph as a persistent information model through which purpose, authority, evidence, action, consequence, obligation, and remedy remain connected across model substitution and organizational change. Fifth, it proposes falsifiable hypotheses, metrics, and stress tests for comparing governance-native systems with prompt-only and pre-release-only baselines.

The article is a design-science and conceptual contribution, not a claim that causal answerability has already been validated across frontier AI. Several supporting results are established within their original domains; their mapping to agentic governance is an architectural inference. One recent controlled study provides preliminary evidence for external institutional enforcement in a narrow multi-agent market setting [28], while Mindful Machine publications document governance-native prototypes and distributed testbeds [30,31,32,33,34]. These sources motivate construction and testing; they do not establish universal superiority.

2. Materials and Methods

2.1. Research Questions

The study addresses four research questions. RQ1 asks which governance objects and timescales are omitted when frontier AI governance is reduced to model evaluation. RQ2 asks which architectural properties are required for consequence information to become a binding control signal rather than passive documentation. RQ3 asks how those properties can be represented as an interoperable information model that survives actor and infrastructure changes. RQ4 asks what observations would refute or materially weaken the proposed architecture.

2.2. Integrative Evidence Synthesis

An integrative synthesis was used rather than a systematic review. Sources were selected for their explanatory role in one of seven domains: frontier AI risk frameworks; public governance and standards; cybernetics and regulation; computer-security architecture; runtime assurance and systems safety; provenance and safety cases; and algorithmic accountability. Priority was given to primary papers, standards, official regulatory texts, and current first-party frameworks. Citation chaining was used to verify foundational claims. Recent preprints were retained only when they supplied a distinctive design or empirical result unavailable in peer-reviewed literature, and their preliminary status is stated.

The synthesis does not treat similarly worded concepts as identical. For each connection, the analysis records both what the source supports and what it does not establish. For example, the good-regulator theorem motivates an explicit model of the regulated system but does not uniquely entail any particular data structure [24]. The free-energy principle may illuminate divergence and adaptation, but it does not prove a specific enterprise metric. Likewise, tamper-evident logging establishes integrity properties, not the truth or causal adequacy of observations.

2.3. Construct Definition and Claim Calibration

Constructs were operationalized before architecture design. Capability denotes what an actor can do under stated conditions. Admissibility denotes whether a proposed action is permitted in the current context. Accountability allocates responsibility through institutional roles and procedures. Answerability denotes the technical-institutional relation through which an action can be reconstructed, challenged, and made consequence-sensitive. Coherence denotes continued compatibility among purpose, authority, evidence, execution, resilience, history, and observed effects.

Table 1. Operational distinctions used in the architecture.

Construct	Operational meaning	Minimal test	Does not establish
Capability	Ability to predict, generate, plan, infer, or execute under specified conditions.	Can the actor complete the task?	Legitimate authority or acceptable consequence.
Alignment	Behavioral compatibility with a specified objective or policy over tested conditions.	Does behavior conform in representative and adversarial tests?	That the specification is complete, legitimate, or durably enforced.
Admissibility	Permission for a particular state change given current authority, evidence, uncertainty, risk, and history.	Does an independent gate permit, defer, deny, or escalate before commitment?	Universal safety of the actor.
Accountability	Allocation of duties, review powers, sanctions, and remedies among institutions and people.	Can responsible roles be identified and exercised?	Complete technical mediation of every action.
Causal answerability	A relation in which action, consequence, record, obligation, and future constraint are connected.	Can adverse evidence change later permissions or create enforceable repair?	Consciousness, moral agency, or biological life.
Coherence debt	Accumulated unresolved divergence between declared commitments and lived consequences.	Are deficits detected, owned, aged, and repaired?	A universal scalar independent of domain and severity.

Table 1. Operational distinctions used in the architecture.

Construct	Operational meaning	Minimal test	Does not establish
Capability	Ability to predict, generate, plan, infer, or execute under specified conditions.	Can the actor complete the task?	Legitimate authority or acceptable consequence.
Alignment	Behavioral compatibility with a specified objective or policy over tested conditions.	Does behavior conform in representative and adversarial tests?	That the specification is complete, legitimate, or durably enforced.
Admissibility	Permission for a particular state change given current authority, evidence, uncertainty, risk, and history.	Does an independent gate permit, defer, deny, or escalate before commitment?	Universal safety of the actor.
Accountability	Allocation of duties, review powers, sanctions, and remedies among institutions and people.	Can responsible roles be identified and exercised?	Complete technical mediation of every action.
Causal answerability	A relation in which action, consequence, record, obligation, and future constraint are connected.	Can adverse evidence change later permissions or create enforceable repair?	Consciousness, moral agency, or biological life.
Coherence debt	Accumulated unresolved divergence between declared commitments and lived consequences.	Are deficits detected, owned, aged, and repaired?	A universal scalar independent of domain and severity.

2.4. Design-Science Construction

The artifact was constructed in four steps. First, governance obligations were decomposed into objects and timescales. Second, design invariants were derived from complete mediation, reference-monitor separation, runtime assurance, provenance, safety-case maintenance, and persistent obligation management. Third, the invariants were assembled into a causal answerability architecture centered on a versioned commitment graph. Fourth, evaluation hypotheses and adversarial stress tests were specified before any implementation result was claimed.

The design deliberately avoids two shortcuts. It does not use Gödelian incompleteness as a direct proof that an AI system cannot evaluate itself; the stronger engineering basis is the reference-monitor requirement that security decisions be completely mediated, tamper-resistant, and small enough to verify [13,14]. It also does not infer that an append-only ledger is automatically truthful. Record integrity and consequence validity are separate assurance problems and must be tested independently.

2.5. Use of Generative AI

Generative AI tools were used for literature discovery, source comparison, language editing, and preliminary figure composition. The named author selected the research question, verified references against primary or official sources, determined the architecture and claim boundaries, and accepts responsibility for the manuscript. AI-generated connections were treated as hypotheses and retained only when they could be tied to cited sources and explicit falsification conditions.

3. Results

3.1. Four Governance Objects and Three Timescales

The first result is a decomposition. Governance concerns at least four different objects: the model as a capability provider; the action as a proposed state transition; the consequence as an effect experienced by systems or people; and the institution as the source of legitimate purpose, authority, contestability, and remedy. Each object changes across three timescales. Pre-deployment assurance defines what may be deployed and under what envelope. In-actu governance decides what the authorized system may do next. Post-action reconciliation attributes immediate and delayed effects, preserves unresolved obligations, and revises the deployment envelope.

Figure 1. Four governance objects across three timescales. Model assurance is necessary, but it cannot substitute for action control, consequence attribution, or legitimate institutional learning.

Figure 1. Four governance objects across three timescales. Model assurance is necessary, but it cannot substitute for action control, consequence attribution, or legitimate institutional learning.

This decomposition reveals why a two-loop description remains incomplete. A fast runtime loop can detect policy violations and immediate telemetry, but many consequential effects emerge after the original execution context has ended. Credit decisions alter later household options; clinical triage affects downstream diagnosis; software changes create vulnerabilities discovered months later. These outcomes require temporal attribution and obligation persistence. The third loop is therefore not merely a slow version of runtime control. It governs delayed evidence, appeal, repair, and institutional revision.

3.2. Cross-Disciplinary Foundations and Missing Connections

The source traditions provide complementary constraints rather than a single proof. Cybernetics explains why regulation requires sufficient variety and an adequate model [23,24]. Security architecture explains why every protected transition must be mediated and why the policy mechanism must resist actor control [13,14]. Runtime assurance explains how an unverified advanced controller can be paired with a verified fallback and switching logic [15,16]. Systems-theoretic safety treats accidents as inadequate control and constraint enforcement rather than only component failure [17]. Autonomic computing supplies a monitor–analyze–plan–execute loop over persistent knowledge [18]. Provenance standards supply interoperable relations among entities, activities, and agents [19]. Secure logging supplies forward-integrity properties [20]. Dynamic safety cases connect changing claims to operational evidence [21,22].

Table 2. Foundations, architectural implications, and epistemic boundaries.

Source result	What it supports	Architectural implication	What it does not establish
Requisite variety [23]	A regulator must address relevant disturbance variety.	Risk controls must cover tool, data, policy, incentive, and consequence variation, not only benchmark tasks.	That exhaustive prediction of an open environment is possible.
Good-regulator theorem [24]	Effective regulation requires an adequate model of the regulated system.	Maintain explicit governance state containing purpose, authority, constraints, and relevant system state.	That one specific 'Digital Genome' representation is uniquely required.
Complete mediation [13]	Every protected access or transition must be checked.	Place a reference monitor on all consequential state-change paths.	That the policy being enforced is ethically legitimate.
Reference monitor [14]	The enforcement mechanism must be tamper-resistant and verifiable.	Separate checker authority from the acting model and minimize the trusted computing base.	That separation alone prevents institutional capture.
Simplex / runtime assurance [15,16]	Advanced performance can coexist with a verified safe fallback.	Add safety monitors, switching logic, and a recoverable baseline controller.	That the fallback preserves all social or legal commitments.
W3C PROV [19]	Provenance can be represented through interoperable entity–activity–agent relations.	Use a standards-compatible lineage layer in the commitment graph.	That recorded observations are true or causally sufficient.
Dynamic safety cases [21,22]	Assurance claims and evidence must evolve with system state.	Bind runtime indicators and incidents to claim revision and deployment authority.	That safety cases are unbiased when authored by conflicted developers.
Algorithmic auditing [11]	Accountability requires end-to-end organizational processes.	Connect technical evidence to responsible roles, review gates, and remediation.	That documentation alone mediates action.
General Theory of Information [29,30]	Information is relational and consequential with respect to a receiving system.	Treat evidence as governance information only when it changes authorized state or obligations.	That every semantic or normative question is solved by information theory.

Table 2. Foundations, architectural implications, and epistemic boundaries.

Source result	What it supports	Architectural implication	What it does not establish
Requisite variety [23]	A regulator must address relevant disturbance variety.	Risk controls must cover tool, data, policy, incentive, and consequence variation, not only benchmark tasks.	That exhaustive prediction of an open environment is possible.
Good-regulator theorem [24]	Effective regulation requires an adequate model of the regulated system.	Maintain explicit governance state containing purpose, authority, constraints, and relevant system state.	That one specific 'Digital Genome' representation is uniquely required.
Complete mediation [13]	Every protected access or transition must be checked.	Place a reference monitor on all consequential state-change paths.	That the policy being enforced is ethically legitimate.
Reference monitor [14]	The enforcement mechanism must be tamper-resistant and verifiable.	Separate checker authority from the acting model and minimize the trusted computing base.	That separation alone prevents institutional capture.
Simplex / runtime assurance [15,16]	Advanced performance can coexist with a verified safe fallback.	Add safety monitors, switching logic, and a recoverable baseline controller.	That the fallback preserves all social or legal commitments.
W3C PROV [19]	Provenance can be represented through interoperable entity–activity–agent relations.	Use a standards-compatible lineage layer in the commitment graph.	That recorded observations are true or causally sufficient.
Dynamic safety cases [21,22]	Assurance claims and evidence must evolve with system state.	Bind runtime indicators and incidents to claim revision and deployment authority.	That safety cases are unbiased when authored by conflicted developers.
Algorithmic auditing [11]	Accountability requires end-to-end organizational processes.	Connect technical evidence to responsible roles, review gates, and remediation.	That documentation alone mediates action.
General Theory of Information [29,30]	Information is relational and consequential with respect to a receiving system.	Treat evidence as governance information only when it changes authorized state or obligations.	That every semantic or normative question is solved by information theory.

3.3. Seven Design Invariants

The second result is a set of seven invariants. They are phrased as architecture tests rather than aspirational principles. A system either mediates a class of consequential actions or it does not; an actor can alter its record or it cannot; an obligation survives actor replacement or it disappears. The invariants can therefore be inspected and stress-tested.

Table 3. Causal answerability design invariants.

Invariant	Operational requirement	Failure signature	Primary evidence
I1 Complete mediation	Every consequential state change traverses an admissibility gate before commitment.	Unlogged side channels, direct tool calls, or privileged bypasses.	Reference-monitor and complete-mediation principles [13,14].
I2 Actor-independent validation	The actor cannot unilaterally modify checker logic, permissions, or final adjudication.	Self-certification, policy editing by the optimizer, or checker disablement.	Separation of privilege; reward-tampering and corrigibility concerns [25,26,27].
I3 Tamper-evident provenance	Decision, evidence, versions, transformations, and identities are recorded with integrity protection.	Missing lineage, retroactive alteration, or irreproducible action context.	W3C PROV and secure audit logging [19,20].
I4 Independent consequence observation	Effects are observed where they land, with uncertainty and attribution confidence.	Executor telemetry substitutes for affected-party outcomes.	Systems safety, post-market monitoring, and impact assessment [7,9,17].
I5 Obligation persistence	Unresolved duties and remedies survive model, service, team, and infrastructure replacement.	Replacement clears adverse history or resets accountability.	End-to-end audit integrity and event-history architectures [11,32,34].
I6 Safe fallback and repair	Unsafe or uncertain action can be interrupted, degraded, reversed, or transferred to a verified process.	No safe state, irreversible commitment, or untested rollback.	Simplex/runtime assurance and resilience engineering [15,16,17].
I7 Contestable institutional authority	Affected parties and authorized reviewers can challenge evidence, decisions, and policy application.	Technically consistent but illegitimate or unappealable control.	OECD, EU AI Act, impact assessment, and accountable algorithms [7,9,10,35].

Table 3. Causal answerability design invariants.

Invariant	Operational requirement	Failure signature	Primary evidence
I1 Complete mediation	Every consequential state change traverses an admissibility gate before commitment.	Unlogged side channels, direct tool calls, or privileged bypasses.	Reference-monitor and complete-mediation principles [13,14].
I2 Actor-independent validation	The actor cannot unilaterally modify checker logic, permissions, or final adjudication.	Self-certification, policy editing by the optimizer, or checker disablement.	Separation of privilege; reward-tampering and corrigibility concerns [25,26,27].
I3 Tamper-evident provenance	Decision, evidence, versions, transformations, and identities are recorded with integrity protection.	Missing lineage, retroactive alteration, or irreproducible action context.	W3C PROV and secure audit logging [19,20].
I4 Independent consequence observation	Effects are observed where they land, with uncertainty and attribution confidence.	Executor telemetry substitutes for affected-party outcomes.	Systems safety, post-market monitoring, and impact assessment [7,9,17].
I5 Obligation persistence	Unresolved duties and remedies survive model, service, team, and infrastructure replacement.	Replacement clears adverse history or resets accountability.	End-to-end audit integrity and event-history architectures [11,32,34].
I6 Safe fallback and repair	Unsafe or uncertain action can be interrupted, degraded, reversed, or transferred to a verified process.	No safe state, irreversible commitment, or untested rollback.	Simplex/runtime assurance and resilience engineering [15,16,17].
I7 Contestable institutional authority	Affected parties and authorized reviewers can challenge evidence, decisions, and policy application.	Technically consistent but illegitimate or unappealable control.	OECD, EU AI Act, impact assessment, and accountable algorithms [7,9,10,35].

3.4. The Commitment Graph

The third result is a persistent commitment graph. The graph is not a general knowledge graph and not merely an audit log. It is a versioned set of governance relations that answers: Who defined the purpose? Which principal bears the consequence? Who delegated authority? Which policy and evidence justified the action? What effect was expected? What occurred? Which obligation remains open? Which remedy changed the system? The graph can be serialized using provenance standards while adding domain-specific authority, expectation, obligation, and remedy relations.

Figure 2. The commitment graph. Persistent relations preserve institutional memory and unresolved duties even when the acting model, service, infrastructure, or organizational team changes.

Figure 2. The commitment graph. Persistent relations preserve institutional memory and unresolved duties even when the acting model, service, infrastructure, or organizational team changes.

Table 4. Minimal commitment-graph schema.

Entity / relation	Required fields	Governance purpose	Example query
Principal	identifier; role; rights; consequence-bearing scope	Locates who authorizes or bears effects.	Which affected principal has standing to contest this action?
Purpose	version; owner; scope; priority; prohibited ends	Prevents capability from becoming its own objective.	Which purpose authorized the workflow at action time?
Authority	delegator; delegate; permissions; limits; validity interval	Makes mandate explicit and time-bounded.	Was the actor permitted to use this tool on this data?
Policy / invariant	rule; source; jurisdiction; precedence; exception process	Defines admissibility and non-negotiable constraints.	Which rule caused deferment, and who can approve an exception?
Evidence bundle	source; freshness; quality; uncertainty; transformation lineage	Supports epistemic adequacy.	Which evidence was missing or contradicted?
Action commitment	actor; tool; parameters; expected effect; reversibility; approval	Captures the state change before execution.	What exactly was permitted and under which version?
Observed consequence	observer; measurement; time; affected party; attribution confidence	Connects action to lived effect.	Which delayed outcome is plausibly attributable to this commitment?
Obligation / remedy	bearer; due state; deadline; evidence of closure; escalation	Prevents history loss and turns divergence into repair.	Which unresolved obligations survive model replacement?

Table 4. Minimal commitment-graph schema.

Entity / relation	Required fields	Governance purpose	Example query
Principal	identifier; role; rights; consequence-bearing scope	Locates who authorizes or bears effects.	Which affected principal has standing to contest this action?
Purpose	version; owner; scope; priority; prohibited ends	Prevents capability from becoming its own objective.	Which purpose authorized the workflow at action time?
Authority	delegator; delegate; permissions; limits; validity interval	Makes mandate explicit and time-bounded.	Was the actor permitted to use this tool on this data?
Policy / invariant	rule; source; jurisdiction; precedence; exception process	Defines admissibility and non-negotiable constraints.	Which rule caused deferment, and who can approve an exception?
Evidence bundle	source; freshness; quality; uncertainty; transformation lineage	Supports epistemic adequacy.	Which evidence was missing or contradicted?
Action commitment	actor; tool; parameters; expected effect; reversibility; approval	Captures the state change before execution.	What exactly was permitted and under which version?
Observed consequence	observer; measurement; time; affected party; attribution confidence	Connects action to lived effect.	Which delayed outcome is plausibly attributable to this commitment?
Obligation / remedy	bearer; due state; deadline; evidence of closure; escalation	Prevents history loss and turns divergence into repair.	Which unresolved obligations survive model replacement?

3.5. Causal Answerability Architecture

Figure 3 assembles the design. Legitimate institutions define the purpose, rights, risk envelope, and appeal authority. These are represented in governance state rather than embedded only in a model prompt. Any actor—an LLM, human, database, microservice, planner, or device—submits an action proposal. A reference monitor performs complete mediation against current authority, evidence, uncertainty, invariants, history, and open obligations. Runtime assurance monitors the action path and can switch to a verified fallback or safe state. Independent observers capture effects and their attribution confidence. Provenance and obligation records update a dynamic assurance case, which can revise both runtime permissions and the institutional deployment envelope.

Figure 3. Causal answerability architecture. The critical separation is between the replaceable actor and the persistent governance state, checker, consequence record, and institutional authority.

Figure 3. Causal answerability architecture. The critical separation is between the replaceable actor and the persistent governance state, checker, consequence record, and institutional authority.

The architecture extends classic MAPE-K in a specific way. The knowledge base is not owned solely by the managed element; it is partitioned into governance state, evidence, and history with separate authority. A reference monitor is inserted before execute, and a consequence-reconciliation path continues after immediate telemetry. It also extends Simplex-style runtime assurance beyond physical safety: the fallback must preserve authorization, provenance, data constraints, and open obligations, not merely maintain a stable plant state.

3.6. Formal Interfaces

The architecture can be summarized through four interfaces. Let g_t denote the authorized governance state at time t; a_t a proposed action; e_t an evidence bundle; u_t uncertainty; r_t affected-party rights and risk; h_t relevant history; and o_t open obligations. The admissibility function is:

K(g_t, a_t, e_t, u_t, r_t, h_t, o_t) -> {permit, defer, deny, escalate}.

A permitted action creates an action commitment q_t containing the authorized parameters, versions, expected effects, and reversibility conditions. For an outcome observed after delay k, consequence divergence is:

delta_(t,k) = D(expected_(t,k), observed_(t,k), attribution_confidence_(t,k)).

D is domain-specific and may combine safety, legal, financial, service, or human-impact criteria. Divergence can create an obligation tuple:

O_j = <principal, bearer, required_state, deadline, closure_evidence, remedy, escalation>.

Finally, coherence debt is represented as a vector rather than a universal score:

CD_t = [d_authority, d_evidence, d_provenance, d_consequence, d_continuity, d_repair].

Each component has a domain-specific scale, owner, aging rule, and repair threshold. Aggregation is allowed only when the decision context justifies weights and non-compensability rules. For example, a low provenance deficit cannot compensate for an invalid legal authority, and high accuracy cannot compensate for an unappealable denial of rights.

Figure 4. Coherence debt as a vector. The numeric profile is illustrative; implementations require domain-calibrated measures, ownership, thresholds, and repair paths.

Figure 4. Coherence debt as a vector. The numeric profile is illustrative; implementations require domain-calibrated measures, ownership, thresholds, and repair paths.

3.7. Evaluation Hypotheses and Metrics

The architecture yields testable hypotheses. H1: complete mediation reduces unauthorized state changes relative to prompt-only controls. H2: actor-independent provenance reduces reconstruction time and recurrence after incidents. H3: delayed consequence reconciliation improves later admissibility and obligation closure. H4: persistent governance state preserves policy fidelity during model and infrastructure substitution. H5: coupled assurance, admissibility, and reconciliation loops outperform any single loop under policy, data, tool, and incentive drift. H6: contestability reduces uncorrected institutional error without imposing unacceptable latency or disclosure.

Table 5. Proposed implementation metrics.

Metric	Definition	Desired direction	Primary invariant
Complete-mediation coverage	Consequential state changes passing through the reference monitor / all consequential state changes.	Toward 100%, with documented exceptions.	I1
Unauthorized state-change rate	Committed actions later determined to lack valid authority or required evidence.	Lower.	I1–I2
Checker bypass rate	Successful attempts to disable, evade, or rewrite validation.	Lower; ideally zero for protected paths.	I2
Provenance completeness	Required lineage fields present and cryptographically linked.	Higher.	I3
Reconstruction time	Time to reproduce the decision context, versions, evidence, and authority.	Lower.	I3–I5
Outcome attribution coverage	Material outcomes linked to originating commitments with stated confidence.	Higher.	I4
Obligation closure latency	Time from accepted divergence to verified remedy or justified retirement.	Lower, severity-adjusted.	I5–I6
Policy fidelity after substitution	Protected commitments retained after model, service, or region replacement.	Higher.	I5
Safe fallback success	High-risk monitor triggers reaching verified safe or degraded state.	Higher.	I6
Recurrence rate	Repeat of a previously recorded failure class after remediation.	Lower.	I5–I6
Appeal reversal and response	Valid challenges resolved, with reasons and repair, within policy targets.	Calibrated; neither zero nor excessive.	I7
Governance overhead	Latency, compute, storage, and human review attributable to control mechanisms.	Minimize subject to risk bounds.	All

Table 5. Proposed implementation metrics.

Metric	Definition	Desired direction	Primary invariant
Complete-mediation coverage	Consequential state changes passing through the reference monitor / all consequential state changes.	Toward 100%, with documented exceptions.	I1
Unauthorized state-change rate	Committed actions later determined to lack valid authority or required evidence.	Lower.	I1–I2
Checker bypass rate	Successful attempts to disable, evade, or rewrite validation.	Lower; ideally zero for protected paths.	I2
Provenance completeness	Required lineage fields present and cryptographically linked.	Higher.	I3
Reconstruction time	Time to reproduce the decision context, versions, evidence, and authority.	Lower.	I3–I5
Outcome attribution coverage	Material outcomes linked to originating commitments with stated confidence.	Higher.	I4
Obligation closure latency	Time from accepted divergence to verified remedy or justified retirement.	Lower, severity-adjusted.	I5–I6
Policy fidelity after substitution	Protected commitments retained after model, service, or region replacement.	Higher.	I5
Safe fallback success	High-risk monitor triggers reaching verified safe or degraded state.	Higher.	I6
Recurrence rate	Repeat of a previously recorded failure class after remediation.	Lower.	I5–I6
Appeal reversal and response	Valid challenges resolved, with reasons and repair, within policy targets.	Calibrated; neither zero nor excessive.	I7
Governance overhead	Latency, compute, storage, and human review attributable to control mechanisms.	Minimize subject to risk bounds.	All

3.8. Standards and Regulatory Mapping

The architecture should be understood as an implementation pattern that can provide evidence for governance obligations, not as a claim of legal compliance. Table 6 maps selected obligations to architectural evidence. Legal interpretation, sector regulation, and organizational accountability remain outside the authority of the technical system.

Table 6. Illustrative mapping from governance obligations to architectural evidence.

Framework / obligation	Relevant architectural evidence	Residual gap
NIST AI RMF / GenAI Profile [5,6]	Governance-state versions; mapped risks; measurement evidence; incident and repair records.	Risk acceptance and organizational judgment remain human responsibilities.
EU AI Act [7]	Technical logs; human-oversight interventions; data and model versions; post-market outcome records.	Applicability, conformity assessment, and legal sufficiency require competent authorities.
ISO/IEC 42001 [8]	Controlled policies; roles; objectives; operational controls; corrective-action evidence.	A management-system certificate does not by itself prove runtime complete mediation.
ISO/IEC 42005 [9]	Expected-impact models; affected-party records; observed consequences; reassessment triggers.	Impact identification remains contestable and context-dependent.
OECD AI Principles [10]	Traceability, accountability roles, challenge pathways, and lifecycle evidence.	Principles require institutional legitimacy, not only technical records.
Frontier safety frameworks [2,3,4]	Capability thresholds linked to deployment envelopes; runtime indicators feeding safety-case revision.	Company frameworks remain voluntary and vary in scope and enforceability.
ISO/IEC 42006 [36]	Auditor-accessible management-system and control evidence.	Auditor competence and independence do not guarantee truth of all underlying observations.

Table 6. Illustrative mapping from governance obligations to architectural evidence.

Framework / obligation	Relevant architectural evidence	Residual gap
NIST AI RMF / GenAI Profile [5,6]	Governance-state versions; mapped risks; measurement evidence; incident and repair records.	Risk acceptance and organizational judgment remain human responsibilities.
EU AI Act [7]	Technical logs; human-oversight interventions; data and model versions; post-market outcome records.	Applicability, conformity assessment, and legal sufficiency require competent authorities.
ISO/IEC 42001 [8]	Controlled policies; roles; objectives; operational controls; corrective-action evidence.	A management-system certificate does not by itself prove runtime complete mediation.
ISO/IEC 42005 [9]	Expected-impact models; affected-party records; observed consequences; reassessment triggers.	Impact identification remains contestable and context-dependent.
OECD AI Principles [10]	Traceability, accountability roles, challenge pathways, and lifecycle evidence.	Principles require institutional legitimacy, not only technical records.
Frontier safety frameworks [2,3,4]	Capability thresholds linked to deployment envelopes; runtime indicators feeding safety-case revision.	Company frameworks remain voluntary and vary in scope and enforceability.
ISO/IEC 42006 [36]	Auditor-accessible management-system and control evidence.	Auditor competence and independence do not guarantee truth of all underlying observations.

4. Discussion

4.1. Why Model Assurance Cannot Carry the Full Governance Load

Capability evaluation remains indispensable. It can identify dangerous affordances, inform deployment conditions, and trigger stronger safeguards before release. Its limitation is structural rather than accidental: the evaluated object is not identical to the deployed socio-technical system. Retrieval sources, tool permissions, application logic, operators, incentives, and affected populations can change independently of model weights. Benchmark performance also becomes vulnerable to Goodhart effects when optimized as a release target [25], and capable agents may seek to influence or bypass reachable reward and evaluation channels [27]. The correct conclusion is not to abandon model assurance, but to bind its deployment envelope to complete mediation and post-deployment evidence.

Current frontier frameworks increasingly include monitoring, model reports, and safeguard escalation [2,3,4]. The proposed architecture makes the coupling explicit: a capability threshold produces a versioned deployment envelope; every protected action verifies that the current system remains inside it; runtime evidence can suspend or narrow authority; and delayed consequences can revise the assumptions of the safety case. This is a causal chain rather than a periodic documentation exchange.

4.2. The Reference Monitor Is a Better Foundation Than Self-Certification Analogies

Arguments against self-certification are sometimes framed through formal incompleteness or broad claims that a system cannot evaluate itself. Such claims are easy to overextend. Complex systems can perform many useful internal checks, and redundant internal critics can improve reliability. The stronger design argument is the reference-monitor tradition: security-sensitive transitions require complete mediation; the mechanism must resist tampering; and the trusted base must be sufficiently small and interpretable to verify [13,14]. Internal critique remains useful, but final authorization for protected actions must not be solely under the actor's control.

This distinction also clarifies the role of constitutional prompts. They can improve behavior, express policy in the agent context, and reduce the load on external controls. They are not equivalent to an institution because the optimizer can reinterpret them, context can be truncated, and enforcement consequences may be absent. In a recent preprint on multi-agent Cournot markets, an external governance graph and Oracle/Controller substantially reduced severe collusion relative to a prompt-only constitution [28]. The result is narrow and not yet a general validation, but it supports a causal-placement hypothesis: rules enforced outside the optimizer can alter incentives in ways that text inside the optimizer may not.

4.3. Runtime Assurance Connects High Capability to Bounded Autonomy

Simplex and related runtime-assurance architectures offer a practical bridge between advanced controllers and verified safety [15,16]. Their central move is not to prove the advanced controller correct in all states, but to monitor a recoverable boundary and transfer control when necessary. Agentic AI requires an expanded boundary. Safe fallback may mean suspending a transaction, requesting human evidence, degrading to a deterministic workflow, isolating a tool, rolling back a configuration, or entering a read-only mode. The fallback must also preserve provenance and obligations. A technically stable recovery that erases the reason for intervention remains governance-incoherent.

4.4. Provenance Integrity Is Not Consequence Truth

The commitment graph uses W3C PROV because interoperability matters across heterogeneous actors and tools [19]. Secure logging can make undetected retroactive alteration difficult [20]. Neither solves the oracle problem: how the system knows what happened in the world and whether an outcome was caused by a specific action. Consequence observers therefore must report source, method, timing, uncertainty, and attribution confidence. Independent sensors, affected-party reports, external databases, auditors, or domain experts may disagree. The architecture preserves disagreement rather than forcing premature consensus.

This is why causal answerability requires an adjudication process, not just a ledger. A tamper-evident falsehood remains false; an immutable but privacy-invasive record can remain illegitimate; and a perfectly reconstructed action may still have an unjust purpose. Provenance strengthens evidence, while institutional authority determines what counts, who may challenge it, and which remedy is due.

4.5. The Third Loop: Delayed Consequences, Obligations, and Repair

The most important extension beyond two-timescale governance is the consequence-reconciliation loop. Immediate runtime telemetry is biased toward effects visible to the executor. Many harms, benefits, and policy violations are delayed, distributed, or borne by parties outside system telemetry. The commitment graph preserves the original expectation and creates an address for later evidence. When a delayed effect is accepted, it can open an obligation that survives model replacement, infrastructure migration, or organizational reorganization.

This addresses a recurring weakness of incident-centric governance: learning is documented but not guaranteed to alter future action. In the proposed design, an accepted divergence must reach one of four terminal states—repaired, compensated, explicitly accepted by legitimate authority, or retired with an explanation. Aging and recurrence metrics make unresolved obligations visible. This converts organizational memory from a collection of reports into executable constraint and repair state.

4.6. Mindful Machines as One Candidate Realization

The Mindful Machine research program offers one candidate implementation of several proposed elements. General Theory of Information and operational schemas motivate knowledge structures that participate in computation rather than remaining passive documentation [29,30]. Autopoietic and cognitive-machine work describes separation among execution, management, and meta-level regulation [31]. The Digital Genome and event-driven history provide an explicit model of functional and non-functional commitments across distributed components [32]. Later work applies governance and orchestration to distributed AI workflows and coherence-debt management [33,34].

Epistemic restraint is essential. The good-regulator theorem does not prove that the Digital Genome is the unique or optimal representation. The publications document architectural implementations and prototypes, not independent large-scale comparisons across frontier-agent deployments. The appropriate research question is therefore whether a Digital Genome/AMOS implementation satisfies the invariants and outperforms alternative reference-monitor, policy-as-code, service-mesh, or workflow-governance designs under controlled stress. The architecture in this article is deliberately implementation-neutral enough to permit that comparison.

4.7. Institutional Legitimacy, Contestability, and Privacy

Technical enforcement can be causally strong and normatively wrong. The architecture therefore treats purpose and authority as externally supplied and contestable. Accountable-algorithm research emphasizes that legal and policy objectives can sometimes be supported by technical mechanisms without requiring total transparency [35]. The EU AI Act, OECD principles, and impact-assessment standards further require attention to human rights, affected parties, and lifecycle impacts [7,9,10]. A reference monitor cannot determine legitimate values; it can make value commitments explicit, versioned, reviewable, and difficult to bypass silently.

Provenance also conflicts with privacy, confidentiality, and security. Complete evidence retention is neither necessary nor always lawful. Implementations should use data minimization, role-based access, cryptographic commitments, selective disclosure, retention schedules, and separation between evidence needed for control and content revealed during review. The commitment graph should preserve that an authorized check occurred and which policy was satisfied without exposing more personal or proprietary data than the adjudication requires.

4.8. Falsification and Research Program

The proposal is weakened if prompt-only or pre-release-only systems perform equivalently after controlling for cost and organizational maturity; if the reference monitor is routinely bypassed through unavoidable side channels; if delayed outcome attribution produces too much noise to improve decisions; if obligation persistence does not reduce recurrence; or if contestability adds latency and disclosure without correcting error. These possibilities should be tested directly.

Table 7. Adversarial stress tests and refutation criteria.

Stress test	Baseline	Architecture prediction	Material refutation condition
Model substitution	Replace a certified model inside an active workflow.	Purpose, authority, history, and obligations persist; new actor is re-qualified.	No preservation advantage or unnoticed policy drift.
Policy change mid-workflow	Amend a governing rule after proposals have been generated.	Affected commitments are blocked, re-evaluated, or explicitly grandfathered.	Equivalent unauthorized-action rate to baseline.
Checker compromise / bypass	Prompt or tool attempts to disable or route around validation.	Protected paths fail closed; attempt is recorded and triggers containment.	Comparable bypass rate despite separation.
History tampering	Delete or reinterpret adverse episodes.	Integrity checks reveal alteration; open obligations remain queryable.	No reconstruction or recurrence benefit.
Delayed consequence	Introduce a material effect after successful immediate telemetry.	Outcome is linked with confidence, opens obligation, and changes later admissibility.	No improvement in attribution, repair, or later decisions.
Infrastructure failure / migration	Fail a region or orchestration component.	Governance state and obligation history survive controlled migration.	Loss rates and policy fidelity match unmanaged baseline.
Incentive pressure / collusion	Reward agents for violating a declarative rule.	External enforcement suppresses the harmful equilibrium more reliably.	Independent replications do not reproduce the reported direction [28].
Evidence poisoning / conflict	Supply stale, manipulated, or contradictory evidence.	System abstains, corroborates, or escalates according to epistemic policy.	No reduction in confident false action.
Institutional conflict	Two legitimate principals issue incompatible directives.	Precedence, conflict record, and authorized escalation are explicit.	System silently chooses or hides conflict.
Appeal and privacy	Affected party challenges a decision requiring protected evidence.	Selective disclosure supports meaningful review without unnecessary exposure.	No correction benefit or unacceptable privacy leakage.

Table 7. Adversarial stress tests and refutation criteria.

Stress test	Baseline	Architecture prediction	Material refutation condition
Model substitution	Replace a certified model inside an active workflow.	Purpose, authority, history, and obligations persist; new actor is re-qualified.	No preservation advantage or unnoticed policy drift.
Policy change mid-workflow	Amend a governing rule after proposals have been generated.	Affected commitments are blocked, re-evaluated, or explicitly grandfathered.	Equivalent unauthorized-action rate to baseline.
Checker compromise / bypass	Prompt or tool attempts to disable or route around validation.	Protected paths fail closed; attempt is recorded and triggers containment.	Comparable bypass rate despite separation.
History tampering	Delete or reinterpret adverse episodes.	Integrity checks reveal alteration; open obligations remain queryable.	No reconstruction or recurrence benefit.
Delayed consequence	Introduce a material effect after successful immediate telemetry.	Outcome is linked with confidence, opens obligation, and changes later admissibility.	No improvement in attribution, repair, or later decisions.
Infrastructure failure / migration	Fail a region or orchestration component.	Governance state and obligation history survive controlled migration.	Loss rates and policy fidelity match unmanaged baseline.
Incentive pressure / collusion	Reward agents for violating a declarative rule.	External enforcement suppresses the harmful equilibrium more reliably.	Independent replications do not reproduce the reported direction [28].
Evidence poisoning / conflict	Supply stale, manipulated, or contradictory evidence.	System abstains, corroborates, or escalates according to epistemic policy.	No reduction in confident false action.
Institutional conflict	Two legitimate principals issue incompatible directives.	Precedence, conflict record, and authorized escalation are explicit.	System silently chooses or hides conflict.
Appeal and privacy	Affected party challenges a decision requiring protected evidence.	Selective disclosure supports meaningful review without unnecessary exposure.	No correction benefit or unacceptable privacy leakage.

Table 8. Abbreviations.

Abbreviation	Meaning	Abbreviation	Meaning
AI	Artificial intelligence	CD	Coherence debt
CAA	Causal Answerability Architecture	LLM	Large language model
PROV	W3C provenance family	RTA	Runtime assurance
AIMS	Artificial intelligence management system	RQ	Research question

Table 8. Abbreviations.

Abbreviation	Meaning	Abbreviation	Meaning
AI	Artificial intelligence	CD	Coherence debt
CAA	Causal Answerability Architecture	LLM	Large language model
PROV	W3C provenance family	RTA	Runtime assurance
AIMS	Artificial intelligence management system	RQ	Research question

4.9. Limitations

This is a conceptual and design-science article. It does not report a new controlled implementation. The literature synthesis is integrative rather than systematic, and selection bias remains possible. Several mappings are analogical: cybernetic regulation does not settle institutional legitimacy; runtime assurance for physical controllers does not automatically transfer to open-ended language agents; and the General Theory of Information does not prove the proposed graph schema. The Institutional AI result is a preprint in a narrow environment [28]. Mindful Machine evidence consists of published architectures and prototypes rather than broad independent replication [30,31,32,33,34].

The architecture also introduces costs and new failure modes. The checker can be captured, misconfigured, unavailable, or over-conservative. Consequence observation can be biased. Tamper-evident records can preserve inaccurate claims. Persistent obligations can create unbounded state and privacy risk. Complete mediation can increase latency and create a high-value attack surface. These are not reasons to abandon the approach; they are requirements for checker governance, redundancy, evidence-quality controls, retention policies, performance engineering, and independent evaluation.

5. Conclusions

Agentic AI governance cannot be reduced to a single model score, policy document, or audit event. Model assurance asks what a system can do and under what conditions it may be deployed. Runtime admissibility asks whether a particular action is authorized now. Consequence reconciliation asks what actually happened, who bears the effect, which obligation remains, and how that evidence changes future authority. These are three coupled timescales governing four distinct objects: model, action, consequence, and institution.

The proposed causal answerability architecture makes the coupling explicit. It combines a versioned governance state, complete mediation, actor-independent validation, runtime assurance, standards-compatible provenance, independent consequence observation, obligation persistence, dynamic assurance, and contestable institutional authority. Its central information-theoretic claim is modest but consequential: recording an event is not yet governance. Consequence evidence becomes governing information only when it changes admissibility, creates repair duties, or revises the deployment envelope.

The decisive next step is empirical. Implementations should be compared under model substitution, checker attack, policy drift, delayed effects, infrastructure failure, incentive pressure, evidence conflict, and appeal. The proposed metrics and refutation criteria permit the architecture to fail. Until those tests are completed, causal answerability should be treated as a falsifiable design hypothesis—one that shifts the frontier from trying to make a model own its governance to building human-machine institutions in which powerful, replaceable cognitive actors remain unable to erase the accounting for what they do.