From Permission to Institutional Authority: Governance-Native Agentic AI with Governed Continuity and Authoritative Memory

1. Introduction

Agentic AI changes the enterprise control problem because intelligent systems can now call tools, change records, coordinate other agents, trigger transactions, and create commitments before a retrospective review occurs. Model quality remains important, but a state-changing system introduces a second question: not only whether its reasoning is plausible, but whether a particular action is legitimate for the enterprise to commit under the current purpose, evidence, policy, delegation, and accountability model.

Recent research has made an important separation between capability and permission. Zheng et al. distinguish Autonomous Capability Levels from Allowed Autonomy Levels [1]. Uchibeke places deterministic policy evaluation before tool execution [2]. Zhou addresses the capability-identity gap created when agent tools change after authorization [3]. Cao et al. separate a declarative agent specification from its runtime substrate [4]. Production platforms have moved in the same direction: OpenAI Agents SDK supports approval-gated tool calls and resumable state [5]; LangGraph persists checkpointed workflow state for human-in-the-loop and fault-tolerant execution [6]; Open Policy Agent separates policy decision-making from application code [7]; and Amazon Verified Permissions evaluates principal-action-resource-context policies using Cedar [8]. These developments make a straw-man comparison with “ungoverned AI” untenable.

The remaining architectural question is composition. A production agent can combine an identity service, a policy engine, a durable workflow runtime, a memory store, a tracing platform, human approval, cloud autoscaling, and recovery mechanisms. Each component can be correct locally. The higher-order question is whether the enterprise can make one testable claim across them: that legitimate authority, open commitments, provenance, and recovery obligations remain coherent when a process scales, fails, retries, migrates, or changes executors.

This article calls that property governed continuity. Computational continuity preserves execution state. Governed continuity additionally preserves the institutional meaning of the workflow: who is authorized, under which purpose and policy version, on the basis of which evidence, with which commitments already made, which obligations remain open, and what recovery semantics apply. The distinction is particularly important for agentic systems because models and tools are increasingly replaceable while the institution remains accountable for the resulting actions.

The Mindful Machine architecture studied here treats authority and commitments as first-class managed knowledge rather than incidental application metadata. A ratified Digital Genome defines constitutional constraints; AMOS - the Autopoietic and Metacognitive Orchestration System - interprets and regulates runtime execution; models, agents, and oracles propose rather than own authority; consequential action crosses a mediation boundary and acquires an Authorization Warrant; replaceable executors perform; and authoritative memory preserves the accepted history from which role-specific operational views are derived. Earlier Mindful Machine work developed Digital Genome-based distributed applications, associative memory, event-driven history, and governance of commitments [18,19,20]. The present contribution reframes that lineage around institutional authority and tests the resulting architecture in a prior-authorization workflow.

Contributions

• A vocabulary that separates capability, permission, authorization, institutional commitment, consequence obligation, and constitutional change authority.
• An Authorization Warrant model that represents action authority as versioned, evidence-bearing executable state rather than a scalar permission bit.
• A comparison with 2026 state-of-the-art AI that recognizes current advances in policy, approvals, durable execution, memory, identity, and tracing and locates the remaining differentiation in authority custody and continuity.
• A governed-continuity model for autoscaling, autofailover, retry/replay, live migration, and model, tool, container, database, or cloud substitution.
• A governance-native architecture with one authoritative event history and multiple governed service-delivery, assurance, governance, and learning/review views.
• An implementation result from a current graph query over 25 synthetic Pre_Auth completion records: 10 accepted, 3 denied, and 12 escalated, exercising all three designed authority paths.
• A bounded claim for closure: the present work demonstrates governance disposition and completion semantics; end-to-end consequence closure across external actors is defined as future work.

2. Related Work and State of the Art

2.1. Pre-Action Authorization and Durable Agent Execution

The most important change in contemporary agent governance is movement of controls toward the moment before side effect. Approval-gated tools, deterministic policy evaluation, and resumable state are now practical platform features rather than only research proposals. OpenAI Agents SDK pauses runs when a tool requires approval and resumes from serialized run state after approval or rejection [5]. LangGraph checkpoints graph state at execution boundaries, enabling human interruption, replay, and fault recovery [6]. Policy-as-code systems such as OPA evaluate structured context independently from application code [7], while Amazon Verified Permissions uses a principal-action-resource-context authorization model [8].

These mechanisms materially close the permission gap. They also clarify why the remaining distinction must be narrower than “governance versus no governance.” A well-engineered conventional stack can propagate policy versions, evidence references, identity, and durable workflow state. The differentiating research question is whether those variables are treated as one first-class institutional state whose custody remains explicit across control planes and execution change, rather than as fields that every application integration must remember to carry.

2.2. Management, Provenance, and Regulatory Context

The NIST AI Risk Management Framework and its Generative AI Profile organize AI risk management across the lifecycle [9,10]. ISO/IEC 42001 specifies requirements for establishing, maintaining, and continually improving an organizational AI management system [11]. The EU Artificial Intelligence Act establishes risk-based obligations including record keeping, human oversight, robustness, and cybersecurity for relevant classes of systems [12]. W3C PROV provides a standard model for provenance relationships among entities, activities, and agents [13]. These frameworks are complementary to the present work: they describe management, risk, oversight, and provenance obligations, while this article studies an execution architecture intended to make selected obligations operational at action time.

2.3. Prior Authorization as a Governance-Dense Workflow

Prior authorization is a useful implementation domain because it concentrates evidence sufficiency, policy volatility, time constraints, human escalation, adverse decisions, auditability, and interoperability. CMS-0057-F requires impacted payers to modernize prior-authorization and interoperability processes, with operational provisions beginning in 2026 and API requirements generally beginning in 2027 [14]. Current HL7 Da Vinci implementation guides define coverage-requirements discovery (CRD), documentation templates and rules (DTR), and prior-authorization support (PAS) over FHIR-aligned interfaces [15,16,17]. These standards provide essential exchange rails; they do not by themselves define who owns the authority to commit a particular decision, how that authority survives runtime change, or how the resulting institutional history is maintained.

2.4. Positioning Relative to Earlier Mindful Machine Work

Digital Genome-based self-regulating distributed applications were introduced as a means of encoding executable knowledge, relationships, and event-driven history [18]. Subsequent work reframed static prediction as a governed distributed AI process with associative and episodic memory [19] and argued for an application-layer governance layer that preserves commitments rather than only compute and data [20]. The General Theory of Information provides a broader structural account of information, knowledge, carriers, and recipients [21], while autonomic computing established the enduring systems objective of self-management under high-level goals [22]. The present article narrows those ideas to a concrete systems question: custody of institutional authority under agentic action and execution change.

3. Authority as Executable State

The word authority is often used in AI to mean access, permission, or human approval. Those concepts are related but not interchangeable. A consequential architecture benefits from separating at least six layers, summarized in Table 1 and Figure 1.

3.1. Permission is Necessary but Insufficient

Permission is resource-centric: it controls whether an identity may invoke a capability. Institutional authority is commitment-centric: it controls whether an invocation may legitimately create a consequence on behalf of a principal. An authenticated and authorized service account can therefore still lack authority to deny a benefit, approve a financial commitment, alter a governing policy, or continue acting after its delegated scope has expired. Agentic systems make this distinction visible because reasoning, tool selection, and execution can be dynamic rather than hard-coded in one application path.

3.2. Authorization is an Event; Authority is State

Authorization is a decision at a moment. Authority is the state that makes the decision legitimate. That state includes the accountable principal, delegated scope, purpose, policy and genome versions, current evidence, conditions, expiry, continuity class, and obligations attached to the action. A binary permit that cannot reconstruct those dimensions is weak evidence of institutional governance even if the decision was locally correct.

The implementation therefore uses an Authorization Warrant as the state-bearing evidence of admitted action. The warrant is not presented as a legal instrument; it is an architectural object that binds authority, evidence, and conditions to a specific consequential action and to the authoritative event that records its result.

LegitimateAction(a,t) = ValidAuthority AND CurrentEvidence AND MandatoryMediation AND AuthorizationWarrant AND AuthoritativeRecord AND ConsequenceObligations

Table 2. Minimum Authorization Warrant fields proposed for consequential action.

Field	Purpose
warrant_id	Unique identity of the admitted action authority.
principal / accountable owner	Institution or person whose delegated authority is exercised.
actor / activity	Identity and concrete action being admitted.
purpose / scope	Why the action is allowed and the boundary of that authority.
genome_version / policy_version	Ratified governing versions in force.
evidence_set / provenance	Facts and artifacts that justify admission.
conditions / exceptions / expiry	When authority ceases or requires escalation.
review / disclosure	Human or institutional review required or already performed.
obligations	Audit, notification, recovery, or downstream duties created.
continuity / executor substitution	Rules for retry, migration, failover, or replacement of executors.
correlation / causation identity	Link to the workflow episode and triggering events.

Table 2. Minimum Authorization Warrant fields proposed for consequential action.

Field	Purpose
warrant_id	Unique identity of the admitted action authority.
principal / accountable owner	Institution or person whose delegated authority is exercised.
actor / activity	Identity and concrete action being admitted.
purpose / scope	Why the action is allowed and the boundary of that authority.
genome_version / policy_version	Ratified governing versions in force.
evidence_set / provenance	Facts and artifacts that justify admission.
conditions / exceptions / expiry	When authority ceases or requires escalation.
review / disclosure	Human or institutional review required or already performed.
obligations	Audit, notification, recovery, or downstream duties created.
continuity / executor substitution	Rules for retry, migration, failover, or replacement of executors.
correlation / causation identity	Link to the workflow episode and triggering events.

Figure 2. The Authorization Warrant as executable authority state. Enterprise constitution, evidence, identity, and policy are bound to mediated execution, authoritative event recording, and consequence/recovery obligations.

Figure 2. The Authorization Warrant as executable authority state. Enterprise constitution, evidence, identity, and policy are bound to mediated execution, authoritative event recording, and consequence/recovery obligations.

4. Governed Continuity Under Execution Change

Agentic applications change along two independent axes. Cognitive resources change when models, tools, prompts, APIs, or sub-agents are substituted. Execution resources change when workers scale, containers fail, processes restart, data stores move, or workloads migrate. High availability and durable execution preserve computation. Governed continuity requires that the institutional object remain the same despite those substitutions.

Table 3. Governed-continuity invariants under common execution changes.

Change	What changes	What must remain governed
Autoscaling	Additional/reduced workers	Workflow identity, authority scope, open commitments, policy/genome version, evidence provenance.
Autofailover	Primary executor fails	Case/run identity, idempotency, committed side effects, pending obligations, recovery semantics.
Retry / replay	A step is repeated	No duplicate commitment; original warrant, causation identity, and prior effects remain visible.
Live migration	Running workload moves	The governed workflow keeps identity, authority, evidence, and obligations across nodes or clouds.
Model/tool substitution	Cognitive or tool resource changes	Replacement acquires no authority merely from capability; current warrant and constraints remain controlling.
Cloud / database substitution	Infrastructure changes	Authoritative institutional state remains above the replaceable substrate.

Table 3. Governed-continuity invariants under common execution changes.

Change	What changes	What must remain governed
Autoscaling	Additional/reduced workers	Workflow identity, authority scope, open commitments, policy/genome version, evidence provenance.
Autofailover	Primary executor fails	Case/run identity, idempotency, committed side effects, pending obligations, recovery semantics.
Retry / replay	A step is repeated	No duplicate commitment; original warrant, causation identity, and prior effects remain visible.
Live migration	Running workload moves	The governed workflow keeps identity, authority, evidence, and obligations across nodes or clouds.
Model/tool substitution	Cognitive or tool resource changes	Replacement acquires no authority merely from capability; current warrant and constraints remain controlling.
Cloud / database substitution	Infrastructure changes	Authoritative institutional state remains above the replaceable substrate.

Figure 3. Governed continuity. Computational continuity preserves process state; institutional continuity additionally preserves identity, delegated authority, policy/genome version, evidence, commitments, obligations, and recovery semantics through scaling, failover, migration, replay, and substitution.

Figure 3. Governed continuity. Computational continuity preserves process state; institutional continuity additionally preserves identity, delegated authority, policy/genome version, evidence, commitments, obligations, and recovery semantics through scaling, failover, migration, replay, and substitution.

This comparison is deliberately conservative. Conventional SOTA platforms can store arbitrary governance metadata in durable workflow state. The proposed differentiation is therefore not theoretical impossibility, but architectural default and custody. In a composed stack, application teams must ensure every side-effecting path consults the correct authority, every retry remains idempotent, every executor change preserves the governing versions and open obligations, and every role-specific view is reconciled to the same accepted history. The Mindful Machine architecture makes those requirements the managed object of the runtime itself.

5. Governance-Native Mindful Machine Architecture

Figure 4 summarizes the resulting architecture. Human or institutional authority ratifies the Digital Genome. AMOS interprets that ratified state and regulates runtime execution. Models, agents, and oracles generate proposals but do not own institutional commitments. A non-bypass consequential-action boundary separates proposal from effect; admitted action is represented by an Authorization Warrant. Execution resources remain replaceable. The governed workflow and its commitments persist as the enduring institutional object, while authoritative memory preserves structural, functional, semantic, and episodic history. Service-delivery, assurance, governance, and learning/review views are governed projections of that history.

Figure 4. How a Mindful Machine preserves legitimate action. The architecture separates institutional authority, runtime governance, intelligence resources, mediation, execution, authoritative memory, continuity, operational views, security, and reviewed learning.

Figure 4. How a Mindful Machine preserves legitimate action. The architecture separates institutional authority, runtime governance, intelligence resources, mediation, execution, authoritative memory, continuity, operational views, security, and reviewed learning.

5.1. The Five Architectural Elements

Table 4. Core Mindful Machine elements interpreted as an authority-custody architecture.

Element	Architectural role	Governance content
Digital Genome	Ratified executable constitution	Purpose, roles, delegated authority, invariants, policies, admissible actions, NFRs, evidence and recovery duties.
AMOS	Autopoietic and Metacognitive Orchestration System	Interprets ratified authority; mediates action; preserves continuity; recovers, recomposes, escalates, and supports reviewed change.
Models / agents / oracles	Intelligence resources	Reason, retrieve, infer, critique, plan, and propose; proposals are not institutional commitments.
Execution resources / substrates	Replaceable performers	Services, tools, containers, databases, networks, and clouds carry out actions without defining institutional identity.
Authoritative memory / managed knowledge network	Source of accepted institutional history	Structural and functional state, semantic state, episodic events, warrants, evidence, commitments, obligations, recovery, and consequences.

Table 4. Core Mindful Machine elements interpreted as an authority-custody architecture.

Element	Architectural role	Governance content
Digital Genome	Ratified executable constitution	Purpose, roles, delegated authority, invariants, policies, admissible actions, NFRs, evidence and recovery duties.
AMOS	Autopoietic and Metacognitive Orchestration System	Interprets ratified authority; mediates action; preserves continuity; recovers, recomposes, escalates, and supports reviewed change.
Models / agents / oracles	Intelligence resources	Reason, retrieve, infer, critique, plan, and propose; proposals are not institutional commitments.
Execution resources / substrates	Replaceable performers	Services, tools, containers, databases, networks, and clouds carry out actions without defining institutional identity.
Authoritative memory / managed knowledge network	Source of accepted institutional history	Structural and functional state, semantic state, episodic events, warrants, evidence, commitments, obligations, recovery, and consequences.

5.2. One Authoritative History, Multiple Governed Views

One authoritative history does not require a single physical database. It requires a designated accepted history from which other representations can be derived and reconciled. Graph views, dashboards, caches, search indexes, vector stores, and observability platforms may all exist, but they are not independent institutional truths. This distinction lets different roles operate from the same underlying facts while asking different questions.

Table 5. Role-specific projections from one authoritative institutional history.

View	Primary question	Representative state
Service-delivery view	What is happening now?	Case/workflow state, pending work, dependencies, progress, runtime status.
Assurance view	Are commitments and NFRs being met?	SLOs, RTO/RPO, evidence obligations, recovery, audit readiness, exceptions.
Governance view	Who authorized what, under which rule and evidence?	Warrants, policy/genome versions, delegated authority, accountable actors, open obligations.
Learning / review view	What consequences justify a ratified change?	Observed outcomes, divergences, incidents, appeals, review proposals; no silent constitutional self-modification.

Table 5. Role-specific projections from one authoritative institutional history.

View	Primary question	Representative state
Service-delivery view	What is happening now?	Case/workflow state, pending work, dependencies, progress, runtime status.
Assurance view	Are commitments and NFRs being met?	SLOs, RTO/RPO, evidence obligations, recovery, audit readiness, exceptions.
Governance view	Who authorized what, under which rule and evidence?	Warrants, policy/genome versions, delegated authority, accountable actors, open obligations.
Learning / review view	What consequences justify a ratified change?	Observed outcomes, divergences, incidents, appeals, review proposals; no silent constitutional self-modification.

5.3. Mandatory Mediation and Delegated Governance

The central architectural invariant is that consequential proposal and consequential effect are separate events. Intelligence may propose; execution may occur only after mediation under ratified authority. This separation is compatible with local autonomy: services can operate under delegated local authority without placing a human in every runtime loop, provided scope, expiry, revocation, escalation, and global invariants remain explicit. Human accountability therefore terminates the governance regress at constitutional change, contested decisions, and delegated boundaries rather than becoming a synchronous bottleneck for every routine action.

6. Materials and Methods

6.1. Implementation Setting

The empirical implementation is a synthetic prior-authorization (Pre_Auth) Mindful Machine. No real patient data were used. The workflow represents clinical and administrative evidence, policy context, agent proposals, governance evaluation, human escalation, completion reporting, and authoritative history in a managed knowledge graph. The study is an implementation and systems-governance experiment, not a clinical efficacy or payer-adjudication study.

The domain was selected because prior authorization places evidence sufficiency, policy interpretation, adverse decisions, human review, deadlines, interoperability, and auditability in the same workflow. The implementation is aligned conceptually with CMS modernization requirements and the HL7 Da Vinci CRD, DTR, and PAS rails [14,15,16,17], but no claim of regulatory certification or production payer conformance is made.

6.2. Governed Workflow Semantics

The current implementation records three designed governance dispositions in the completion report: Accept, Deny, and Escalate. Accept denotes a governed acceptance path under the applicable authority, evidence, and policy conditions. Deny denotes an adverse determination when the governing authority and any required review conditions are satisfied. Escalate denotes termination of the machine’s delegated decision authority and transfer of decision custody to accountable human review. Escalation is therefore a completed governance-routing action but not necessarily a terminal prior-authorization business decision; final business closure occurs when the human reviewer subsequently accepts or denies.

6.3. Current Graph Query and Analysis Cohort

A read-only query of the current managed knowledge graph was used to count completion records by persisted governance disposition. The analysis cohort contained 25 synthetic cases. Each case was counted once according to its completion-record disposition. Counts and percentages were calculated directly from the query result; no statistical inference was performed because the cohort was constructed to exercise governance paths rather than to estimate real-world prior-authorization prevalence.

The outcome measure is therefore governance-path execution, not decision accuracy. The present analysis asks whether the implemented graph contains cases that traverse each designed authority path and records their completion disposition. It does not compare those dispositions with independently adjudicated clinical ground truth.

6.4. Claim Discipline

The study distinguishes four evidence levels: (i) architecture specified; (ii) governance path implemented; (iii) completion disposition observed in current graph state; and (iv) downstream consequence closure. The present results support levels (ii) and (iii) for Accept, Deny, and Escalate. They do not establish production throughput, clinical superiority, formal non-bypass under an adversarial threat model, or downstream consequence learning across external institutions.

7. Results

7.1. All Three Designed Authority Paths were Observed

The current graph query returned 25 completion records. Ten cases were Accepted (40%), three were Denied (12%), and twelve were Escalated (48%). Thus, all three designed governance dispositions were present in the running implementation.

Table 6. Current Pre_Auth graph-query results.

Disposition	Cases	Share	Authority meaning	Closure interpretation
Accepted	10	40%	Governed acceptance commitment under applicable authority, evidence, and policy conditions.	Terminal for the bounded decision path when all required conditions are satisfied.
Denied	3	12%	Governed adverse determination under applicable authority and required review conditions.	Terminal for the bounded decision path when all required conditions are satisfied.
Escalated	12	48%	Machine authority stops; custody transfers to accountable human review.	Terminal as a machine governance disposition; final business decision remains human-held.
Total	25	100%	All designed governance paths observed.	-

Table 6. Current Pre_Auth graph-query results.

Disposition	Cases	Share	Authority meaning	Closure interpretation
Accepted	10	40%	Governed acceptance commitment under applicable authority, evidence, and policy conditions.	Terminal for the bounded decision path when all required conditions are satisfied.
Denied	3	12%	Governed adverse determination under applicable authority and required review conditions.	Terminal for the bounded decision path when all required conditions are satisfied.
Escalated	12	48%	Machine authority stops; custody transfers to accountable human review.	Terminal as a machine governance disposition; final business decision remains human-held.
Total	25	100%	All designed governance paths observed.	-

Figure 5. Current Pre_Auth governance outcomes from the graph query. The percentages characterize path execution in the synthetic implementation cohort and are not estimates of real-world prior-authorization prevalence or clinical accuracy.

Figure 5. Current Pre_Auth governance outcomes from the graph query. The percentages characterize path execution in the synthetic implementation cohort and are not estimates of real-world prior-authorization prevalence or clinical accuracy.

7.2. Escalation is an Authority Transition, not a Model Failure

The largest observed category was Escalate (12/25). Because the cases are synthetic and intentionally exercise governance conditions, this percentage should not be interpreted as a desired or expected production rate. Its architectural significance is different: the system has a first-class outcome for the condition “this decision is no longer mine to make.” Instead of resolving uncertainty by granting the model greater autonomy, the governance layer can stop autonomous commitment, preserve the evidence and governing context, and transfer custody to an accountable human.

This yields two related closure concepts. Governance-disposition closure occurs when the Mindful Machine has either committed an admitted outcome or explicitly transferred custody outside its delegated boundary. Final business-decision closure for an escalated case occurs later when the human reviewer accepts or denies. This distinction prevents the system from treating human escalation as either an error or a silent continuation of machine authority.

7.3. What the Current Results Establish

• The current graph contains completion records for all 25 analyzed cases.
• Accept, Deny, and Escalate are all exercised as explicit governance outcomes.
• Authority can terminate and transfer to human custody rather than forcing autonomous resolution.
• The results are obtained from persisted graph state rather than from narrative reconstruction of model outputs.
• The study demonstrates governance-path execution and completion semantics; it does not establish clinical correctness or consequence closure.

8. Discussion

8.1. The Permission Gap is Narrowing; the Authority-Continuity Problem Remains

The 2026 state of the art changes the competitive framing. Current systems increasingly support memory, checkpointing, tool approvals, policy evaluation, identity, tracing, and durable resumption [5,6,7,8]. Recent research likewise separates capability from permission and moves authorization before tool execution [1,2,3,4]. The Mindful Machine contribution should therefore not be framed as the discovery of guardrails or pre-action authorization. Its narrower claim is that institutional authority, commitments, evidence, and recovery semantics are treated as one managed state that remains valid when the intelligence and execution resources underneath the workflow change.

Table 7. Representative SOTA AI versus the Mindful Machine differentiation proposed here.

Dimension	Representative SOTA position	Mindful Machine emphasis
Memory / checkpointing	Strong and increasingly first-class [5,6].	Authoritative institutional history includes identity, warrants, commitments, obligations, and consequences.
Tool guardrails / approval	Available in current agent runtimes [5].	Mandatory mediation is part of the architecture for consequential action.
Policy-as-code / authorization	Mature policy engines exist [7,8].	Policy is bound with purpose, evidence, delegated authority, genome version, and continuity in the warrant.
Durable workflow / recovery	Checkpointing, replay, and fault tolerance are mature [6].	Governed continuity carries institutional state through scale, failover, migration, retry, and executor substitution.
Observability / audit	Logs, traces, and provenance standards are mature [13].	Service, assurance, and governance views derive from one authoritative institutional history.
Learning / adaptation	Many systems support memory and iterative improvement.	Consequences may inform reviewed change, but constitutional authority changes only through ratification.

Table 7. Representative SOTA AI versus the Mindful Machine differentiation proposed here.

Dimension	Representative SOTA position	Mindful Machine emphasis
Memory / checkpointing	Strong and increasingly first-class [5,6].	Authoritative institutional history includes identity, warrants, commitments, obligations, and consequences.
Tool guardrails / approval	Available in current agent runtimes [5].	Mandatory mediation is part of the architecture for consequential action.
Policy-as-code / authorization	Mature policy engines exist [7,8].	Policy is bound with purpose, evidence, delegated authority, genome version, and continuity in the warrant.
Durable workflow / recovery	Checkpointing, replay, and fault tolerance are mature [6].	Governed continuity carries institutional state through scale, failover, migration, retry, and executor substitution.
Observability / audit	Logs, traces, and provenance standards are mature [13].	Service, assurance, and governance views derive from one authoritative institutional history.
Learning / adaptation	Many systems support memory and iterative improvement.	Consequences may inform reviewed change, but constitutional authority changes only through ratification.

8.2. The Governed Workflow is the Enduring Institutional Object

A useful architectural shift is to stop treating the container, model, or process instance as the identity that matters most. Those resources can be replaced. The enduring institutional object is the governed workflow and its commitments. The Digital Genome specifies what must remain true; the Authorization Warrant records what may happen now; AMOS preserves governed continuity while executors change; and authoritative memory records what actually happened. This decomposition makes autoscaling, failover, and migration governance questions rather than only infrastructure events.

8.3. One History Supports Three Accountability Perspectives

The one-history/multiple-view architecture is important because enterprises already separate operational responsibilities. Service owners need to know what is happening. Assurance functions need to know whether commitments and non-functional requirements are being met. Governance functions need to know who authorized what and under which evidence and rule. If these views are reconstructed from unrelated tools, disagreements become forensic integration problems. If they are governed projections of one accepted history, differences are perspective rather than competing truth.

8.4. Cybersecurity Becomes Protection of the Authority Chain

Agentic cybersecurity must protect more than model behavior and endpoint availability. An attacker can target the chain that makes an action legitimate: steal an identity, expand capability after approval, mutate delegated rules, bypass mediation, replay a commitment, corrupt authoritative memory, or prevent consequences from being linked back to the action that caused them. The security object therefore becomes the integrity of the sequence principal -> delegation -> warrant -> mediation -> action -> memory -> reality. Zero-trust principles remain relevant [24], but the protected asset is the legitimacy of the institutional action itself.

Figure 6. Cybersecurity reframed around the legitimacy of action. Capability escalation, identity theft, unauthorized rule change, mediation bypass, replay/duplication, memory loss, and consequence blindness attack different links in the authority chain.

Figure 6. Cybersecurity reframed around the legitimacy of action. Capability escalation, identity theft, unauthorized rule change, mediation bypass, replay/duplication, memory loss, and consequence blindness attack different links in the authority chain.

8.5. Consequence Closure is the Next Empirical Boundary

The present paper closes the governance-disposition question for the analyzed implementation cohort; it does not close the broader consequence loop. Prior-authorization consequences often occur outside the immediate system boundary. Escalated cases depend on human reviewers. Accepted or denied cases can lead to provider notifications, additional evidence, appeals, scheduling, patient decisions, treatment delivery, payer responses, or later clinical and administrative outcomes. These external events have different owners, time scales, and evidence quality.

Future work will therefore extend the authoritative event model from decision and custody closure to consequence closure. A terminal or transferred disposition will carry explicit expectations and open obligations. Subsequent externally observed events will be represented with provenance and linked, where evidence permits, to the case, warrant, governing versions, and decision that created the obligation. The intended sequence is DecisionCommitted -> CaseCompleted/Transferred -> ExternalFollowUp -> ConsequenceObserved -> ObligationResolved -> ConsequenceLoopClosed -> DRAS Review -> Proposed Governance Change -> Human Ratification. Consequences become evidence for reviewed change; they do not silently mutate the Digital Genome.

Table 8. Future-work specification for consequence closure across external actors.

Future extension	Required evidence	Research purpose
Human resolution of escalation	Reviewer accepts or denies; record reviewer identity, evidence state, rationale, and timing.	Final business-decision closure for escalated cases.
Provider / payer follow-up	Notification, additional-information request, appeal, reversal, or administrative action.	Observation of institutional consequence beyond the Pre_Auth boundary.
Patient / clinical follow-up	Scheduling, treatment, alternative pathway, delay, or other outcome when available and ethically appropriate.	Connect decision to real-world effect without inferring unobserved causation.
Expectation vs. observation	Compare explicit expected consequence with provenance-bearing observation.	Measure divergence and open obligations.
Reviewed learning	DRAS reflection produces a change proposal; institutional authority ratifies or rejects.	No autonomous constitutional self-modification.

Table 8. Future-work specification for consequence closure across external actors.

Future extension	Required evidence	Research purpose
Human resolution of escalation	Reviewer accepts or denies; record reviewer identity, evidence state, rationale, and timing.	Final business-decision closure for escalated cases.
Provider / payer follow-up	Notification, additional-information request, appeal, reversal, or administrative action.	Observation of institutional consequence beyond the Pre_Auth boundary.
Patient / clinical follow-up	Scheduling, treatment, alternative pathway, delay, or other outcome when available and ethically appropriate.	Connect decision to real-world effect without inferring unobserved causation.
Expectation vs. observation	Compare explicit expected consequence with provenance-bearing observation.	Measure divergence and open obligations.
Reviewed learning	DRAS reflection produces a change proposal; institutional authority ratifies or rejects.	No autonomous constitutional self-modification.

9. Standards and Regulatory Alignment

The architecture is not a compliance certificate. It is an execution pattern that can help make external obligations inspectable and testable. Table 9 maps representative standards and regulations to architecture control points without claiming conformity assessment.

Table 9. Representative standards and regulatory alignment.

Reference	Relevant obligation/practice	Architecture mapping
NIST AI RMF / NIST AI 600-1 [9,10]	Lifecycle risk management and trustworthiness.	Digital Genome constraints, mediated action, residual-risk handling, authoritative history, reviewed improvement.
ISO/IEC 42001:2023 [11]	AI management system and continual improvement.	Ratified governance artifacts, controlled change, auditable operation, reviewed learning.
EU AI Act [12]	Record keeping, human oversight, robustness, cybersecurity where applicable.	Authoritative events, accountable escalation, AMOS recovery, authority-chain security.
W3C PROV [13]	Provenance for entities, activities, and agents.	Evidence and action provenance within the managed knowledge network.
CMS-0057-F [14]	Prior-authorization modernization and interoperability.	Governed workflow around evidence, decision, timeliness, and FHIR-aligned exchange.
HL7 Da Vinci CRD/DTR/PAS [15,16,17]	Coverage discovery, documentation, and prior-authorization exchange.	Replaceable capability rails governed by the Digital Genome and authorization boundary.

Table 9. Representative standards and regulatory alignment.

Reference	Relevant obligation/practice	Architecture mapping
NIST AI RMF / NIST AI 600-1 [9,10]	Lifecycle risk management and trustworthiness.	Digital Genome constraints, mediated action, residual-risk handling, authoritative history, reviewed improvement.
ISO/IEC 42001:2023 [11]	AI management system and continual improvement.	Ratified governance artifacts, controlled change, auditable operation, reviewed learning.
EU AI Act [12]	Record keeping, human oversight, robustness, cybersecurity where applicable.	Authoritative events, accountable escalation, AMOS recovery, authority-chain security.
W3C PROV [13]	Provenance for entities, activities, and agents.	Evidence and action provenance within the managed knowledge network.
CMS-0057-F [14]	Prior-authorization modernization and interoperability.	Governed workflow around evidence, decision, timeliness, and FHIR-aligned exchange.
HL7 Da Vinci CRD/DTR/PAS [15,16,17]	Coverage discovery, documentation, and prior-authorization exchange.	Replaceable capability rails governed by the Digital Genome and authorization boundary.

10. Limitations and Threats to Validity

The empirical cohort is synthetic and intentionally constructed to exercise governance branches. The observed 40% Accept, 12% Deny, and 48% Escalate shares therefore cannot be generalized to payer populations, clinical specialties, or real-world authorization prevalence.

The present graph query demonstrates persisted governance dispositions, not independent clinical correctness. No gold-standard payer adjudication, prospective clinical evaluation, patient-outcome analysis, or economic-effect study is reported.

The architecture specifies a mandatory mediation boundary, but this paper does not report a formal proof or a complete adversarial non-bypass campaign across every possible side-effect interface. Security hardening, credential compromise, insider misuse, replay attacks, and governance-substrate attack remain important validation targets.

Governed continuity is an architectural invariant supported by the broader Mindful Machine implementation lineage [18,19,20], but this specific Pre_Auth result set is not a controlled benchmark of autoscaling, autofailover, and live migration under production load. Such stress tests should be reported separately with workload, failure-injection, state-integrity, and recovery measurements.

Finally, consequence closure is deliberately out of scope for the present results. Human resolution of escalations and later provider, patient, appeal, payer, or clinical events occur across external authority boundaries and require additional provenance-bearing integrations before closed-loop consequence learning can be claimed.

11. Conclusions

Agentic AI has advanced beyond the point where governance can be characterized as an absence of memory, permissions, guardrails, or recovery. Contemporary platforms increasingly provide all of these. The next architectural boundary is institutional authority: what gives a specific action legitimacy, how that authority is represented, how it survives execution change, who owns the resulting commitments, and how later consequences remain linked to the state that admitted the action.

The Mindful Machine architecture addresses this boundary by separating constitutional authority, runtime governance, intelligence, and execution. The Digital Genome encodes ratified purpose and constraints. AMOS - the Autopoietic and Metacognitive Orchestration System - mediates and regulates execution. The Authorization Warrant carries evidence-bearing authority for consequential action. Replaceable models, tools, services, containers, databases, networks, and clouds remain performers rather than owners of institutional identity. Authoritative memory preserves the accepted history from which service-delivery, assurance, governance, and learning/review views are derived. Governed continuity requires that this institutional state survive scaling, failure, retry, migration, and substitution.

The current Pre_Auth graph query provides an implementation anchor: 25 completion records included 10 Accepted, 3 Denied, and 12 Escalated cases, demonstrating all three designed authority paths. Escalation is especially important because it represents a first-class answer to uncertainty: stop autonomous commitment and transfer custody to accountable human authority. The result does not establish clinical superiority, but it demonstrates that authority can be represented as an operational state rather than collapsed into model capability or tool permission.

The next research boundary is consequence closure. Prior-authorization decisions continue into human review, provider and patient action, appeals, payer processes, and other external events. Future work will bind those observations and obligations back to the original warrant and authoritative history, enabling reviewed consequence learning without silent constitutional self-modification. The resulting research question is broader than “was the tool call allowed?”: under whose authority did the enterprise act, did that authority survive change, what happened afterward, and what may the institution legitimately change as a result?