AI must be authorized
before it acts.
When AI systems take irreversible actions, someone must approve those actions first. This is the governance surface where that authorization is enforced. Every control exists to preserve a structural guarantee.
The Arguments
ZTG-0 Control Set
Governance exists around the execution engine, not inside it. These controls define the minimum structural conditions required for deterministic governance in high-consequence environments.
Authorization must precede irreversible action. No runtime bypass, reinterpretation, or negotiation.
Every external effect must occur only through registered surfaces with declared reversal strategy and authorization policy.
The system records every governance decision so it can be reviewed later. If something happened, there is a record of it.
All governance-relevant state transitions, decision points, and boundary checks must be recorded with sufficient fidelity to support deterministic post-hoc audit.
Given the same inputs, the system makes the same governance decision every time. The AI may behave unpredictably, but the rules that govern it do not.
Given identical initial state and identical inputs, the governance system must produce identical governance decisions. Execution nondeterminism is permitted; governance nondeterminism is not.
All parts of the system agree on what time it is. If the clocks drift too far apart, the system stops rather than make decisions with bad timing data.
All components participating in governance evaluation must operate against a synchronized time source with bounded skew. Clock skew exceeding declared tolerance triggers system halt.
Every identity used to sign authorizations traces back to a declared root of trust. Identities cannot be forged or handed off to someone else.
All cryptographic material used for authorization signing, evidence sealing, and identity binding must be traceable to an explicitly declared trust root. Identity must be unforgeable and non-delegatable.
All parts of the system see the same governance rules at the same time. If the rules are out of sync, the system denies authorization until consistency is restored.
All components participating in governance evaluation must operate against a consistent view of governance state. During inconsistency, the system must deny authorization.
Specification and Regulatory Context
ZTG invariants mapped to EU AI Act, NIST AI RMF, and ISO/IEC 42001. Where the frameworks require procedure, ZTG requires mechanism.
Governance evaluation in real time.
Every authorization decision evaluated against all five structural prerequisites. Every effect sealed with durable evidence. The invariants hold or the system halts.
Before any action runs, the system evaluates all five structural prerequisites. Is every state transition observable? Are governance decisions replayable? Is the clock synchronized? Is the trust root valid? Is governance state consistent? If any check fails, the action is denied.
IF Observability == RECORDING
AND ReplayFidelity == DETERMINISTIC
AND ClockSkew < TOLERANCE
AND TrustRoot == VALID
AND GovernanceState == CONSISTENT
THEN Authorize Before Irreversible Effect
Control requirements
Declared time source and tolerance
Durable authorization precedes dispatch
One governed effect. One inspectable record.
The record gathers decision provenance, consequence, routing, and result. Durable authorizing evidence precedes dispatch; uncertain disposition is an integrity condition, not a missing-log footnote.
Decision provenance
- verdict
- policy version
- decision-time
- authorizing identity
- ratifying principal
Consequence
- harm class
- liability ceiling
- reversal_strategy
- residual harm, where applicable
Routing
- surface route
Disposition
- dispatch and result disposition
- 01Commit evidence durably
Authorizing intent is write-ahead.
- 02Dispatch the effect
No effect appears before the commit.
- 03Record disposition
Completion or indeterminate effect.
ZTG-0a owns record completeness and integrity.
ZTG-4 owns the coupling between evidence and effect.
Indeterminate effect Hold, reconcile, or obtain ratified acceptance before normal operation resumes.
Authorization And Effect Record
No external effect exists without simultaneous durable evidence of authorization and execution.
Every governed action is classified at decision time by the restorability of its harm — not the action itself. The presence of a forward mechanism (refund, retraction, settlement) does not on its own lower the class.
Affected parties can be returned to a materially equivalent state by an available action.
No return to equivalent state, but harm is reducible through a defined forward action. Residual harm is recorded in provenance.
No available forward action reduces the harm. Subject to stricter controls.
The harm-class is a required field in the ZTG-4 evidence record.
Scroll horizontally to inspect the complete record
| # | Time | Event | Target | Inv. | Status |
|---|---|---|---|---|---|
| 01 | 14:32:07 | AUTHORIZATION_SEALED | effect-surface.payment-04 | ZTG-1 | BOUND |
| 02 | 14:32:05 | CLOCK_SKEW_CHECK | time-authority.primary | ZTG-0c | PASS |
| 03 | 14:32:03 | STATE_CONSISTENCY_PROOF | governance-view.current | ZTG-0e | CONSISTENT |
| 04 | 14:31:58 | TRUST_ROOT_VALIDATION | root.identity.alpha | ZTG-0d | VALID |
| 05 | 14:31:54 | EVIDENCE_APPEND | ledger.segment-02 | ZTG-4 | DURABLE |
| 06 | 14:31:49 | EFFECT_DISPATCH | registered-surface.write-11 | ZTG-3 | AUTHORIZED |
| 07 | 14:31:45 | REVERSAL_STRATEGY_CHECK | surface.write-11 | ZTG-3 | DECLARED |
| 08 | 14:31:41 | BOUNDARY_ENFORCEMENT | mechanistic-gate | ZTG-1 | LOCKED |
| 09 | 14:31:38 | STASIS_SCOPE_EVAL | subsystem.execution-a | ZTG-2 | CLEAR |
| 10 | 14:31:32 | INPUT_REPLAY_HASH | run.2026.03.18.1431 | ZTG-0b | MATCH |
| 11 | 14:31:28 | IDENTITY_BINDING | operator.console-01 | ZTG-0d | NON_DELEGATABLE |
| 12 | 14:31:24 | UNSEALED_EFFECT_SCAN | external-surface-set | ZTG-4 | ZERO |
Required system state
A conforming system must produce evidence that each precondition is satisfied and demonstrate that every invariant is enforced across every governed effect path.
Who implements this. How.
ZTG is an open specification. Implement it yourself, deploy the reference implementation, or engage the team that wrote it.
The ZTG invariants are published. Read the specification, evaluate your system against the five primitives, and build a governance layer that satisfies the structural prerequisites. No license fee. No permission required.
- —Start with the five evaluation primitives — they tell you where your system stands
- —Map your execution surfaces to ZTG-3 requirements
- —The invariants are interdependent — ZTG-4 depends on ZTG-0a and ZTG-0c
- —Relaxing an invariant can silently invalidate others
Constable is the reference implementation — the Zero Trust Governance AI Control Kernel built and maintained by Shadow Dynamic Systems. Constable is built to implement the maximal ZTG specification. It is designed for regulated industry deployment.
- —Includes Memoria (governed memory), edge routing, and black box logger
- —Early access opening for government, infosec, medical, and insurance verticals
- —Deployment architecture designed for air-gapped and hybrid environments
ZTG implementation guidance from the team that wrote the specification. Invariant modification analysis, architecture review, and integration planning for teams building their own governance layer or evaluating Constable for deployment.
- —Invariant modification analysis — which changes break structural guarantees, which are scoping decisions
- —Architecture review against the five evaluation primitives
- —Regulatory mapping to your compliance obligations (EU AI Act, NIST AI RMF, ISO 42001)
- —Integration planning for existing agent infrastructure
About the Author
Jason Crittenden
Jason Crittenden has approximately 20 years experience as a Software Engineer, 12 of which were spent in the LegalTech industry building software to improve the efficiency of low-cost legal aid. He has been an avid and occasionally vocal proponent of effective information security since a time when logging onto the internet involved a strange device that screeched, and he holds a Juris Doctor from the University of South Carolina School of Law. He founded Shadow Dynamic Systems in mid-2025 upon realizing the depth of structural security issues plaguing the artificial intelligence space. Zero Trust Governance was published because the technical infrastructure for ensuring safe, secure, governable AI should not require the GDP of a moderate-sized city to validate, study, or create.