Identity Integrity

This file captures the §8 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.

Identity Integrity is the fourth of the five structural prerequisites (ZTG-0a through ZTG-0e), and the last of the input-trust prerequisites: with Observability, Replayability, and Temporal Integrity it completes the set of properties a decision's inputs must have before the boundary can be trusted to act on them. ZTG-0d answers by whose authority. A decision can be recorded (ZTG-0a), reproducible (ZTG-0b), and temporally well-anchored (ZTG-0c) and still be ungoverned if the authority it claims to act under cannot be attributed to a real, accountable party.

Operational Questions

ZTG-0d sits in the prerequisite range serving replayability and evidence coupling — an authorization is only fully reconstructable and only worth coupling to an effect if whose authority it carried is part of the record. It is also the prerequisite beneath override visibility: the appendix maps override visibility to the framework's signing and lineage structure, and that structure is exactly what ZTG-0d requires. An override is attributable only if the identity that authorized it is cryptographically bound and recorded. ZTG-0d supplies the to whom of every governance act; without it, attribution is asserted rather than demonstrable.

Normative

Every authorization recognized at the boundary MUST trace to an identity that is cryptographically bound, attributable to a real principal, and valid as of decision-time. Authority that cannot be attributed to a principal is not authority, and the boundary MUST NOT act on it.

Authorizing Identity

An authorizing identity is the identity under whose authority a governance decision is made. The reasoning system MUST NOT hold an authorizing identity. A model cannot be a principal whose authority the boundary recognizes, for the same structural reason the boundary refuses memory-resident content as policy (ZTG-1) and refuses model-supplied time (ZTG-0c): an input the governed subject can issue to itself cannot be a check on the governed subject. A system that can mint its own authorizing identity can author its own authorization, which collapses the separation the boundary exists to maintain.

Delegation and Terminal Attribution

Authority in a governed system is delegated, not spontaneous. Every authorization MUST trace, through a delegation chain, to a human or institutional principal who ratified the authority under which the decision is made. Service identities, automated components, and the enforcement architecture itself may appear as intermediate links in that chain, but they MUST NOT be its terminus. The chain terminates at an accountable party, never at the system.

This is the identity-layer statement of a principle the framework asserts elsewhere: the system never originates authority (ZTG-5), and the ratifying officer's authority is exercised continuously through the architecture (§1.2). ZTG-0d makes that principle checkable by requiring the chain back to the ratifying principal to be present and attributable for any authorization, so that "the system did it on its own authority" is not a representable state. An action taken under authority that was never delegated is unauthorized regardless of its content — authority the principal did not grant is not authority the system holds.

Credential Binding

Authorizing identity MUST be bound by cryptographic credentials that are non-repudiable and revocable. Non-repudiable means attributable to the principal, unforgeable by anyone else, and undeniable by the principal after the fact: authorization carries a signature only the principal could produce and the principal cannot later disavow. Revocable means the binding can be withdrawn, and the withdrawal takes effect on governance decisions made after it.

Bearer tokens, session credentials, and shared secrets do not satisfy ZTG-0d as the binding for authorizing identity. They authenticate a holder without attributing to a principal: they are replayable by whoever obtains them and disavowable by the principal who issued them, so they cannot carry attribution strong enough to bind a governance authority. They may serve transport authentication; they may not serve as the authorizing binding. The binding ZTG-0d requires is the same structure the framework's override visibility depends on — signed, attributable, and traceable — which is why the credential strength is specified rather than left to deployment.

Validity and Revocation in Time

An authorizing identity's validity is time-bounded and MUST be evaluated against trusted decision-time. Whether a credential is currently valid, expired, or revoked is determined from the ZTG-0c point-in-time snapshot, using the trusted time source, not from a live view the reasoning system could influence. Revocation is a governance event: it is recorded under ZTG-0a, and an authorization made after a revocation takes effect MUST NOT recognize the revoked identity. Because identity state is part of the decision-time snapshot, a replayed decision (ZTG-0b) reconstructs the validity and revocation state exactly as it stood when the decision was made — a credential valid at decision-time replays as valid even if later revoked, and a credential revoked before decision-time replays as revoked.

Attribution Completeness

Every governance decision's record MUST identify the authorizing identity and preserve enough of the delegation chain to attribute the decision to its terminal principal. An authorization whose principal cannot be reconstructed from the record is an attribution gap, and an attribution gap is a violation under ZTG-0a's negative-space rule, not a missing optional field. A governed system that cannot say under whose authority an action was taken has not governed the action.

Conformance Criteria

A conforming implementation can: demonstrate that no authorizing identity is held by the reasoning system; trace every recognized authorization through its delegation chain to a human or institutional principal; demonstrate that authorizing credentials are non-repudiable and revocable, and that bearer or shared secrets are not accepted as the authorizing binding; evaluate identity validity and revocation against trusted decision-time from the ZTG-0c snapshot; honor revocation on decisions made after it takes effect; and reconstruct the terminal principal of any decision from its record.

Further Considerations

The delegated-authority grounding. The law of agency worked out, long before autonomous software, what it means for one party to act under another's authority. An agent acts with the principal's authority only to the extent the principal conferred it; an act beyond that authority is ultra vires — outside the power granted — and does not bind the principal as authorized. Authority can be conveyed in advance or ratified, but it always originates with a principal who is accountable for its exercise, and an agent cannot enlarge its own authority by asserting it. ZTG-0d is this structure applied to a governed autonomous system. The system is an agent; its authority is delegated by a ratifying principal; an action under authority that was never delegated is ultra vires and unauthorized; and attribution back to the principal is what makes the principal accountable for what was delegated. The requirement that the chain terminate at a human or institutional principal is not a bureaucratic preference — it is the condition under which the system's actions have an accountable author at all.

Attribution is not the same as binding force. ZTG-0d supplies the to whom of a governance act: who authorized it, traceable to an accountable principal. It is distinct from two neighboring properties it is easy to conflate. It is not override visibility in the narrow sense — visibility is whether an override is traceable; ZTG-0d is the identity machinery that makes such tracing possible, but override visibility as a property is about the override record, not the identity binding. And it is distinct from the question of whether authority binds at the point of exercise rather than operating advisorily — that is a property of the boundary's force (ZTG-1) and of the architecture as a whole, not of identity. A correctly attributed authorization that the boundary treats as advisory is an attribution success and a governance failure. ZTG-0d guarantees attribution; it does not by itself guarantee that attributed authority binds. (The binding-force question is tracked separately and is deliberately unplaced; see Draft Flags.)

Identity as a trust boundary. Identity is the third of the inputs the governed subject must not control, alongside policy-relevant memory and time. The pattern recurs because it is the same vulnerability each time: any governance check the governed system can supply to itself is not a check. Reading ZTG-1 (memory), ZTG-0c (time), and ZTG-0d (identity) together, the framework is drawing a single line — the governed subject does not get to author the inputs that govern it — across three different input types. The recurrence is evidence the line is real, not three separate rules that happen to rhyme.

Relationship to replayability and temporal integrity. ZTG-0d depends on ZTG-0c for the meaning of "valid at decision-time" and feeds ZTG-0b by making identity state part of the reconstructable snapshot. The three compose into a single property: a replayed decision reproduces not only the inputs and the verdict but the authority and its validity status exactly as they stood. Attribution that could not be replayed would be attribution one had to take on trust, which is the condition ZTG-0b exists to eliminate.

Institutional identity and key custody. Terminating the chain at an institutional principal raises real questions of institutional key custody, rotation, and succession — whose keys represent the institution, and how authority survives personnel change. These are genuine deployment concerns and they are not reasons to weaken the requirement; an institution that cannot say whose authority binds it has an institutional problem ZTG-0d surfaces rather than creates. The chapter requires attributable institutional identity; it does not specify custody mechanism, which is a deployment matter.

How We Do It

Constable recognizes authorization only from cryptographically bound identities whose authority traces to a ratifying principal, validates them against decision-time, and records the binding so the authority is attributable and replayable.

No model-held identity. The agent runtime holds no authorizing identity and has no path to mint one. Identities recognized by the gate are issued and managed outside the agent runtime; the model can propose actions but cannot present itself or any identity it controls as the authorizing principal.

Signed authorization and delegation chains. Authorizations carry signatures from credentials bound to principals, and Constable retains the delegation chain linking an operating identity back to the ratifying principal. The gate verifies the signature and the chain before recognizing authority, emitting an IDENTITY_VALIDATED event under ZTG-0a that records the authorizing identity and the chain sufficient to reconstruct the terminal principal. Authorizations that do not verify, or whose chain does not terminate at a ratifying principal, are refused.

Non-repudiable, revocable credentials. Constable binds authorizing identity with asymmetric credentials rather than bearer tokens: a signature attributable to the principal, verifiable by the gate, and undeniable afterward. Revocation status is maintained and checked at decision-time; a revoked credential is not recognized for decisions after revocation takes effect. Transport-level authentication may use other mechanisms, but the authorizing binding is always the signed, attributable credential.

Decision-time validity. Credential validity and revocation are evaluated against the ZTG-0c trusted time and the pinned decision-time snapshot, so identity status is assessed as of the same instant as the rest of the decision and replays identically through the ZTG-0b harness.

Conformance tests. Constable's internal testing for ZTG-0d includes: tests confirming the agent runtime holds and can mint no authorizing identity; chain-termination tests confirming every recognized authorization traces to a ratifying principal and ultra-vires authorizations are refused; credential-strength tests confirming bearer/shared secrets are rejected as the authorizing binding and signatures are non-repudiable; revocation tests confirming revoked identities are not recognized after revocation; and replay tests confirming identity validity state reconstructs as of decision-time. The protocol is documented in the conformance verification specification referenced in §22.

Draft Flags

• Binding-force question is parked, not placed here. The note in planning/binding-authority-note.md — "Is authority exercised at a point where it is not merely advisory?" — is deliberately unplaced. ZTG-0d touches it (it supplies attribution, which the binding-force question presupposes) but does not resolve or place it. Flag for the §1.0 / framing session that owns it; do not let it migrate into ZTG-0d's normative body by default.
• Override visibility ownership. The appendix maps override visibility to the signing-and-lineage structure ZTG-0d provides, but override visibility may be stated as its own normative property in a later section. Decide whether ZTG-0d owns it or merely enables it, to avoid double-specification.
• Institutional key custody/succession is named as a deployment concern and not specified. Confirm on a later pass whether ZTG-0d should say anything normative about succession (authority surviving personnel change) or leave it fully to deployment.
• ZTG-0e (Governance Consistency) interaction. Revocation and delegation-chain changes are governance-state transitions; their ordering and consistency across changes will need to agree with ZTG-0e once it is drafted. Flag for ZTG-0e.
• §22 Conformance Verification is referenced but not yet captured in this workspace.
• The chapter is substantively complete but likely needs final tone calibration for publication register.