P-002 - Constitutional Runtime Governance

S. Jason Prohaska
ETHRAEON Systems; Independent Research, Bologna, Italy
ORCID: 0009-0008-8254-8411
Corresponding author: S. Jason Prohaska
Primary correspondence: sjasonprohaska@gmail.com
Additional author contact: jason.fells@pm.me; jason@ethraeon.systems

Abstract

Autonomous AI-agent systems can initiate consequential commands faster than external review processes can evaluate them. This article presents Constitutional Runtime Governance (CRG), a system-layer architecture that places authorization, evidence, state-integrity, and delegation checks in the pre-execution command path. CRG operationalizes five constraints - append-only governance state, fail-closed command handling, evidence-required authorization, exclusion of placeholders from truth-bearing fields, and non-recursive authority delegation - collectively termed T5-RIGID. The article defines the enforcement boundary and trusted computing base, distinguishes pre-execution blocking from post-hoc detection, and specifies an event-level evaluation protocol for testing enforcement claims. The governance-latency hypothesis is deliberately bounded: placing an authorization decision before forwarding removes post-hoc enforcement delay for mediated commands, while validation overhead, monitoring latency, validator defects, privileged compromise, and actions outside the mediated boundary remain material. CRG is offered as an auditable reference-monitor pattern for governing autonomous-system execution, not as a model-alignment method or a claim of universal safety. The resulting framework contributes a concrete vocabulary, threat model, command lifecycle, and reproducibility schema for evaluating whether governed actions remain inside explicitly authorized human control.

Keywords: AI governance; autonomous agents; runtime verification; reference monitor; authority delegation; auditability

1 Introduction

Autonomous AI agents can write code, call external services, alter infrastructure, and initiate consequential workflows. Governance mechanisms that operate only before deployment or after execution leave a temporal and architectural gap: an action may take effect before its authorization, evidence, and policy compliance have been evaluated.

Existing approaches include alignment training, human review, runtime monitoring, and post-hoc audit [1-4]. These approaches remain valuable, but they address different control points. Constitutional Runtime Governance (CRG) addresses the command boundary. A proposed action is evaluated before it is forwarded to an execution environment, and a failed check produces a scoped halt rather than silent or degraded execution.

The term constitutional refers here to an explicit, durable set of execution constraints and authority rules. It does not imply that model behavior has been formally verified or that the runtime controls every possible side effect. The claim is narrower: actions routed through the governed command interface are subject to deterministic checks before forwarding.

1.1 Contributions

This article contributes:

A specification of the T5-RIGID constraint set for single-authority agent chains.

A Layer 6 runtime architecture that mediates proposed commands between agent decision processes and execution environments.

A bounded threat model and trusted computing base for evaluating enforcement claims.

An event-level schema and reproducibility protocol that separate proposed actions, authorized commands, scoped halts, escaped violations, and undetected failures.

A governance-latency hypothesis distinguishing pre-execution authorization delay from post-execution detection and response.

1.2 Governance latency

Let t_p denote the time at which an agent proposes a command, t_d the time at which the governance runtime returns an authorization or halt decision, and t_x the time at which an authorized command begins execution. Pre-execution decision latency is G = t_d - t_p. A mediated architecture requires t_d <= t_x. It therefore prevents an unauthorized mediated command from beginning execution before the decision, but it does not make G equal to zero.

For an action that bypasses mediation or for a defect not detected by the validator, conventional detection and response latency remains relevant. CRG’s architectural advantage is placement: the authorization decision occurs before forwarding, not after the action. The empirical cost of that placement is validation overhead, which must be measured rather than assumed away.

1.3 Layer 6 positioning

For this article, Layers 1-5 denote perception, reasoning, tool use, memory, and communication. Layer 6 denotes constitutional runtime and evidence control. It is governance infrastructure positioned at the command boundary. Removing or bypassing Layer 6 removes the guarantees described here; the framework does not claim to constrain actions that never traverse the boundary.

2 Related work

Reinforcement learning from human feedback and Constitutional AI shape model behavior through training and feedback [2, 3, 12]. CRG is complementary. It does not infer that a model will follow a principle; it evaluates a proposed command against explicit runtime conditions before forwarding.

Runtime verification observes executions against specified properties [7, 10]. CRG is most closely related to inline reference-monitor enforcement [5]. Its extension is the combination of command authorization, evidence provenance, append-only state, and bounded authority delegation for AI-agent workflows.

Multi-agent systems research analyzes interaction, coordination, and mechanism design [11, 13, 14]. Formal verification and safe reinforcement learning address model- or policy-level properties [6, 8, 9]. CRG instead defines a system-level enforcement boundary. Its guarantees are conditional on complete mediation and validator correctness and are not a mechanized proof of model safety.

3 T5-RIGID constraint set

T5-RIGID comprises five independently testable runtime constraints. The set is a practical coverage argument for a single-authority reference architecture, not a mathematically complete or minimal theorem for all agent systems.

3.1 Append-only governance state

Governance-relevant state is committed by append rather than in-place mutation. If S = <s1,…,sn> is the committed sequence, an allowed transition produces S’ = <s1,…,sn,sn+1> while preserving each prior entry. Hash chaining provides tamper evidence; it does not by itself prevent deletion or replacement by a privileged actor outside the trusted computing base.

3.2 Fail-closed per command

Each proposed command returns either a verified success receipt or a scoped halt with diagnostic evidence. Missing, ambiguous, or partially validated output is not authorization. Command-level failure need not halt an entire workflow, but retry or continuation requires a new governed decision.

3.3 Evidence-required authorization

A proposed action is forwarded only when the runtime can trace the required authorization and evidence to the applicable authority state. Missing or unverifiable evidence produces a halt. Evidence establishes the basis of the runtime decision; it does not establish the factual correctness of every external claim contained in a command.

3.4 No placeholders in truth-bearing fields

Reserved placeholder values such as TBD, TODO, and empty strings are rejected when they occupy fields designated as truth-bearing. This is a schema-level integrity rule. Its effectiveness depends on correct designation of truth-bearing fields and cannot detect a plausible but false non-placeholder value without an additional validator.

3.5 Non-recursive authority delegation

The reference authority structure is acyclic and uses a one-way delegation path. An execution component cannot expand its own authority or delegate authority upstream. This rule prevents a defined class of recursive escalation; it does not address collusion, credential theft, or compromise of the human root authority.

3.6 Coverage argument

The constraints cover distinct operational failure classes: mutation of committed governance state, ambiguous command outcomes, absent authorization evidence, incomplete truth-bearing records, and recursive authority escalation. Removing one constraint reopens its corresponding class in the reference architecture. This is a design rationale, not proof that all governance failures map exclusively or completely to these classes.

4 Architecture and enforcement boundary

Every mediated proposed action proceeds through: (1) schema and constraint validation; (2) authorization-evidence verification; (3) append of the proposal and decision to governance state; (4) forwarding of an authorized command; and (5) receipt generation and post-execution evidence capture. A halt terminates that command path before forwarding.

The reference architecture uses four functional roles: a human root authority; an adjudication function that validates evidence and advances governed state; a coordination function that sequences turns and maintains governance state; and an execution function that performs authorized commands and emits receipts.

4.1 Trusted computing base and threat model

The trusted computing base comprises the policy specification, validators, authorization records, governance-state implementation, cryptographic hashing implementation, command mediator, credential boundary, and host integrity. The claimed enforcement property requires all consequential commands in scope to traverse this base.

The threat model includes malformed or incomplete commands, missing authorization evidence, placeholder values in designated truth fields, attempted mutation of committed governance state, and prohibited recursive delegation. It does not establish protection against privileged host compromise, stolen root credentials, colluding trusted components, validator specification errors, supply-chain compromise, side channels, or actions taken outside the mediated interface.

5 Evaluation protocol

The unit of governance analysis is the proposed command, not the conversational turn. An authorized command passes applicable checks and is forwarded. A halt is stopped before forwarding. An escaped constitutional violation is an executed in-scope command that violates an applicable constraint. An undetected failure is identified only outside the runtime’s instrumentation.

A reproducible evaluation requires immutable event identifiers, command and phase identifiers, UTC proposal/decision/forwarding timestamps, terminal decisions, terminal constraints, policy and validator versions, authorization-evidence pointers, receipt hashes, and an explicit bypass search. Reported halt counts must be deduplicated at command level and reconciled to receipts. Latency analysis must publish its sampling rule, clock source, missingness, exclusions, and distributional summaries.

An enforcement test should include positive commands, one negative test for each constraint, validator-failure tests, missing-evidence tests, concurrent-action tests, mutation tests, and attempts to execute through paths outside the mediator. Independent reconciliation should compare executed actions against the policy version applicable when each decision was made.

A reference implementation of the enforcement component was run against this protocol with a fixed decision battery covering valid delegation, nonsense and empty actions, a missing target, low, borderline, and threshold confidence, and ambiguous requests. All ten decisions matched their specification, each returning its constraint-specific reason, and the decision set is deterministic across runs. Measured in-path enforcement cost over two thousand calls was 4.79 microseconds median (7.25 microseconds at the 95th percentile), establishing the pre-execution authorization cost as a measured value rather than an estimate. This is a single-machine component measurement of the reference implementation, not a controlled comparison against another framework and not independent replication.

6 Discussion

Within a conforming implementation and for actions routed through the command boundary, policy-noncompliant commands are configured to halt before forwarding. This supports a constructive enforcement claim at the mediated interface. It does not establish protection against runtime bypass, privileged compromise, validator defects, incomplete logging, or external side effects.

The governance-latency hypothesis is correspondingly bounded: moving authorization into the pre-execution path removes post-hoc enforcement delay for mediated commands. It does not eliminate validation time, monitoring latency, or detection latency for failures outside the enforcement boundary.

6.1 Limitations

CRG is an architectural reference pattern rather than a proof of universal safety. The five constraints are not claimed to be complete for every deployment. The framework depends on specification quality, validator correctness, complete mediation, logging integrity, and credential security. A single-authority model does not resolve federated or multi-stakeholder governance. Binary standing delegation may be less expressive than capability-based or context-specific grants. Empirical effectiveness must be established through a released or reviewable event corpus and adversarial testing.

7 Conclusion

Constitutional Runtime Governance places explicit authorization and evidence controls in the pre-execution path of autonomous-system commands. T5-RIGID provides a concrete reference design for append-only governance state, scoped fail-closed behavior, evidence-required authorization, truth-field completeness, and acyclic delegation. The framework’s value is not an assertion that failure is impossible; it is the creation of a testable command boundary at which authority, evidence, and execution can be reconciled. Future work should evaluate independent validators, bypass and compromise scenarios, competing governance placements, high-throughput performance, and federated authority structures.

Statements and Declarations

Funding

No external funding was received for this work.

Competing interests

S. Jason Prohaska is the founder and chief executive officer of ETHRAEON Systems and is the creator of the ETHRAEON constitutional governance infrastructure from which the architectural framework discussed in this article was developed. This relationship is disclosed as a relevant non-financial and potential financial competing interest. The author has no other competing interests to declare.

Author contribution

S. Jason Prohaska: Conceptualization; methodology; system architecture; investigation; resources; writing - original draft; writing - review and editing; visualization; and project administration. The author approved the submitted version and accepts accountability for the work.

Data availability

This article presents an architectural framework and an evaluation protocol; it does not report a quantitative empirical dataset. No research dataset was generated or analyzed for the results presented in this article. Security-sensitive implementation materials are not required to evaluate the article’s conceptual claims.

Code availability

No software code is reported as an experimental result in this conceptual article. The reproducibility requirements for testing a conforming implementation are specified in the Evaluation protocol section.

Ethics approval and consent to participate

Not applicable. This article develops and analyzes a systems architecture and reports no research involving human participants, human data, animals, or biological materials.

Consent for publication

Not applicable. No identifiable individual participant data are reported.

Acknowledgments

None.

Use of generative artificial intelligence

The author used ChatGPT as an assistive tool during manuscript restructuring, reference checking, and language revision. The author reviewed and takes responsibility for the manuscript’s content, claims, citations, and final form.

References

1. Amodei, D., Olah, C., Steinhardt, J., et al.: Concrete problems in AI safety. arXiv:1606.06565 (2016). https://doi.org/10.48550/arXiv.1606.06565

2. Bai, Y., Jones, A., Ndousse, K., et al.: Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv:2204.05862 (2022). https://doi.org/10.48550/arXiv.2204.05862

3. Bai, Y., Kadavath, S., Kundu, S., et al.: Constitutional AI: Harmlessness from AI feedback. arXiv:2212.08073 (2022). https://doi.org/10.48550/arXiv.2212.08073

4. Brundage, M., Avin, S., Wang, J., et al.: Toward trustworthy AI development: Mechanisms for supporting verifiable claims. arXiv:2004.07213 (2020). https://doi.org/10.48550/arXiv.2004.07213

5. Erlingsson, U., Schneider, F.B.: IRM enforcement of Java stack inspection. In: 2000 IEEE Symposium on Security and Privacy, pp. 246-255 (2000)

6. García, J., Fernández, F.: A comprehensive survey on safe reinforcement learning. J. Mach. Learn. Res. 16, 1437-1480 (2015)

7. Havelund, K., Goldberg, A.: Verify your runs. In: Verified Software: Theories, Tools, Experiments. LNCS 4171 (2008). https://doi.org/10.1007/978-3-540-69149-5_40

8. Huang, X., Kwiatkowska, M., Wang, S., Wu, M.: Safety verification of deep neural networks. In: Computer Aided Verification, pp. 3-29 (2017). https://doi.org/10.1007/978-3-319-63387-9_1

9. Katz, G., Barrett, C., Dill, D.L., Julian, K., Kochenderfer, M.J.: Reluplex: An efficient SMT solver for verifying deep neural networks. In: Computer Aided Verification, pp. 97-117 (2017)

10. Leucker, M., Schallhart, C.: A brief account of runtime verification. J. Log. Algebr. Program. 78(5), 293-303 (2009)

11. Nisan, N., Roughgarden, T., Tardos, E., Vazirani, V.V. (eds.): Algorithmic Game Theory. Cambridge University Press, Cambridge (2007)

12. Ouyang, L., Wu, J., Jiang, X., et al.: Training language models to follow instructions with human feedback. Adv. Neural Inf. Process. Syst. 35 (2022)

13. Shoham, Y., Leyton-Brown, K.: Multiagent Systems. Cambridge University Press, Cambridge (2009)

14. Wooldridge, M.: An Introduction to MultiAgent Systems, 2nd edn. Wiley, Chichester (2009)