Research Index

AOI Runtime Governance Evidence Map

A continuously maintained index of primary research, technical architectures, standards, market developments, and adjacent work contributing to the emerging discipline of Runtime Governance.

The map catalogs supporting, overlapping, adjacent, and challenging work. Inclusion does not imply endorsement.

The Evidence Map describes the state of the literature, not the state of AO Integrity.

Schema v744 sources9 claims

Corpus facts

Derived from stored corpus records.

44

Total sources

35

Primary sources

0 external contributions recorded.

Classification metrics

Counts depend on AOI's current taxonomy.

25

Overlap flagged

23

Challenge or complicate

Claim Map

Stored claims and source relationships.

Coverage statements are rendered exactly as stored in the Schema v7 corpus.

ClaimLabelTypeCoverageSources
EL

Execution Legitimacy

Whether a specific execution remains a legitimate exercise of conferred authority at the moment it occurs. The five conditions operationalize this determination.

determinationFourteen sources. Three added 2026-08-03, all as support or complement rather than competition: aviation dispatch release as a two-party determination made against current conditions, financial settlement finality as an ex ante determinate irrevocability point, and certificate-bound admission as a conditional-execution model. Support remains strongest from outside AI. Competing treatments continue to address individual conditions rather than the integrated five.
RA

Runtime Admissibility

The determination of whether execution should proceed right now. Not whether memory, data, context, or a consequence is admissible — those may be inputs or subordinate questions, but RA governs execution.

gateTwenty-one sources. Six added 2026-08-03. The certificate-bound admission and execution pair (arXiv 2606.11632, 2606.20520) is the corpus's first two-paper treatment separating proposal, admission, and execution with a signed artifact carried between them, with prototype measurements on AWS and Kubernetes. Foundational support continues to come from runtime verification and monitorability literature, now joined by financial settlement-finality standards on the ex ante determinacy of the irrevocability point. No enterprise-scale operational case study found.
AC

Authority Continuity

The preservation of valid, correctly scoped, and traceable authority across identity, delegation, context, and execution as conditions change over time. Broader than delegation-chain correctness: includes whether authority remains legitimate through the interval between grant and effect.

continuityTwenty sources. Four added 2026-08-03. arXiv 2607.23586 addresses grant survival under agent mutation under the name authorization continuity, with a fixed transition envelope and effect ceiling; arXiv 2606.20520 revalidates against live state at execution rather than at grant. Aviation dispatch regulation (14 CFR 121.533 and 121.663) supplies a long-standing regulatory analogue in which release authority is joint, continuously revisited between release and completion, and non-delegable at the dispatch level. Catalogued treatments continue to address subsets of the claim: agent mutation, infrastructure state, or delegation structure, rather than authority across identity, delegation, organizational context, and execution together. Delegation chains remain structurally representable without non-widening enforced by construction in any deployed standard.
AD

Authority Drift

The divergence, over time, between authority a system retains and the authority current organizational circumstances would justify. Not privilege accumulation — a technically correct entitlement may still be illegitimate in current context.

failureThree sources, unchanged this week. No competing treatments found, and none of the seven sources added 2026-08-03 competes with the canonical definition. arXiv 2606.20520 checks live-state drift at execution against a certified contract, but that comparison is infrastructure state against a contract rather than retained authority against current organizational circumstances, and it was not tagged AD. No standardized business-state event vocabulary exists. No unit of measure, continuous formulation, or threshold located in any source. AD remains the thinnest claim in the corpus by competing coverage and an open search lane.
CD

Capability Drift

Change in an autonomous system's effective ability to produce consequences without a corresponding reevaluation of the authority governing those capabilities. Arises through learned skills, tool composition, memory, model updates, reusable behaviors, delegation, or environmental change.

failureThree sources, up from one. Two added 2026-08-03 substantively address capability evolution rather than state persistence: a state-bound authorization model that fixes an immutable effect ceiling at grant time and proves that mutation cannot amplify protected effects beyond it, where the mutations enumerated include acquiring skills and tools, revising workflows, and delegating work (arXiv 2607.23586); and a lifecycle-time upgrade governance pipeline with interface, policy, behavioral, and recovery compatibility checks, gated activation, shadow deployment, online monitoring, and rollback, measured on an embodied-agent testbed (arXiv 2604.08059). Both report formal or quantitative results; neither uses the term Capability Drift. A third source added this week, arXiv 2605.26542, is catalogued under AC and RA rather than CD: it governs authority attenuation across a composed tool chain within a session, which is adjacent compositional attenuation rather than change over time in effective ability to produce consequences. Still absent from the record: any enterprise deployment case study, any continuous measure or threshold for capability change, and any treatment tying capability change to organizational rather than technical authority.
GE

Governance Evidence

Independently reviewable evidence showing what legitimacy determination was made, which authority and contextual signals informed it, and why the execution was permitted, denied, escalated, or attested. Logs may contribute evidence; event records alone do not establish governance reasoning.

evidenceThirteen sources. Three added 2026-08-03. Signed decision and outcome records bound to a certified execution contract (arXiv 2606.20520) and evidence-digest binding at admission (arXiv 2606.11632) extend the catalogued set of cryptographically bound evidence models. The signed dispatch release under 14 CFR 121.663 is the corpus's first regulatory instance of a governance artifact that two named parties must both sign before an operation may begin. Regulatory demand remains documented with no finalized technical standard.
OBJ

Evaluation Object

The composite execution event: principal, delegation chain, agent, action, target, context, intent, and provenance relevant to a specific execution. Treated as an adopted and refined architecture choice, not a novelty claim.

designNine sources. One added 2026-08-03: arXiv 2606.11632 compiles agent proposals into typed execution contracts bound to evidence digests and policy versions, adding a fifth independent 2026 work locating governance at an execution, admission, or bind boundary.
PE

Policy vs Enforcement

The distinction between governance that is declared and governance that is operationally established in the execution path. A supporting claim, not AOI-originated.

supportingWell covered externally. Primary source is Cavallo's described-versus-established framing; supported by practitioner and distributed-systems material.
MKT

Market Conditions

External technical, regulatory, operational, and commercial developments that increase the need for Runtime Governance but do not themselves establish its architecture.

contextAmple. NHI ratios, over-permissioning rates, IAM capability gaps, and regulatory timelines all documented from multiple sources.

Showing 9 of 44 sources.

Clear filters

e001

Runtime Governance for AI Agents: Policies on Paths

Permalink
Source
arXiv 2603.16586
Source type
research
Primary or secondary status
Primary
Domain
Runtime
Published
2026-03-17
Claims
OBJ, RA
Conditions
OBJ
Stance
complicates
Relation
differentiates
Strength
supporting
Overlap flag
prior_art

Argues the execution path is the central object for runtime governance and formalizes compliance policy as a deterministic function mapping agent identity, partial path, proposed next action, and organizational state to a violation probability. Claims prompt-level instructions and static access control are special cases of this framework. Policy examples drawn from the AI Act; reference implementation discussed. Bears on OBJ and RA.

Original link

e004

Agent Control Specification: Portable runtime governance for AI Agents

Permalink
Source
Microsoft
Source type
vendor
Primary or secondary status
Secondary
Domain
Runtime
Published
2026
Claims
OBJ, MKT
Conditions
OBJ, MKT
Stance
contests
Relation
differentiates
Strength
emerging
Overlap flag
naming_collision

Markets 'runtime governance' as a vendor-neutral standard for applying governance across the agent lifecycle. Uses the term for a policy-enforcement layer, not an evaluation object. Section 5.5 argues the discipline does not require a platform; this is the term being used to name a platform.

Original link

e018

Agent Control Protocol (ACP): Admission Control for Agent Actions

Permalink
Source
arXiv 2603.18829
Source type
research
Primary or secondary status
Primary
Domain
Runtime
Published
2026-03
Claims
RA, OBJ
Conditions
OBJ, 3.4
Stance
complicates
Relation
differentiates
Strength
supporting
Overlap flag
prior_art

Technical specification and reference implementation for admission control at the agent action boundary. Same inline-enforcement pattern as Section 5.1, with a concrete protocol. Relevant to the Section 5.5 concession that the discipline may be implemented inside existing machinery.

Original link

e019

Proof of Execution: Runtime Verification for Governed AI Agent Actions

Permalink
Source
arXiv 2607.05397 (Rhodes & Kang)
Source type
research
Primary or secondary status
Primary
Domain
Verification
Published
2026-04-26
Claims
GE, RA, OBJ, PE
Conditions
EV, OBJ, 3.2
Stance
complicates
Relation
differentiates
Strength
supporting
Overlap flag
prior_art

Formalizes execution as a triple (contract C, Execution Causal Event Stream T, replay context R) with five validator-checkable invariants and five semantic guarantees: authorization, path compliance, null effect on deny, history integrity, replayability. Includes soundness and replay theorems with witness constructions. Overlaps AOI on execution as evaluation object, deterministic inline enforcement, null effect after denial, integrity and replayability, and independently checkable execution history. Does not evaluate contextual validity, intent conformance, or causal origin; establishes that execution followed a valid contract and path rather than whether the execution was institutionally legitimate.

Original link

e020

Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems

Permalink
Source
arXiv 2606.26298 (Salfeld-Nebgen)
Source type
research
Primary or secondary status
Primary
Domain
Evidence
Published
2026-06-24
Claims
OBJ, GE, EL
Conditions
OBJ, EV, 3.4
Stance
complicates
Relation
differentiates
Strength
supporting
Overlap flag
prior_art

Observes that human institutions have governed autonomous actors by requiring independently attested evidence at the point of consequential action rather than by monitoring reasoning. Agent retains planning and reasoning autonomy but holds no execution authority over designated high-risk actions. Execution is conditional on preconditions each independently attested by a separate authoritative source, cryptographically bound to a declared intent, evaluated by deterministic policy, and recorded in a tamper-evident log amenable to independent re-verification. Examples from software deployment and clinical prescribing; proof-of-concept on GitHub. Bears on OBJ, GE, and condition 3.4.

Original link

e027

Saga pattern, compensating transactions, and durable execution

Permalink
Source
Azure Architecture Center / long-running transaction literature
Source type
architecture
Primary or secondary status
Primary
Domain
Distributed Systems
Published
ongoing
Claims
RA, PE, OBJ
Conditions
OBJ
Stance
supports
Relation
adjacent
Strength
foundational
Overlap flag
none

Long-running transactions abandon locks on non-local resources and use compensating transactions that semantically undo rather than restore prior state, typically coordinated by a durable state machine. Establishes an existing engineering distinction between operations that can be compensated and those that cannot. Bears on the reversibility-based allocation in Section 5.3.

Original link

e035

Harnessing Embodied Agents: Runtime Governance for Policy-Constrained Execution

Permalink
Source
arXiv 2604.07833
Source type
research
Primary or secondary status
Primary
Domain
Robotics
Published
2026-04
Claims
RA, OBJ
Conditions
OBJ
Stance
complicates
Relation
differentiates
Strength
supporting
Overlap flag
naming_collision

Robotics application of the term runtime governance. Separates agent cognition from execution oversight by externalizing governance into a dedicated runtime layer performing policy checking, capability admission, execution monitoring, rollback handling, and human override. Capability admission and rollback handling bear on CD and on the reversibility material in Section 5.3.

Original link

e037

From Audit to Admissibility: Why AI Governance Must Move Into The Execution Boundary

Permalink
Source
Medium
Source type
practitioner
Primary or secondary status
Secondary
Domain
Runtime
Published
2026
Claims
RA, OBJ, PE
Conditions
OBJ, EV
Stance
supports
Relation
supports
Strength
emerging
Overlap flag
naming_collision

Practitioner argument that model outputs are not admissible actions but proposals, and that if a proposal can directly mutate system state without boundary evaluation, the model becomes a source of authority. Uses admissibility and execution boundary framing. Bears on OBJ, RA, and PE.

Original link

e041

Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure

Permalink
Source
arXiv 2606.11632
Source type
research
Primary or secondary status
Primary
Domain
Runtime
Published
2026-06
Claims
RA, GE, OBJ, EL
Conditions
3.1, 3.2, 3.4, 3.5
Stance
complicates
Relation
differentiates
Strength
supporting
Overlap flag
prior_art

States a control-plane authorization problem: non-deterministic reasoning systems may propose high-stakes mutations to production resources, while IAM, policy engines, consensus protocols, and audit logs either enforce static permissions or record actions only after execution. Introduces a certificate-bound runtime admission boundary that intercepts agent proposals at an assurance airlock, compiles them into typed execution contracts, binds those contracts to cryptographic evidence digests and policy versions, and routes them through consequence-aware certification paths; successful admission emits a signed certificate valid only for a scoped execution identity, revocation epoch, and validity window. The contract-to-certificate-to-execution chain constrains which execution path may follow from a given admitted proposal, which bears on condition 3.5. Formalizes admission and revocation invariants and reports feasibility measurements from a Go prototype over 2,500 admission attempts. Vocabulary in use that overlaps AOI's: runtime admission boundary, execution contract, evidence-bound, consequence-aware certification, replayable. Companion to e042. Bears on RA, GE, OBJ, and conditions 3.1, 3.2, 3.4, and 3.5.

Original link

Methodology

How to read this map.

AO Integrity maintains the corpus and performs the classifications. Classification is interpretive. Total, primary, and externally contributed counts are corpus facts. Other metrics depend on the current taxonomy. Records can be corrected or withdrawn. Stable evidence IDs are never renumbered or reused. Withdrawn records remain addressable.

Contribution

What are we missing?

The corpus is intended to include work that supports, overlaps with, complicates, or challenges the Runtime Governance thesis. Sources that make the thesis less comfortable are especially useful.

Please include the source title, original URL, author, organization, or venue as published, publication date, and why it may be relevant. Submission does not imply guaranteed inclusion.

Submit a source