Research Index

AOI Runtime Governance Evidence Map

A continuously maintained index of primary research, technical architectures, standards, market developments, and adjacent work contributing to the emerging discipline of Runtime Governance.

The map catalogs supporting, overlapping, adjacent, and challenging work. Inclusion does not imply endorsement.

The Evidence Map describes the state of the literature, not the state of AO Integrity.

Schema v744 sources9 claims

Corpus facts

Derived from stored corpus records.

44

Total sources

35

Primary sources

0 external contributions recorded.

Classification metrics

Counts depend on AOI's current taxonomy.

25

Overlap flagged

23

Challenge or complicate

Claim Map

Stored claims and source relationships.

Coverage statements are rendered exactly as stored in the Schema v7 corpus.

ClaimLabelTypeCoverageSources
EL

Execution Legitimacy

Whether a specific execution remains a legitimate exercise of conferred authority at the moment it occurs. The five conditions operationalize this determination.

determinationFourteen sources. Three added 2026-08-03, all as support or complement rather than competition: aviation dispatch release as a two-party determination made against current conditions, financial settlement finality as an ex ante determinate irrevocability point, and certificate-bound admission as a conditional-execution model. Support remains strongest from outside AI. Competing treatments continue to address individual conditions rather than the integrated five.
RA

Runtime Admissibility

The determination of whether execution should proceed right now. Not whether memory, data, context, or a consequence is admissible — those may be inputs or subordinate questions, but RA governs execution.

gateTwenty-one sources. Six added 2026-08-03. The certificate-bound admission and execution pair (arXiv 2606.11632, 2606.20520) is the corpus's first two-paper treatment separating proposal, admission, and execution with a signed artifact carried between them, with prototype measurements on AWS and Kubernetes. Foundational support continues to come from runtime verification and monitorability literature, now joined by financial settlement-finality standards on the ex ante determinacy of the irrevocability point. No enterprise-scale operational case study found.
AC

Authority Continuity

The preservation of valid, correctly scoped, and traceable authority across identity, delegation, context, and execution as conditions change over time. Broader than delegation-chain correctness: includes whether authority remains legitimate through the interval between grant and effect.

continuityTwenty sources. Four added 2026-08-03. arXiv 2607.23586 addresses grant survival under agent mutation under the name authorization continuity, with a fixed transition envelope and effect ceiling; arXiv 2606.20520 revalidates against live state at execution rather than at grant. Aviation dispatch regulation (14 CFR 121.533 and 121.663) supplies a long-standing regulatory analogue in which release authority is joint, continuously revisited between release and completion, and non-delegable at the dispatch level. Catalogued treatments continue to address subsets of the claim: agent mutation, infrastructure state, or delegation structure, rather than authority across identity, delegation, organizational context, and execution together. Delegation chains remain structurally representable without non-widening enforced by construction in any deployed standard.
AD

Authority Drift

The divergence, over time, between authority a system retains and the authority current organizational circumstances would justify. Not privilege accumulation — a technically correct entitlement may still be illegitimate in current context.

failureThree sources, unchanged this week. No competing treatments found, and none of the seven sources added 2026-08-03 competes with the canonical definition. arXiv 2606.20520 checks live-state drift at execution against a certified contract, but that comparison is infrastructure state against a contract rather than retained authority against current organizational circumstances, and it was not tagged AD. No standardized business-state event vocabulary exists. No unit of measure, continuous formulation, or threshold located in any source. AD remains the thinnest claim in the corpus by competing coverage and an open search lane.
CD

Capability Drift

Change in an autonomous system's effective ability to produce consequences without a corresponding reevaluation of the authority governing those capabilities. Arises through learned skills, tool composition, memory, model updates, reusable behaviors, delegation, or environmental change.

failureThree sources, up from one. Two added 2026-08-03 substantively address capability evolution rather than state persistence: a state-bound authorization model that fixes an immutable effect ceiling at grant time and proves that mutation cannot amplify protected effects beyond it, where the mutations enumerated include acquiring skills and tools, revising workflows, and delegating work (arXiv 2607.23586); and a lifecycle-time upgrade governance pipeline with interface, policy, behavioral, and recovery compatibility checks, gated activation, shadow deployment, online monitoring, and rollback, measured on an embodied-agent testbed (arXiv 2604.08059). Both report formal or quantitative results; neither uses the term Capability Drift. A third source added this week, arXiv 2605.26542, is catalogued under AC and RA rather than CD: it governs authority attenuation across a composed tool chain within a session, which is adjacent compositional attenuation rather than change over time in effective ability to produce consequences. Still absent from the record: any enterprise deployment case study, any continuous measure or threshold for capability change, and any treatment tying capability change to organizational rather than technical authority.
GE

Governance Evidence

Independently reviewable evidence showing what legitimacy determination was made, which authority and contextual signals informed it, and why the execution was permitted, denied, escalated, or attested. Logs may contribute evidence; event records alone do not establish governance reasoning.

evidenceThirteen sources. Three added 2026-08-03. Signed decision and outcome records bound to a certified execution contract (arXiv 2606.20520) and evidence-digest binding at admission (arXiv 2606.11632) extend the catalogued set of cryptographically bound evidence models. The signed dispatch release under 14 CFR 121.663 is the corpus's first regulatory instance of a governance artifact that two named parties must both sign before an operation may begin. Regulatory demand remains documented with no finalized technical standard.
OBJ

Evaluation Object

The composite execution event: principal, delegation chain, agent, action, target, context, intent, and provenance relevant to a specific execution. Treated as an adopted and refined architecture choice, not a novelty claim.

designNine sources. One added 2026-08-03: arXiv 2606.11632 compiles agent proposals into typed execution contracts bound to evidence digests and policy versions, adding a fifth independent 2026 work locating governance at an execution, admission, or bind boundary.
PE

Policy vs Enforcement

The distinction between governance that is declared and governance that is operationally established in the execution path. A supporting claim, not AOI-originated.

supportingWell covered externally. Primary source is Cavallo's described-versus-established framing; supported by practitioner and distributed-systems material.
MKT

Market Conditions

External technical, regulatory, operational, and commercial developments that increase the need for Runtime Governance but do not themselves establish its architecture.

contextAmple. NHI ratios, over-permissioning rates, IAM capability gaps, and regulatory timelines all documented from multiple sources.

Showing 9 of 44 sources.

Clear filters

e003

DEMM-Bench: A Cross-Regime Benchmark for Agent-Runtime Governance-Evidence Sufficiency

Permalink
Source
arXiv 2606.20634
Source type
research
Primary or secondary status
Primary
Domain
Evidence
Published
2026-06
Claims
GE
Conditions
EV
Stance
complicates
Relation
complements
Strength
emerging
Overlap flag
naming_collision

Benchmark accompanying the Decision Evidence Maturity Model. Uses 'agent-runtime governance-evidence' as a compound term. Provides executable categories for classifying evidence sufficiency, making the property measurable rather than asserted. Bears on GE and on the metrics discussion in Section 6.6.

Original link

e007

OpenID Foundation advances authorization for the agent era with new AuthZEN Working Group Drafts

Permalink
Source
OpenID Foundation
Source type
standard
Primary or secondary status
Primary
Domain
Identity
Published
2026
Claims
AC, EL
Conditions
3.2, 3.4
Stance
supports
Relation
complements
Strength
supporting
Overlap flag
absorption

AuthZEN Final in January 2026. New AARP draft addresses what happens when policy cannot authorize yet because a prerequisite — approval, consent, delegated authority, attestation, risk assessment, or justification — must first be satisfied. Supports the claim that the gap is upstream of the decision point; also shows the gap being actively closed.

Original link

e012

OpenID Connect Agent Identity Claims for Autonomous AI Agents

Permalink
Source
IETF draft-sharif-openid-agent-identity-00
Source type
standard
Primary or secondary status
Primary
Domain
Identity
Published
2026-03-26
Claims
AC
Conditions
3.1, 3.2
Stance
complicates
Relation
complements
Strength
emerging
Overlap flag
absorption

Profile of OIDC Core enabling IdPs to issue identity tokens for autonomous agents. Strengthens coverage of conditions 3.1 and 3.2, narrowing the thesis to 3.3-3.5 as intended by Section 3.7.

Original link

e022

State-Aware Runtime for Long-Horizon LLM Agents: A Conceptual Framework and Research Agenda

Permalink
Source
Cambridge Open Engage
Source type
research
Primary or secondary status
Primary
Domain
Memory/State
Published
2026
Claims
AD, CD, RA
Conditions
3.3
Stance
supports
Relation
complements
Strength
emerging
Overlap flag
none

Conceptual framework and research agenda for state-aware runtime across long-horizon agent operation. Bears on AD and on the Section 6.1 assumption that business systems can be consulted at execution latency. CD tag is provisional: the source addresses state persistence, and qualifies for CD only where it substantively treats capability evolution.

Original link

e023

Agency doctrine: actual authority, apparent authority, and ratification

Permalink
Source
Oxford Business Law Blog
Source type
legal_doctrine
Primary or secondary status
Primary
Domain
Legal
Published
2025-04
Claims
EL, AC
Conditions
3.2, 3.4
Stance
supports
Relation
complements
Strength
foundational
Overlap flag
none

Governance analogue and legal foundation rather than a doctrinal conclusion about software agents. Actual authority, apparent authority, and ratification establish that possession of apparent permission does not prove actual authority; that third parties may act on authority that is operationally credible but institutionally defective; and that later acceptance of an act differs from prior legitimacy. Apparent authority resembles the structure of Appendix C.1, though prompt injection and delegated software action are not doctrinally identical to it absent jurisdiction-specific authority. Ratification is the closest legal analogue to Section 5.2 post-hoc attestation, including its all-or-nothing character.

Original link

e029

Authenticated Delegation and Authorized AI Agents

Permalink
Source
arXiv 2501.09674
Source type
research
Primary or secondary status
Primary
Domain
Identity
Published
2025-01
Claims
AC
Conditions
3.2
Stance
supports
Relation
complements
Strength
supporting
Overlap flag
none

Earlier work connecting agency-law delegation concepts to authenticated agent authorization. Useful bridge between the Legal domain entries and the identity standards track, and evidence that the legal framing is already being imported by researchers.

Original link

e039

ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation

Permalink
Source
arXiv 2605.26542 (Jiang et al.; AIWILD workshop, ICML 2026)
Source type
research
Primary or secondary status
Primary
Domain
Runtime
Published
2026-05
Claims
AC, RA
Conditions
3.3, 3.5
Stance
complicates
Relation
complements
Strength
supporting
Overlap flag
prior_art

Names permission laundering: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, because a restricted value is transformed, mixed, or rewritten before reaching a sink it should not reach. Enforces a runtime invariant in which every value carries a sink-specific authority budget and tool composition propagates budgets by intersection, so a value may lose but never gain authority through composition; states and proves a non-amplification theorem to that effect. Implemented as a transparent MCP proxy requiring no change to agent or tool servers; reports attack success falling from 25-68 percent to 0-4.8 percent across five frontier models on an 82-task suite, with manifest authoring quality, not runtime overhead, identified as the binding deployment constraint. The mechanism governs authority attenuation across a composed tool chain within a session rather than change in an agent's effective ability to produce consequences over time. The paper positions itself as complementary to execution-boundary mechanisms, which it says constrain execution while ChainCaps constrains the authority of derived values. Vocabulary in use that overlaps AOI's: monotonic capability attenuation, authority propagation, declassification. Bears on AC, RA, condition 3.5, and the compositional material in Appendix C.4.

Original link

e040

Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with Embodied Agents as Case Study

Permalink
Source
arXiv 2604.08059
Source type
research
Primary or secondary status
Primary
Domain
Robotics
Published
2026-04
Claims
CD, RA
Conditions
3.1
Stance
complicates
Relation
complements
Strength
supporting
Overlap flag
naming_collision

Formulates governed capability evolution as a software-lifecycle problem: when a capability module evolves into a new version, the hosting system must decide whether the new version may be activated, under what deployment conditions it runs, how it is monitored, and when it is rolled back. Introduces four upgrade compatibility checks (interface, policy, behavioral, recovery) staged into a pipeline of candidate validation, sandbox evaluation, shadow deployment, gated activation, online monitoring, and rollback. Reports that naive upgrade reaches 72.9 percent task success but drives unsafe activation to 60 percent by the final round, while governed upgrade retains 67.4 percent success with zero unsafe activations, and that shadow deployment reveals 40 percent of upgrade regressions invisible to sandbox evaluation alone. States its contribution as extending runtime governance from action execution to capability evolution; the checks are lifecycle-time and pre-activation rather than per-execution. The source's terms are governed capability evolution and runtime governance; it does not use the term Capability Drift. Bears on CD and on the reversibility material in Section 5.3.

Original link

e044

Principles for financial market infrastructures - Principle 8: Settlement finality

Permalink
Source
CPSS-IOSCO / CPMI-IOSCO, PFMI (CPMI Papers No 101)
Source type
standard
Primary or secondary status
Primary
Domain
Financial Systems
Published
2012-04-16
Claims
EL, RA
Conditions
3.5
Stance
supports
Relation
complements
Strength
foundational
Overlap flag
none

Governance analogue from financial market infrastructure standards, not a doctrinal claim about software agents. Principle 8 requires that an FMI provide clear and certain final settlement, at a minimum by the end of the value date, and intraday or in real time where necessary or preferable. The accompanying legal-basis discussion states that there should be a clear legal basis regarding when settlement finality occurs, in order to define when key financial risks are transferred, including the point at which transactions are irrevocable, and treats settlement finality as a building block for risk management rather than a bookkeeping detail. Establishes an existing international standard requiring that the moment at which an action becomes irrevocable be defined ex ante and be legally determinate, including under participant insolvency. The standard governs the determinacy of the finality boundary; it does not specify evidence of a governance determination, and the entry is therefore not tagged GE. Bears on the reversibility-based allocation in Section 5.3 and on the treatment of the consequence-formation boundary; complements the compensating-transaction material catalogued at e027.

Original link

Methodology

How to read this map.

AO Integrity maintains the corpus and performs the classifications. Classification is interpretive. Total, primary, and externally contributed counts are corpus facts. Other metrics depend on the current taxonomy. Records can be corrected or withdrawn. Stable evidence IDs are never renumbered or reused. Withdrawn records remain addressable.

Contribution

What are we missing?

The corpus is intended to include work that supports, overlaps with, complicates, or challenges the Runtime Governance thesis. Sources that make the thesis less comfortable are especially useful.

Please include the source title, original URL, author, organization, or venue as published, publication date, and why it may be relevant. Submission does not imply guaranteed inclusion.

Submit a source