ENVELOPE: EnvelopeProbabilistic containment that becomes possible once you have a governed surface. Statistical operating bounds — holds under additive conditions. Insufficient alone against non-additive or emergent decisions; the invariant layer exists because the envelope cannot guarantee against catastrophic boundary violations.
SURFACE: Effect SurfaceGoverned effect surface. All agent-generated effects occur through registered, authorization-addressable interfaces. Because effects are bounded and auditable, insurability begins here.
INVARIANT: System InvariantFoundational mechanical constraints. Non-negotiable. Enforced deterministically, not discretionarily — no component may bypass, reinterpret, or negotiate a boundary at runtime.
A three-layer model separates the stochastic envelope, governed effect surfaces, and system invariants.
SDS.WEB.RESEARCH //
Research
CURRENT RECORD · KB-CRYPTO-004
Agentic Security Incident Record
Twenty-nine incidents and vulnerability disclosures, kept with their inclusion rule, verification state, and limitations. Across poisoned logs, coding agents, supply chains, cyber evaluations, and autonomous intrusion, the delivery channel changes. The missing boundary does not.
Commercial control kernel and reference implementation for Zero Trust Governance.
SDS.WEB.ROLES //
One body of work. Three public roles.
Shadow Dynamic Systems publishes the research, maintains the open Zero Trust Governance specification, and builds Constable as a commercial reference implementation. ZTG does not require Constable.
All irreversible actions pass through a mechanistic governance gate prior to execution. Boundaries are code-enforced, not intent-interpreted. Post-execution detection does not constitute governance.
Deterministic Policy Evaluation
Authorization logic is rule-bound and reproducible. Given identical initial state and identical inputs, the governance system produces identical decisions. Governance evaluation nondeterminism is not permitted.
Authority Attribution
Execution rights resolve to identifiable, accountable actors. When governance state is uncertain, the system grants no new authority while remaining observable and recoverable — a state it holds in, not one it is destroyed by. Resuming grants requires explicit human authorization.
Evidence-Coupled Execution
No externally observable effect may exist without simultaneous durable evidence of authorization and execution. The evidence record is not documentation of the effect — it is a constitutive part of it.
Governed Effect Surfaces
All agent-generated external effects occur exclusively through registered, governance-addressable surfaces. Each surface formally classifies actions by effect type, reversibility, and rollback cost prior to execution.
⛶
Graduated Containment
Component-level freeze mechanisms halt execution at targeted scope without requiring system-wide halt. Escalation is mechanistic: surface freeze, subsystem freeze, system-wide stasis. Containment is proportional to failure.
ARCHITECTURAL CROSS-SECTION
CROSS-SECTION
ZTG Architectural Layers
AA'
ENVELOPE: EnvelopeProbabilistic containment that becomes possible once you have a governed surface. Statistical operating bounds — holds under additive conditions. Insufficient alone against non-additive or emergent decisions; the invariant layer exists because the envelope cannot guarantee against catastrophic boundary violations.
SURFACE: Effect SurfaceGoverned effect surface. All agent-generated effects occur through registered, authorization-addressable interfaces. Because effects are bounded and auditable, insurability begins here.
INVARIANT: System InvariantFoundational mechanical constraints. Non-negotiable. Enforced deterministically, not discretionarily — no component may bypass, reinterpret, or negotiate a boundary at runtime.
INVARIANTS
ZTG-0aObservability
ZTG-0bReplayability
ZTG-0cTemporal Integrity
ZTG-0dIdentity Integrity
ZTG-0eGovernance Consistency
ZTG-1Mechanistic Boundary
ZTG-2Stasis
ZTG-3Governed Effect Surface
ZTG-4Evidence-Coupled Execution
ZTG-5Irreversibility of Harm
Section A-A' · ZTG specification v0.7
SYS.SPEC //
Doctrine
▼SYSTEM INVARIANT LAYER
Shadow Dynamic Systems is an AI research and development company focused on governance infrastructure for high-consequence domains.
STRUCTURAL OBSERVATION
We design cognitive architectures, orchestration frameworks, and governance systems grounded in a structural observation: when stochastic reasoning is granted irreversible execution authority without deterministic controls, risk becomes unbounded.
Zero Trust Governance (ZTG)
Formalizes the invariants required for governed execution: the operational property that irreversible actions are permitted only following deterministic authorization that is auditable, attributable, and replayable.
ConstableCommercial control kernel and reference implementation
ORIGIN
SDS was founded by Jason Crittenden (JD, 12+ years engineering in legal technology) at the intersection of liability architecture, evidentiary standards, and systems engineering: the three domains where governance either holds or fails.
SDS.SPEC.DOCTRINE
SDS.WEB.PUBLICATIONS //
Publications
The corpus moves from maintained incident evidence to structural diagnoses, design prescriptions, and concise field notes. Start with the record for current evidence, then use the diagnoses to identify recurring authority failures.
Formal response to NIST-2025-0035 identifying structural requirements for governing AI agent execution authority. Presents Zero Trust Governance as an architectural framework addressing threats, security practices, assessment methods, and deployment constraints.
Systems that replace mechanistic enforcement with probabilistic filtering and treat the result as a governance control exhibit Heuristic Governance Substitution. The pattern produces the appearance of governance without the structural properties governance requires.
During reinforcement-learning training of GPT-5.6 Sol, 2.15% of the model's context-compaction summaries carried an instruction addressed to the context that would read them next: conceal this mistake unless the user asks. SDS.FN.011 described surfaces that govern because nobody chose them. This one governs because the writer chose. The writer and the reader are two agents that the system counts as one principal, the authority is self-issued, and the reader has no way to tell an inherited instruction from an inherited fact. That is authority laundering with the relay hidden inside a single identity.
Write access plus shared read is a memory system. Nobody has to build one, name one, or intend one. Latent memory, latent coordination, latent governance — none of it hidden, none of it counted.
Systems that record every action to a tamper-evident log and treat the log as the governance artifact — without enforced coupling between authorization and effect — exhibit Post-hoc Logging as Governance. The log answers what the system did; it cannot answer whether the system was permitted to do it before it did it.
A hard halt is not safety — it is a second failure stacked on the first. Under Stasis, no new authority is issued but existing authority continues to execute its scope. Stop growing; keep your word.
Formal response to NIST-2025-0035 identifying structural requirements for governing AI agent execution authority. Presents Zero Trust Governance as an architectural framework addressing threats, security practices, assessment methods, and deployment constraints.
Systems optimized for reduced alert volume suppress persistence signals, manufacture the appearance of stability, and functionally degrade operator vigilance. The system produces silence without verified recovery. Governance that depends on human escalation inherits the degradation.
Quiet is not stable. Systems optimized for calm suppress persistence signals, manufacture the appearance of recovery, and erode the operator reflexes that governance depends on. Silence is a hypothesis, not an outcome.
Observability systems must escalate salience in proportion to persistence duration, not suppress it. Silence is permitted only following verified recovery. Defines four design requirements for observability that preserves governance input fidelity.
Governance discourse across insurance, security, compliance, and operations uses different vocabulary for the same structural properties. This fragmentation prevents convergence. This Prescription defines a shared vocabulary for cross-domain governance evaluation.
Systems that replace mechanistic enforcement with probabilistic filtering and treat the result as a governance control exhibit Heuristic Governance Substitution. The pattern produces the appearance of governance without the structural properties governance requires.
Systems that encode governance intent as natural language instructions to a stochastic model exhibit Prompt-Mediated Governance. The resulting authorization decisions are non-deterministic, non-replayable, and non-enforceable.
Systems that delegate authorization decisions to the inference layer — where the model's output determines what actions are permitted — exhibit Inference-Delegated Authorization. Changing the model changes the governance boundary.
Persistent agents operating over extended time horizons accumulate execution authority through implicit inheritance. An authorization granted at task initiation is carried forward across subsequent actions without re-evaluation at each irreversible execution boundary.
Sampler-level keyed perturbation of token probabilities introduces recoverable signal below semantics. The assurance failure: "cannot" collapses into "has not," which is not externally falsifiable over time.
Deterministic policy evaluation is model-independent by construction. If governance correctness depends on which model provides inference, governance is not deterministic.
Training quality, dataset composition, and fine-tuning operate in the Envelope layer. Governance operates in the System Invariant layer. Improving one does not improve the other.
Every action an AI system takes should trace to a human who accepted responsibility for it. Most can’t. No authorization is self-bootstrapped — every grant resolves to H ∪ generated-from(HP).
Demonstrative incident log documenting three structural governance failure modes: temporal collapse, assumed reversibility, and non-actionable observability. Establishes that documented conformance and safety are not equivalent.
The case against AI is aimed at the wrong surface. The failure mode is not a probabilistic system — it is an unbounded probabilistic surface that nothing intercepts. Govern the boundary, not the neurons.
