Decide what AI is allowed to do — before it does it.
InvarOS is built on a native Governance Engine that authorizes agent actions before execution. Every decision is a categorical verdict against an immutable policy snapshot — not a probability score — and every decision produces cryptographic evidence. Governance is the only authority; mathematics evaluates but never authorizes.
A Decision is a function, not a guess.
A governed request is normalized, bound to one immutable Snapshot, evaluated through capability, topology, and policy gates — and, when the Snapshot declares a constraint, through the mathematical evaluator — and resolved to a single categorical Decision.
Governance Request
agent action, normalized
Immutable Snapshot + Session
policy IR · capability catalog · topology (TBoM) · constraints
Gates: capability · topology · policy
deterministic pre-execution evaluation
Math Gateway → Enterprise Math Provider
structural_legality · evaluates, never authorizes
Decision Receipt + Governance Transaction
signed evidence for every created transaction
Governance Engine milestones 0–6 implemented and committed. build-v2 native governance suite passing (454/454 CTest at last full run; 458/458 enterprise regression re-run during deployment qualification, July 2026).
Governance decides. Mathematics evaluates.
The two are deliberately separated. The Governance Engine is the sole authorization authority. The mathematical core is a required evaluator reached only through the Math Gateway — it returns a structural verdict and never issues an authorization.
When policy needs mathematics, mathematics is on the decision path.
A Snapshot constraint is the only thing that triggers mathematical evaluation. When one is present, the Governance Engine constructs a bounded constraint request, invokes the Enterprise Math Provider, validates the returned fingerprints and metadata, and maps the structural result into the Decision. This is a real Continuous-Time Markov Chain (CTMC) core, not a heuristic.
Iterative validation
Canonical hashing and evidence / refusal receipts that establish that a governed execution occurred.
Sparse structural validation
Deterministic graph-legality checks on the declared topology, with no heavy numerical dependencies. This is the evaluator connected to governed decisions today.
CTMC consequence modeling
Deeper stochastic-process analysis over the model. The architecture is published; the solver internals are protected IP.
The verification core is exposed through a stable C ABI isolation boundary; the solver implementation is confidential. 573/573 native math-core tests passed (July 2026).
Governance that cannot fall back to a weaker path.
A deployment can be built in a canonical Governance-only configuration. In that build the earlier lightweight marker evaluator is removed at compile time, and any configuration whose Governance authority is not enabled is rejected. There is no alternate authorization path to fall back to — the deployed system decides through native Governance or it does not run. This is the configuration used by the deterministic deployment lifecycle.
Every decision leaves a record.
Governance produces durable, structured artifacts — not transient log lines. Each can be inspected, cryptographically verified, and referenced by fingerprint.
Decision Receipt
A signed record of the Decision, bound to the request, transaction, Snapshot, and — when present — the mathematical verdict. Produced for every created transaction.
Authorization Lease
Issued only for ALLOW. Single-use, correlated to the exact tool call, and consumed through a claim → complete / abort / expire lifecycle. An expired or already-claimed lease cannot re-authorize.
Refusal, as an artifact
A DENY is a first-class, classified governance object carrying a refusal code and layer — a policy refusal is categorically distinct from a topology or attestation refusal.
Fail-closed by default
Translation, transport, timeout, invalid-result, or missing-evaluator conditions resolve to DENY. The safe state is the default state.