Architectural Governance Models

Definition

ISDAIRE defines the irreducible ex-ante conditions for a governed action class: declared intent and scope, structural domain separation, explicit authority sources, irreversibility awareness, ex-ante risk framing, and a sharp execution boundary between proposal and commitment—without which governance cannot exist before runtime.

What it does

ISDAIRE establishes:

• Intent. The system must have an explicit, machine-legible action-purpose declaration for the action class, represented as a finite declared intent specification whose admissible intents are versioned and governance-controlled. Without declared intent, authority and scope cannot be bounded.
• Scope. What the system is allowed to affect for that class must be defined in advance. Undefined scope makes authority leakage inevitable under scale or load.
• Domain separation. Reasoning, data access, decision logic, and execution must be implemented as structurally distinct components or control surfaces with non-identical authority domains and no undeclared privilege collapse across those surfaces. Without such separation, authority collapses into automation.
• Authority source. The origin of authority must be explicit (human role, policy instrument, contract, regulator). Authority without a source cannot be validated, renewed, or revoked.
• Irreversibility awareness. The system must deterministically classify which actions cross an irreversible boundary, and identify the corresponding execution boundary for those actions.
• Risk framing. The action class must declare an ex-ante risk function, threshold regime, or finite risk-tier mapping sufficient to determine refusal, fallback, or escalation conditions without post-hoc reinterpretation. Otherwise escalation is always late.
• Execution boundary. There must be a clear transition between proposal and commitment. Governance only becomes real at this boundary.

Why it matters

If these conditions are not defined before execution, governance cannot be constructed later.

Runtime controls, monitoring, or policies cannot compensate for missing structural definitions. The system may function, but it is not governed.

Definition

ARETABA defines the minimum execution-time control surface required for governance to operate under real conditions.

What it does

ARETABA enforces:

• Authority. Who may act, under what scope, and for how long.
• Refusal or Halt. The ability to stop execution when conditions are not met.
• Escalation. Mandatory transfer of decision authority when required.
• Traceability. Reconstruction of decisions and their causal chain.
• Accountability. Attribution of responsibility at decision time.
• Boundary definition. Explicit limits on system operation.
• Admissibility. Enforcement of allowed inputs and actions.

Why it matters

Governance that cannot execute under pressure is not governance. It becomes descriptive rather than causal.

ARETABA ensures governance is enforceable, non-bypassable, and capable of failing closed.

Definition

GAG governs how authority behaves across composed systems, ensuring it remains valid, bounded, and non-amplifying.

What it does

GAG ensures:

• authority provenance is preserved across system boundaries
• admissibility is not weakened through delegation
• authority does not silently expand or drift during composition

Why it matters

Systems that are locally compliant can still produce globally invalid outcomes if authority is not preserved across boundaries.

GAG prevents this failure mode.

Definition

MGAG extends GAG across multiple technical, organisational, and regulatory layers.

What it does

MGAG governs:

• authority transfer across layers
• escalation pathways between layers
• refusal propagation across systems
• audit survivability across boundaries

Where it applies

• multi-agent systems
• multi-vendor architectures
• orchestrated AI workflows
• regulated environments requiring layered accountability

Why it matters

In layered systems, governance often fails at the seams. MGAG addresses these failure points directly.

Definition

OTANIS is an execution-time architectural governance system that integrates ISDAIRE, ARETABA, GAG, and MGAG into a single enforceable structure for governing agentic AI at the point of irreversibility.

It represents the full Architectural Governance (AG) model, where ex-ante definition, execution-time enforcement, and cross-system authority preservation operate as a unified system.

What it integrates

OTANIS is not a standalone model. It is the integration layer that makes the other models operational:

• ISDAIRE defines the ex-ante conditions required for governance to exist.
• ARETABA provides the execution-time control surface required for governance to operate.
• GAG ensures authority remains valid across composed systems.
• MGAG ensures governance survives across multiple technical, organisational, and regulatory layers.

OTANIS binds these layers together and enforces them at execution time, where actions become irreversible.

Core principles

• Governance executes at the point of irreversibility, not before and not after.
• Authority is explicit, bounded, and independently verifiable.
• Admissibility is defined ex-ante and enforced at execution.
• Governance is non-bypassable and fails closed.
• Accountability is grounded in evidence produced at decision time.

Key distinction: audit logs vs authority evidence

OTANIS draws a strict distinction between:

• Audit logs. Records of what happened.
• Authority evidence. Proof that an action was permitted to happen.

Audit logs support investigation. Authority evidence establishes legitimacy.

A system may have complete logs and still act without valid authority. OTANIS addresses this gap.

Why OTANIS is the complete AG model

Individually, ISDAIRE, ARETABA, GAG, and MGAG define necessary components of governance.

OTANIS is what makes governance executable.

It ensures that:

• definitions established ex-ante are enforced at runtime,
• authority remains valid across system boundaries,
• and actions cannot commit unless all governance conditions hold at the point of irreversibility.

Without OTANIS, these models remain structurally incomplete.

Suitability

OTANIS is designed for systems where actions have real world consequences, including:

• agentic AI systems
• high-autonomy decision systems
• multi-agent orchestration environments
• regulated or high-consequence operational systems

See also: OTANIS suitability by system type.

Why OTANIS scales with advanced systems

OTANIS governs execution, not cognition.

• Authority is external to the model and cannot drift with optimisation.
• Execution is gated at defined irreversibility boundaries.
• Authority is time-bound and must be revalidated.
• Governance remains auditable without requiring access to internal reasoning.

This allows OTANIS to remain applicable as systems increase in autonomy and complexity.