Executive briefA policy matters when it changes a consequential path

An enterprise policy says that sensitive personal data must not enter a general-purpose model. A team copies the sentence into a system prompt. The prompt is bypassed by a retrieval connector that has already assembled the data, and the model dutifully returns a refusal after the disclosure has crossed the boundary. The wording survived; the intended protection did not.

AI governance as executable constraint is the disciplined translation of authorised intent into a control that can alter a real decision or action at the right point, under known conditions, with evidence. The translation includes interpretation, not just coding. It names who issued the requirement, what it governs, which facts activate it, what must happen, where enforcement occurs, how exceptions work, what failure means and when the interpretation must be reconsidered.

The unit proposed here is the Governance Constraint Record. Its twelve fields connect a source requirement to an operational effect without implying that the source text is self-executing. The accompanying Constraint Execution Loop carries that record through tests, enforcement, receipts, outcomes, challenge and change. A Governance Placement Matrix prevents a control from landing after the point at which harm became irreversible.

Executable does not mean fully automated. Some requirements are determinate enough for a release gate, admission rule, redaction transform or tool interceptor. Others depend on disputed categories, proportionality, fairness, legal interpretation or human authority. In those cases the executable constraint is an obligation to gather evidence, halt the automated path and route the determination to an accountable person.

The strongest rival: governance is political and interpretive

The strongest objection is correct: governance cannot be reduced to a policy engine. Principles acquire meaning through interpretation, institutional authority, contest, facts and changing social expectations. Encoding a threshold may freeze a disputed judgement, obscure whose values prevailed and make a technical maintainer the accidental policy-maker. Therefore this design treats code as one instrument inside governance. The authorised interpretation remains visible, versioned and challengeable, while indeterminate decisions are explicitly reserved for humans.

Governance Constraint RecordTwelve fields keep authority and meaning attached to execution

A bare rule such as “deny when risk is high” hides nearly everything an operator needs. Who defined high risk? Which system, geography, user and purpose are in scope? Is the effect a prohibition, an obligation or a transformation? Can an incident commander override it? What evidence proves operation? What happens when the policy service is unavailable? A reliable constraint answers those questions before deployment.

Constraint Execution LoopA rule earns legitimacy through operation, evidence and revision

The loop begins with intent and interpretation, not syntax. Legal, policy, risk, product and affected operational voices establish the requirement's purpose and legitimate scope. The principal approves the interpretation. A control steward then produces the Constraint Record, tests and implementation. Separation between principal and implementer helps prevent a convenient technical detail from quietly becoming policy.

Testing occurs before exposure and again at the enforcement point. Design tests check internal consistency, known edge cases, discriminatory decompositions, missing facts and bypass paths. Runtime tests confirm that the actual policy version, inputs and enforcement action match the released record. Outcome review asks whether the protection occurred and whether burden, delay, false denial or displacement created another material harm.

A receipt closes the gap between evaluation and effect. It records constraint and implementation versions, effective time, principal, subject or transaction reference, trusted input references, result, reason category, enforcement point, action acknowledgement, exception, evidence location and challenge route. Sensitive raw content need not be copied into the receipt; controlled references and integrity identifiers may provide enough traceability with less privacy risk.

Challenge and change are normal states, not evidence of governance failure. A person may contest the facts, the rule's applicability, the interpretation or the authority. An incident may show that the selected fail-safe worsens harm. A policy amendment may conflict with an older release. Each event routes to the responsible principal, changes the version or scope if warranted, and triggers affected tests before the record returns to operation.

Conflicts need a defined resolution path because rule ordering is itself a policy choice. A privacy constraint may require minimisation while a safety investigation requires preservation; a local operating rule may collide with a newly effective enterprise standard. The engine should return an indeterminate conflict rather than select whichever rule happens to run first. The receipt carries both sources, their effective times, claimed precedence and affected action to the named principals. A temporary hold, safe queue or tightly authorised interim condition protects the situation while they resolve scope. The resolution becomes a new interpretation with impact analysis, versioned tests and explicit treatment of requests evaluated under the superseded rule.

Ownership is also distributed without becoming vague. The principal owns meaning and acceptable residual risk. The control steward owns faithful representation and test coverage. The system owner owns placement, availability and bypass resistance. Data owners attest labels and permitted uses. Operations owns response and recovery. Independent assurance examines whether the evidence supports the claim. People affected by the constraint need an intelligible notice and a route to correct facts or challenge treatment. These roles can sit in different functions, but every live record must connect them to one accountable decision path.

Governance Placement MatrixMatch lifecycle point to the effect that can still protect the outcome

Control placement determines whether a policy prevents, reduces, observes or merely documents harm. Design and release controls are suitable for prohibited architectures, missing evaluation evidence, unapproved models and invalid policy bundles. Admission controls govern who or what may invoke a capability. Context controls can exclude, minimise or transform retrieved material before it crosses a boundary.

Action interceptors stand between a model proposal and a consequential external effect. They verify identity, authority, amount, destination, freshness and required human approval without asking the same model that proposed the act to judge its own permission. Reconciliation controls compare intended and actual state after an action, detect partial failure or policy drift, and initiate containment, compensation or recovery.

No single layer is universally best. A release block can prevent broad exposure but may not see transaction facts. A runtime denial can respond to fresh context but adds dependency and latency. A post-action monitor can find subtle patterns but cannot undo every consequence. Defence in depth uses different control purposes, not the same weak test repeated at several layers.

Determinacy and authorityNot every governance requirement should become a machine verdict

Translation begins by separating determinate facts from interpretive questions. A model identifier, policy version, account role, approved region, data label or transaction amount can often be tested mechanically. Whether a social category is fair, an accommodation is reasonable, a legal exception applies or a person's interests justify an adverse determination may require contextual authority and deliberation.

A fairness objective is particularly dangerous when compressed into one threshold. Aggregate parity can conceal harm within intersections, time periods, locations or process stages. A decomposition tree moves from the stated concern to affected outcome, reference population, relevant groups, intersections, error types, exposure, burden and plausible mechanism. Statistics help reveal patterns; an accountable forum decides materiality, remedy and acceptable trade-offs.

The boundary is not simply human good, machine bad. Human decisions can be inconsistent, biased or poorly evidenced. The executable contribution may be to assemble a complete case, expose missing facts, enforce separation of duties, prevent premature action, capture reasons and guarantee appeal. Automation strengthens the decision process without claiming the mandate to settle the substantive judgement.

Reserve the determination for accountable human authority when the rule is materially ambiguous, facts are contested, stakes are severe or irreversible, the decision allocates rights or essential opportunity, or legitimacy requires reasons responsive to a person's circumstances. State the reserved question and authorised role. A vague “human in the loop” label does not show who may decide, what evidence they see or whether they can change the outcome.

Runtime enforcementSeparate proposal, policy evaluation and permission to act

A runtime path should distinguish the model's proposal from the system's authority. The model may draft a response, select a candidate tool or propose parameters. A trusted component assembles identity, purpose, entitlement, resource, action, environment and relevant policy versions. A policy decision point evaluates those structured facts. A separate enforcement point permits, denies, transforms, requires approval or contains the action.

Open Policy Agent's Rego and Cedar are examples of declarative approaches for reasoning about structured requests and authorisation. XACML defines an access-control policy language and processing model. These technologies can make decisions consistent and inspectable, but language choice does not establish the legitimacy of the policy. The principal, scope, input trust and enforcement integration remain governance questions.

Never rely on the governed model as the sole judge of its own permission. A prompt instruction can guide behaviour and provide a useful inner defence, yet it shares the model's failure modes and can be reached after sensitive context has already been disclosed. The independent interceptor should receive minimal trusted facts, deny unrecognised high-consequence actions, bind approval to exact parameters and prevent replay or substitution.

The policy engine's “allow” is necessary only within its declared control boundary. It does not prove that the business should act. Product checks, available funds, operational readiness, human approval, customer consent and legal authority may still be required. The final action receipt should therefore link the policy result to each additional permission and to the actual downstream acknowledgement.

Exceptions and failureA release valve must not become a second policy system

An exception is another governed constraint with a narrower scope and shorter life. It names the blocked objective, why ordinary compliance is impossible, authorised approver, affected population, compensating controls, start and end time, monitoring, revocation condition and retrospective review. An exception without expiry or population bound is a policy change disguised as an operational convenience.

The exception hourglass begins broad in evidence, narrows at approval and widens again in oversight. Requesters disclose the business need, alternatives, anticipated harm and duration. The authorised principal approves exact scope. Runtime enforcement attaches the exception identifier and still applies every unaffected constraint. Monitoring then checks use, outcome, drift and approaching expiry. Closure confirms revocation, remediation and lessons for the underlying policy.

Failure behaviour follows consequence, reversibility and time to harm. Fail-closed is appropriate when acting without a valid decision could create severe, rapid or irreversible harm and a denial or queue is tolerable. Fail-open can be justified for low-consequence, reversible service where refusal itself causes greater harm, provided exposure is bounded and reconciled. A safe state may reduce capability, route to a manual path, isolate a cohort or queue work with expiry.

Availability is part of control design. Policy data, clocks, identities and bundles can become stale or partitioned. Cache only decisions whose scope and lifetime are explicit. Sign and version bundles, reject unknown critical actions, exercise degraded modes, cap queues and expose uncertainty. A control outage should generate an incident and receipt, not a silent default hidden inside application code.

Evidence and assuranceA decision receipt must survive the system it explains

Evidence serves different lines of accountability. The operating team needs immediate reasons, health and remediation. Risk and compliance need population coverage, exceptions, tests and trends. Independent assurance needs immutable versions, sampling access, separation of duties and proof that the enforcement point acted. Executives need material exposure, unresolved challenges and outcome measures. One dashboard cannot substitute for these different questions.

NIST's AI Risk Management Framework and Playbook organise lifecycle activity around governing, mapping, measuring and managing risk. ISO/IEC 42001 describes an organisational AI management system. NIST SP 800-53 provides a broad control catalogue, while OSCAL offers machine-readable models for control catalogues, profiles, implementation and assessment information. These sources can structure the control environment, but the enterprise must still connect a given requirement to the specific operational decision it changes.

PROV-O can represent entities, activities and agents in provenance relationships. OpenTelemetry can carry correlated traces, metrics and logs. CloudEvents can provide an event envelope. SLSA supports supply-chain integrity claims for build artefacts. Used together, such mechanisms can link a policy source, signed bundle, evaluated facts, result, action and deployed component. They do not determine retention, lawful access, semantic correctness or whether the governing principal had legitimate authority.

Test the negative space. Can an unrecognised action bypass the interceptor? Does a stale entitlement remain cached? Can a lower environment sign a production bundle? Does a redaction happen before logging? Can an exception outlive its approver? Can the evidence store prove a denial as well as an allow? Does a policy update preserve treatment for in-flight work? Tests should include boundary, missing-data, conflict, concurrency, replay, degraded-mode and recovery cases.

Outcome measures ask whether the control protected its object without imposing unjustified burden. Track prohibited exposures, prevented actions, false denials, delayed legitimate service, exception use, appeals, reversals, unresolved receipts, stale versions and time to recovery. Disaggregate where the purpose requires it. A governance score would conceal incompatible dimensions and invite compensation between severe failures and easy successes.

Ten placement casesThe same principle produces different instruments at different points

The cases below demonstrate routing, not universal answers. Each starts with an authorised source and specific facts. The selected instrument is the earliest reliable control that can produce the intended effect while preserving a challenge path. Where interpretation or authority is unresolved, the automated system stops at evidence assembly and referral.

Interactive instrumentGovernance Constraint Placement Board

Select a case or change the record. The Board returns one of exactly five materially distinct outcomes. It does not score governance. The result completes the operative record, exposes insufficient alternatives and names the tests, authoritative inputs, failure behaviour, exception, receipt, outcome measure, principal and review date.

Operating boundaryCode carries authorised constraint; it does not create public legitimacy

The Governance Constraint Record, Constraint Execution Loop, Placement Matrix and Placement Board are this article's synthesis. They connect governance intent to operational effects while keeping interpretation, principal and challenge visible. They can be implemented with policy-as-code, workflow, release controls, data infrastructure, tool gateways and evidence services. The form matters less than whether the constraint can reliably alter the governed path.

OPA, Cedar and XACML illustrate structured policy evaluation. OSCAL supports machine-readable control and assessment information. PROV-O, OpenTelemetry and CloudEvents support different parts of traceability and event transport. SLSA can strengthen provenance for released policy artefacts. These mechanisms solve bounded representation or integrity problems. They do not prove that a source applies, a category is fair, an exception is justified or an authority is legitimate.

NIST AI RMF, its Playbook and Generative AI Profile provide voluntary risk-management guidance. ISO/IEC 42001 describes an AI management system, and ISO/IEC 23894 addresses AI risk management. The OECD AI Principles, the IIA Three Lines Model and the EU AI Act offer additional institutional, accountability and legal context. Applicability depends on organisation, role, system and jurisdiction; this design is not a legal determination.

Review constraints when the source, interpretation, model, data, action, population, geography, principal, policy engine, fact source, exception or observed outcome changes. Pin the specifications and policy artefacts actually used. Current source pages checked on 2 September 2026 include the NIST AI RMF Playbook, OSCAL, the OPA policy language guide, the Cedar guide, XACML 3.0 and PROV-O.

Operate constraints as a portfolio of obligations, not a league table. Show which protections lack placement, which determinations lack authority, which exceptions near expiry, which receipts cannot be reconciled and which outcome burdens require attention. A green average must never cancel one severe unauthorised action or hide a control that operates after irreversible harm.

The closing standard is simple to state and demanding to maintain: every important governance intent should have an accountable interpretation, an effective placement, tested failure behaviour, durable evidence and a real challenge route. When a matter cannot legitimately be settled by deterministic execution, the system must reserve it for a named human authority. Governance becomes executable when its protection reaches the action without losing the politics, reasons and responsibility that gave it meaning.

Source recordWorks cited

1. NIST. Artificial Intelligence Risk Management Framework.
2. NIST. AI RMF Playbook.
3. NIST. Generative Artificial Intelligence Profile.
4. NIST. SP 800-53 Rev. 5.
5. NIST. Open Security Controls Assessment Language.
6. ISO. ISO/IEC 42001.
7. ISO. ISO/IEC 23894.
8. European Union. Regulation (EU) 2024/1689.
9. OECD. OECD AI Principles.
10. Institute of Internal Auditors. The IIA's Three Lines Model.
11. Open Policy Agent. Policy Language.
12. Cedar. Policy Language Reference Guide.
13. OASIS. XACML Version 3.0.
14. W3C. PROV-O.
15. OpenTelemetry. Specification.
16. CloudEvents. Specification.
17. SLSA. Specification 1.2.