PAPER B · v17 · Ernest Chiweshe · LumiWright
Governed AI as Runtime Infrastructure: A Unified Authority and Evidence Architecture for Regulated Agentic Systems
First published 22 October 2026 on Zenodo. Current version published 27 October 2026.
Abstract
Enterprise adoption of autonomous agentic AI in regulated industries requires deterministic proof of authority, non-repudiation, and auditability. We present the implementation, formal protocol specification, and empirical evaluation of the Executable Assurance runtime. The architecture decouples application logic from governance enforcement: an immutable domain-agnostic core runtime is specialized dynamically through domain packs across healthcare, financial settlement, algorithmic lending, legal due diligence, and public procurement.
We evaluate the architecture against two operational signing protocols: (1) managed cloud-native scale using AWS Key Management Service (KMS), and (2) dedicated tamper-resistant hardware security using single-tenant AWS CloudHSM (FIPS 140-3 Level 3). In a continuous 24-hour soak test governing 854,100 consecutive decisions across 2,847 batches, the system maintained flat throughput with zero failed batches and zero permit leakage. Under ten deliberate fault-injection drills—including simulated key revocation, storage outages, and receipt tampering—the runtime strictly adhered to fail-closed invariants, aborting releases before any byte reached external boundaries. Every approved decision, policy evaluation, and refusal is anchored in DSSE (Dead Simple Signing Envelope) signatures and written to WORM-compliant S3 Object Lock storage, producing four verifiable projections for machines, regulators, auditors, and affected persons.
Related
Paper A: Capability Is Not Authority · The reference implementation on GitHub · The videos
Cite as: Chiweshe, E. (2026). Governed AI as Runtime Infrastructure: A Unified Authority and Evidence Architecture for Regulated Agentic Systems. Zenodo. https://doi.org/10.5281/zenodo.23581015