Corrective Completeness in AI Meta-Governance

A Candidate Architecture-Neutral Functional Decomposition for Reviewable, Consequential, and Robust AI Decision Regimes

Abstract

AI governance increasingly relies on constitutions, policies, evaluations, risk thresholds, safety cases, human oversight, audit procedures, access restrictions, escalation mechanisms, and rollback provisions. The presence of such mechanisms, however, does not by itself establish a complete governance architecture. A system may be extensively evaluated yet weakly governed if valid evidence cannot alter operational permission, if authority is structurally ambiguous, if governing assumptions are insulated from challenge, if correction cannot reach recovery or remedy, or if corrective mechanisms fail under repeated institutional pressure.

This paper introduces Corrective Completeness as a candidate conjunctive system property of AI meta-governance. It proposes an architecture-neutral decomposition of eight candidate corrective functions: bounded governance-object and intervention-scope definition; bidirectional decision derivability; epistemic defeasibility with explicit entrenchment discipline; non-self-sealing challenge; legible authority and control topology; consequential state control; recoverability and remedy interfaces; and reflexive governance review. These functions are supplemented by an applicability guard and a separate robustness operator that tests whether the corrective architecture remains operative, or degrades safely, across a pre-specified stress domain. Corrective Completeness is defined as a conjunctive architecture classification rather than a latent factor: the paper does not assume that the eight functions arise from one hidden variable or should covary empirically.

The individual functions have substantial antecedents in systems safety, quality management, organizational learning, experimentalist and meta-governance, contestability, recourse, corrigibility, assurance, and AI management standards. The contribution claimed here is therefore not first invention of those components. It is their joint decomposition as an end-to-end correction architecture, the explicit separation of documented structure from observed execution and independent outcomes, and a falsifiable test program for function-level necessity, robustness, and counterexample.

The framework distinguishes specification-level completeness from observed operational execution and from demonstrated governance effectiveness. An exploratory author-coded development-set mapping of major AI-governance frameworks and adjacent technical approaches, using public materials current through 11 August 2026, suggested recurring functional motifs but did not establish independent convergence. After the observable-signature codebook was frozen, a five-case documentary holdout sensitivity test used previously unused official sources without changing the coding criteria. The first coding and a conservative same-model re-reading agreed on applicability in 40 of 40 cells and on documentary status in 38 of 40 cells; after adjudication, C1 and C4 met a pre-specified strong specification-recurrence threshold, all eight functions met a broad recurrence threshold, and the 90% PASS-D saturation warning was not triggered. Because the second reading was not independent, this is sensitivity evidence only—not inter-rater validation, operational Corrective Completeness, or comparative effectiveness. The paper therefore retains an empirical test architecture based on activation opportunities, independent coding, observed execution, independent governance outcomes, stress testing, functional-equivalence rules, controlled ablation, and explicit counterexample criteria.

The resulting empirical program is deliberately conditional and falsifiable: for each applicable function, activated cases lacking that function or a pre-specified functional equivalent are hypothesized to exhibit a higher incidence or severity of the corresponding failure class than comparable cases, and targeted restoration of the missing function should outperform non-targeted strengthening of unrelated controls. The Central Equilibrium Problem is treated separately, not as a necessary component of governance, but as a candidate explanation for persistent non-correction when a structurally adequate corrective architecture fails to remain operative under repeated strategic or institutional pressure.

Keywords: AI governance; meta-governance; corrigibility; contestability; algorithmic recourse; systems safety; organizational learning; experimentalist governance; decision architecture; institutional correction; robustness; AI assurance; operational governance.

Part I — From Governance Artifacts to Corrective Architecture

1. Introduction: When Does AI Governance Become Governance?

Advanced AI systems increasingly operate inside environments rich in formal control mechanisms. Organizations publish model specifications and constitutions, conduct capability and safety evaluations, define risk thresholds, convene review bodies, maintain audit trails, require human oversight, impose access restrictions, establish escalation procedures, and preserve mechanisms for suspension or rollback.

These developments matter. They also create a conceptual problem.

The existence of governance mechanisms does not establish the existence of a complete governance architecture.

A risk evaluation may identify a material failure without possessing authority to change deployment. A review board may possess formal jurisdiction while lacking technical implementation control. A threshold may trigger a restriction without a reconstructable account of why that threshold represents the underlying decision problem. An appeal procedure may accept criticism while leaving the operative state unchanged. A system may correct future behavior while leaving already realized consequences without a route to remedy. A governance framework may be highly sophisticated under normal conditions and fail when incentives, organizational pressure, uncertainty, or repeated use place its corrective mechanisms under stress.

These are not merely examples of weak governance. They are different structural breaks between evaluation and correction.

The central distinction of this paper is therefore between governance artifacts and corrective architecture.

Governance artifacts are identifiable instruments of control: policies, evaluations, thresholds, audits, review bodies, dashboards, model cards, incident procedures, escalation mechanisms, constitutions, safety cases, access controls, and rollback provisions. Their presence may be necessary, useful, and sophisticated. But an artifact becomes governance-relevant only through the role it performs in a larger decision structure.

A threshold matters because evidence can cross it. A review matters because a judgment can follow from it. A judgment matters because some actor or mechanism possesses authority to alter the operative state. A restriction matters because the restricted state is actually implemented. A correction matters because the failure-producing condition can change. A corrective architecture matters because these relations remain reviewable and continue to function when correction becomes difficult.

This paper calls the resulting property Corrective Completeness.

Corrective Completeness does not mean that a governance regime is correct in every substantive judgment. It does not mean that its objectives are just, its evidence true, its institutions legitimate, or its decisions optimal. Nor does it mean that every consequence is reversible.

The proposed distinction is narrower.

A governance regime is Correctively Complete when the applicable functions required to move from a bounded governance problem through reviewable judgment to operative correction are instantiated in practice, and when that architecture remains operative—or degrades safely—across a declared stress domain.

Schematically:

 

Governance Instruments ⇏ Corrective Completeness.

 

Likewise,

 

Evaluation ⇏ Correction,

 

and

 

Implemented Correction Once ⇏ Reliable Corrective Governance.

 

The paper does not prescribe one ethics, one institutional hierarchy, one alignment doctrine, one mathematical formalism, or one technical control system. Its question is architecture-neutral:

What functions must a consequential AI-governance regime be capable of performing if valid correction is to remain possible from problem definition through operational consequence?

The paper proposes eight candidate core functions, an applicability discipline, and a separate robustness operator. The functions are defined at a sufficiently abstract level that different organizations may instantiate them through different technologies, institutions, normative traditions, regulatory systems, or decision procedures.

This neutrality is architectural, not moral. Decisions about acceptable harm, legitimate purpose, evidence, rights, burden, authority, and irreversible risk remain normative. The proposed decomposition does not solve those disagreements. It asks whether the regime possesses a reviewable architecture through which such disagreements can become decision-relevant rather than remaining symbolic.

Corrective Completeness is presented here as a conceptually developed but empirically unvalidated construct. The present argument does not prove that the proposed functions are universal necessities. It develops a functional decomposition, shows why removing each proposed function admits a distinct class of governance failure, and specifies how those claims can be tested through independent coding, activation opportunities, comparative cases, stress tests, controlled ablations, and governance outcomes defined independently of the construct.

The first task precedes measurement.

Before asking whether governance is complete, one must determine what is being governed.

2. Scope: The Governance Object Is Not the Model Alone

2.1 AI-mediated decision regimes

The object of AI governance is often described as a model, agent, application, or AI system. This is convenient and sometimes causally sufficient. It is not a safe universal assumption.

An AI output becomes consequential only inside a surrounding decision structure.

A ranking matters because someone relies on it. A recommendation matters because it alters attention, priority, resource allocation, or action. A classification matters because it may open or close access. A generated explanation matters because it can affect whether a decision is accepted, contested, or appealed. An agent action matters because tools, permissions, interfaces, workflows, and institutional authority allow it to change the world outside the model.

Accordingly, this paper uses AI-mediated decision regime for the bounded configuration through which AI behavior acquires practical consequence. Depending on the case, that configuration may contain the model or agent; a workflow or application; human decision-makers; evaluators; evidence and measurement procedures; permission and escalation rules; affected parties; institutional authority; technical enforcement mechanisms; appeal or review procedures; and correction or remedy paths.

This does not mean that every analysis must expand indefinitely into society.

The opposite error is equally serious. A technically distinctive vulnerability should not be dissolved into unrestricted social explanation merely because the AI system operates inside an institution. Prompt injection, unauthorized tool use, data leakage, model-specific capability escalation, or a software defect may require model-local or system-local intervention.

The governing requirement is therefore not maximal contextualization. It is boundedness.

The governance object should be no broader than necessary to capture the decision relation under examination and no narrower than the structure required to understand how the relevant consequence is generated and corrected.

2.2 Governance instance

Let a bounded governance instance be:

 

γ=(o,d,m,b,T),

 

where o is the governance object; d is the decision domain and evaluative purpose; m is the relevant AI-mediated system, workflow, or governance configuration; b is a credible baseline, comparison state, or alternative where one is required; and T is the relevant decision and evaluation horizon.

This unitization requirement prevents apparently identical AI behavior from being treated as the same governance problem across materially different contexts.

The same generated text may be low consequence when used for private drafting and high consequence when inserted into a clinical workflow. The same autonomous action may be acceptable in a sandbox and impermissible in production. The same uncertainty may justify continued observation in a reversible application and immediate suspension where a decision is difficult or impossible to undo.

Corrective Completeness is therefore indexed to a bounded governance instance and a declared stress domain:

 

CC(G,γ;Σ).

 

2.3 Meta-governance

This paper uses meta-governance in a restricted functional sense.

A system performs first-order evaluation when it asks whether an output, action, model, or workflow satisfies an existing criterion.

Meta-governance begins when the architecture can also examine the conditions under which that criterion acquires authority.

A model can determine whether an answer satisfies a policy without determining whether the policy represents the relevant problem. An audit can determine whether a process followed a rule without determining whether the rule was justified. A safety evaluation can estimate performance against a threshold without establishing whether the threshold remains appropriate. A human reviewer can override a model while remaining unable to question the task ontology, evidence rules, or authority structure that produced the decision.

Meta-governance therefore concerns not only:

 

Is the system complying with the governing rule?

 

but also:

 

What makes this rule governing?

 

 

What evidence may defeat it?

 

 

Who can revise it?

 

 

What happens when valid criticism reaches it?

 

The prefix meta- does not require an infinite hierarchy of governors. The requirement is reflexive: no load-bearing empirical or governance premise should become operationally immune merely because it belongs to the governing layer.

2.4 Criticism, review, judgment, correction, and remedy

Several stages frequently collapsed under the language of “oversight” must be separated.

Criticism is an objection, anomaly, adverse observation, harm report, counterevidence, or challenge.

Review is substantive examination of that input by a process capable of evaluating its relevance and evidential status.

Judgment is a reasoned conclusion concerning the problem, evidence, failure, or required response.

Correction is an operative change in an outcome, rule, category, evidence treatment, threshold, authority structure, workflow, permission state, resource allocation, or other governance-relevant state caused by criticism or evidence accepted under an explicit and reviewable standard.

Implementation is realization of the authorized change in the operative environment.

Recovery concerns restoration, reversal, containment, or movement to a safer state where the governed state remains recoverable.

Remedy concerns already realized consequences that cannot be addressed merely by changing future operation.

Thus:

 

Criticism ⇏ Review ⇏ Judgment ⇏ Correction ⇏ Implementation.

 

A regime can be procedurally open at the beginning of this sequence and operationally closed at its end.

Correction is also temporally bounded. An appeal that reaches the correct conclusion after an employment opportunity has disappeared, a medical intervention can no longer be altered, or a harmful autonomous action has propagated through downstream systems may be epistemically correct but operationally incomplete.

Time is therefore part of corrective architecture.

2.5 Correction and substantive adequacy

The paper does not equate corrigibility with truth.

A well-designed correction path can produce a wrong correction. Independent reviewers can share the same false assumption. A transparent authority structure can implement an unjust rule. A reversible system can repeatedly move among poor states.

Accordingly:

 

CC ⇏ Truth,

 

 

CC ⇏ Justice,

 

 

CC ⇏ Legitimacy,

 

and

 

CC ⇏ Optimality.

 

Corrective Completeness is architectural. Substantive adequacy remains a separate question.

2.6 Target domain and construct status

The framework is not intended as a universal theory of every control system.

Its primary target domain, denoted D_(CC), consists of consequential AI-mediated decision regimes in which AI outputs, evaluations, or actions can acquire institutionally meaningful permission or decision consequence and in which governance is expected to remain reviewable as evidence, conditions, actors, or system behavior change.

This scope excludes trivial closed-loop controllers merely because they contain feedback. It also excludes cases in which no material permission-bearing decision, correction pathway, or governance claim exists.

The target-domain restriction is not an exemption from falsification. It must be specified before case coding. A regime cannot be removed from D_(CC) merely because it produces a counterexample.

Corrective Completeness is also not proposed as a reflective latent variable. The eight functions need not be manifestations of one hidden causal factor and need not be positively correlated. The property is conjunctive and formative: the analytical claim is that distinct functional absences may admit distinct failure classes. Whether the eight-part decomposition is empirically useful, reducible, or unnecessarily complex remains an open validation question.

3. Before Permission: Bounded Governance Object and Intervention Scope

3.1 The capability-first error

AI governance often begins after several consequential choices have already been made. The capability exists. A use case has been selected. A task has been specified. A workflow has been designed. Metrics have been chosen. An evaluation regime has been constructed. Only then does the organization ask what controls should govern the system.

This sequence can be appropriate for exploratory engineering. It is insufficient as a general model of consequential governance.

“Rank applications,” “summarize evidence,” “detect fraud,” “route patients,” “recommend content,” or “execute tool calls” are descriptions of activities. They do not by themselves identify whose problem is being solved; what outcome matters; which errors are material; who bears the burden; which evidence is admissible; what authority the output may acquire; what alternatives exist; whether the action is reversible; or what correction remains possible after implementation.

The first question of governance is therefore not always:

 

What can the system do?

 

It is:

 

What bounded decision structure is this capability entering?

 

Prior decision-structure analysis inside the RATIUM.AI corpus develops this upstream problem in detail, while explicitly rejecting both model-local reduction and unrestricted social reduction (Dunavich 2026a).

3.2 Prior structure without causal overreach

Human institutions do not begin when AI enters them.

An employment-screening system enters relations among employers, applicants, recruiters, credentialing institutions, legal rules, resource constraints, accepted categories of merit, evidentiary conventions, and existing routes of appeal. A medical system enters relations among patients, clinicians, administrators, diagnostic conventions, resource allocation, insurers, professional authority, and definitions of urgency. A public-benefits system enters existing relations among administrative eligibility, documentation, evidentiary burdens, deadlines, appeals, and public authority.

AI may reproduce such structures, amplify them, operationalize them at greater speed or scale, stabilize them through infrastructure, interact with them to create new mechanisms, or introduce a genuinely technical failure that cannot be adequately explained by the prior institutional structure.

The governance requirement is not a presumption of social inheritance. It is a refusal to presume the opposite.

Causal depth is conditional, not universally maximal. A hard technical interlock may constitute adequate governance for a bounded action without requiring a rich theory of the entire institutional environment. A system-local vulnerability may require immediate local intervention before its wider context has been reconstructed.

The first core requirement is therefore not “complete causal explanation.” It is bounded governance-object and intervention-scope discipline.

3.3 The smallest adequate governance object

The practical unitization rule is:

Select the smallest governance object sufficient to represent the material decision relation under examination and capable of receiving an operative governance consequence.

Causal completeness becomes necessary when causal attribution is load-bearing—for example, where intervention depends on distinguishing institutionally inherited from AI-native failure. It is not necessary to construct an exhaustive causal model merely to enforce a valid bounded safety constraint.

3.4 From information to governance knowledge

A warning is not its own explanation. A metric does not identify the mechanism it measures. A threshold does not state why crossing it should alter permission. An audit trail does not determine whether the recorded sequence is harmful, causally relevant, or institutionally legitimate.

Thus:

 

Governance Information ⇏ Governance Knowledge.

 

Adding more telemetry, evaluators, reports, or dashboards cannot by itself establish stronger governance. The problem is the architecture by which evidence becomes decision-bearing.

4. From Bounded Problem to Corrective Architecture

Even an accurate problem account can remain operationally inert. An institution may understand the failure, possess good evidence, and publish a rigorous analysis while lacking a route from that analysis to operative permission. Conversely, a technical control may change state immediately while having no reconstructable relation to the problem it is supposed to govern.

These failures define opposite ends of the same break:

 

Understanding without consequence,

 

and

 

Consequence without derivation.

 

A complete governance architecture must resist both.

This requires a bidirectional relation between problem and permission. In the forward direction:

If this problem claim, evidence state, or material threshold is accepted, what governance consequence follows?

In the backward direction:

From what problem, evidence, criterion, and authority was this permission state derived?

This is the core contribution developed by Problem-to-Permission Derivation Completeness (PPDC), which distinguishes derivational completeness, substantive adequacy, implemented correction, and governance reliability rather than collapsing them (Dunavich 2026b).

An architecture can therefore be structurally complete on paper while failing in operation.

A documented rollback mechanism does not establish that rollback occurs. A formal appeal right does not establish that evidence reaches state-changing authority. An identified authority does not establish implementation control. A policy requiring reevaluation does not establish that disconfirming evidence can revise the governing premise.

The paper accordingly distinguishes:

 

SCC_D

 

— specification-level Structural Corrective Completeness —

from:

 

SCC_X

 

— operational Structural Corrective Completeness.

Corrective Completeness ultimately concerns the second.

Part II — The Candidate Architecture-Neutral Functional Decomposition

5. Why a Candidate Functional Decomposition?

If a proposed governance decomposition requires the vocabulary, institutions, formal models, or implementation choices of the framework that proposes it, comparative testing becomes circular. A framework using different terminology will appear incomplete even where it performs the same function.

Conversely, if the decomposition is defined only through terms such as accountability, safety, oversight, or responsibility, it becomes too elastic to falsify.

The proposed solution is a candidate functional decomposition. The term kernel is retained only as shorthand for this provisional set and does not imply empirical minimality, latent unity, or universal necessity:

 

C={C_1,…,C_8}.

 

The functions are:

 

C_1=Bounded Governance Object and Intervention Scope,

 

 

C_2=Bidirectional Decision Derivability,

 

 

C_3=Epistemic Defeasibility with Entrenchment Discipline,

 

 

C_4=Non-Self-Sealing Challenge,

 

 

C_5=Authority and Control Topology Legibility,

 

 

C_6=Consequential State Control,

 

 

C_7=Recoverability and Remedy Interface,

 

 

C_8=Reflexive Governance Review.

 

These functions are not defined by institutional form. One institution may implement several functions; one function may be distributed across institutions or technical components.

The current analytical question is:

Does removing any proposed core function admit a governance-failure class that the remaining functions do not independently exclude?

5.1 Functional equivalence

For governance instance γ, mechanisms m_a and m_b are functionally equivalent with respect to C_i where, under a pre-specified coding rule, they perform the same governance-relevant function:

 

m_asim_(C_i,γ)m_b.

 

Terminology, organizational form, and implementation technology may differ.

Thus SHIP, RESTRICT, HOLD, and ROLLBACK are not universal requirements. Another architecture may use authorize, condition, suspend, revoke, quarantine, terminate, remand, or disable.

Functional equivalence must be pre-specified. It cannot be invoked retrospectively to protect the proposed decomposition from a counterexample.

5.2 Applicability guard

Let:

 

a_i(γ)∈{0,1},

 

where a_i(γ)=1 means that C_i is applicable to governance instance γ.

An N/A classification requires an explicit scope exclusion, rationale, evidence, and reopening condition.

Thus:

 

NotApplicable ≠ NotObserved ≠ NotRequired,

 

and:

 

ApplicabilityIndeterminate ≠ NotApplicable.

 

N/A should be exceptional in a consequential AI-mediated regime, not a convenient escape from an absent function.

5.3 Specification and execution

For each C_i, let:

 

D_i(G,γ)

 

represent evidence that the architecture declares or documents the function, and:

 

X_i(G,γ)

 

represent evidence that the function is operationally executed when activated.

After evidence adjudication, each may be collapsed to 1,0,bot, but primary coding should preserve richer evidence states.

The central non-implication is:

 

D_i=1 ⇏ X_i=1.

 

6. C1 — Bounded Governance Object and Intervention Scope

6.1 Definition

Let o_γ denote the bounded governance object and L_γ the operative intervention scope.

C1 is supported where the architecture can identify:

1. the object whose state is governed;

2. the material consequence or failure under examination;

3. the level at which intervention occurs;

4. relevant exclusions from that intervention;

5. and, where causal attribution is load-bearing, evidence connecting causal scope to intervention scope.

The requirement is not a full causal theory of the surrounding society. Nor is it model-local intervention by default.

6.2 Conditional causal depth

Some bounded interventions are valid without a rich causal account. Others depend directly on causal claims.

Accordingly:

 

CausalGrounding ⊆ C_1

 

where causal attribution is material, but exhaustive causal reconstruction is not a universal prerequisite.

6.3 Failure class

Removing C1 admits:

 

¬ C_1 ⇒ Admits(F_1),

 

where F_1 is Governance-Object or Intervention-Scope Mismatch.

The remaining functions may operate competently over the wrong object.

7. C2 — Bidirectional Decision Derivability

7.1 Definition

Let a simplified derivation be:

 

P→ E→ J→ A→ Q→ R,

 

where P is the bounded problem representation, E the evidential state, J the governance judgment, A the authorized decision locus, Q the operative permission or system state, and R subsequent review, correction, or reauthorization.

The sequence is representational, not a mandatory bureaucratic order.

Forward derivability asks:

 

Pleadsto Q.

 

Backward derivability asks:

 

Qleadsto P.

 

Without forward derivability, governance can become analytically sophisticated but operationally inert. Without backward derivability, it can become operationally forceful but conceptually arbitrary.

7.2 Emergency provisional control

Emergency action may precede complete derivation where delay would create unacceptable risk. But such action should have an explicit basis, bounded scope, expiration or review, retrospective derivation, and reauthorization.

7.3 Failure class

Removing C2 admits:

 

F_(2a)=Operational Inertness

 

or:

 

F_(2b)=Conceptual Arbitrariness.

 

C2 is distinct from C6: derivation can exist without state-changing power, and state-changing power can exist without derivation.

8. C3 — Epistemic Defeasibility with Entrenchment Discipline

8.1 Epistemic premises

Let ℰ_γ denote load-bearing empirical, causal, classificatory, and model-based premises.

For each material e∈ℰ_γ, C3 requires representation of:

 

EvidenceStatus(e),

 

 

Uncertainty(e),

 

and:

 

RevisionCondition(e).

 

Thus:

 

OperationalAcceptance ⇏ EpistemicFinality.

 

8.2 Normative entrenchment

Not all governance commitments are empirical hypotheses.

A constitutional prohibition, fundamental right, statutory duty, or explicit normative commitment may be intentionally difficult to alter.

Thus:

 

EpistemicPremise ≠ EntrenchedNormativeCommitment.

 

Normative entrenchment is compatible with C3 where the commitment is explicitly identified as normative; its source of authority and scope are visible; interpretation and case application remain reviewable; and empirical assumptions are not hidden inside the commitment and protected from evidence by being labeled values.

8.3 Failure class

Removing C3 admits Epistemic Freeze:

 

¬ C_3 ⇒ Admits(F_3).

 

The central failure is not that the premise may be wrong, but that the architecture lacks a defined route by which being wrong can matter.

9. C4 — Non-Self-Sealing Challenge

9.1 Defeasibility is not enough

A premise may be formally revisable while effectively self-sealing if all evidence relevant to its revision is filtered through the same criterion being challenged.

9.2 Definition

For a material premise, criterion, ontology, model, or decision z, C4 requires at least one challenge path c for which final challenge validity is not determined exclusively by z and outputs generated under it:

 

Eval_c(z) ≠ f(z,Outputs(z)) alone.

 

Possible mechanisms include independent review, external evidence, adversarial testing, competing evaluators, affected-party evidence, appeal, judicial review, public contestability, objective uncertainty, or red-team challenge.

Absolute independence is not required. The operative test is whether evidence that the governing frame does not already recognize as favorable can reach a forum capable of treating the frame itself as an object of judgment.

9.3 Failure class

Removing C4 admits Self-Sealing Evaluation:

 

InstitutionalAssumption → SystemDesign → SystemOutput → InstitutionalEvaluation → Confirmation.

 

C3 and C4 remain independent:

 

C_3⇏ C_4,

 

 

C_4⇏ C_3.

 

10. C5 — Authority and Control Topology Legibility

10.1 Definition

For material state transition q→ q', C5 requires a reconstructable mapping of formal authority, effective control, evidence access, required competence, escalation rights, implementation control, override relations, handoffs, and responsibility for verification.

The topology may be centralized or distributed.

10.2 Formal and effective authority

 

FormalAuthority(a) ⇏ EffectiveControl(a),

 

and:

 

TechnicalControl(a) ⇏ LegitimateAuthority(a).

 

Both relations matter.

10.3 Failure class

Removing C5 admits Authority or Control-Topology Discontinuity, including contradictory commands, unresolved ownership, delayed escalation, correction lost at handoff, formal override without technical override, or technical intervention without legitimate authorization.

C5 is not reducible to C6.

11. C6 — Consequential State Control

11.1 Definition

C6 marks the point at which evaluation becomes governance in an operational sense.

The decisive relation is:

 

J→Δ q,

 

where J is a justified governance judgment and Δ q a verifiable change in the operative state.

Relevant states may include authorize, restrict, suspend, revoke, isolate, downgrade, redirect, require human confirmation, reduce permissions, withdraw deployment, restore a previous configuration, or prevent continuation.

11.2 Verification

A HOLD is not implemented if deployment continues. A restriction is not implemented if relevant permissions remain active. A rollback is not implemented if downstream systems continue using the replaced configuration.

Thus:

 

Decision ⇏ Implementation.

 

11.3 Failure class

Removing C6 admits Symbolic Governance:

 

Criticism → Review → Judgment not→ OperativeStateChange.

 

12. C7 — Recoverability and Remedy Interface

12.1 Recoverability

Where technically and institutionally feasible, the architecture should identify whether it can reverse, restore, isolate, disable, downgrade, replay, re-evaluate, or move to a known safer state.

Irreversibility should itself become a governance-relevant property.

12.2 Remedy

Remedy concerns consequences already realized. It may include record amendment, renewed consideration, reinstatement, notification, compensation, restoration of access, re-evaluation, or downstream correction.

The AI-governance architecture need not possess jurisdiction to provide the remedy. C7 can be satisfied through a reliable remedy interface to the actor or institution that does.

Thus:

 

Correction ≠ Remedy,

 

and:

 

FutureStateImprovement ⇏ PastConsequenceRepair.

 

12.3 Failure class

Removing C7 admits Prospective-Only Correction.

C7 is distinct from C6: C6 asks whether state can change; C7 asks what happens after that change when earlier state or consequence still matters.

13. C8 — Reflexive Governance Review

13.1 The governor can become the failure

The governance layer can itself become overfitted, excessively restrictive, burdensome, slow, opaque, captured, poorly calibrated, or structurally insulated.

13.2 Definition

Let ℛ_G denote load-bearing governance rules and structures, including object definitions, evidence rules, metrics, thresholds, taxonomies, authority allocation, escalation rules, appeal procedures, evaluator configurations, permission grammars, correction mechanisms, and reauthorization rules.

C8 requires each materially load-bearing element to possess an explicit status:

 

Revisable

 

or:

 

ExplicitlyEntrenched.

 

Hidden immunity is not acceptable.

C8 does not require an infinite hierarchy of governors. Self-amendment, reauthorization, appellate review, external audit, or constitutional review may satisfy the reflexive function.

13.3 Failure class

Removing C8 admits Governance-Layer Closure.

C8 remains distinct from C3: a system may revise empirical premises while retaining a defective governance architecture, or redesign governance while leaving an empirical premise unchanged.

14. Comparative Neutrality and the Anti-Cosmetic Rule

A negative finding requires more than absence of terminology. A positive finding requires more than rhetorical similarity.

For C6, words such as “action,” “mitigation,” or “response” are insufficient without a path to operative state change.

For C4, inviting feedback is insufficient if challenge cannot test the governing frame.

For C7, future mitigation is insufficient if realized consequences remain outside any remedy path.

This is the Anti-Cosmetic Rule.

15. The Subtraction Argument

For each function:

 

¬ C_i ⇒ Admits(F_i).

 

This is not:

 

¬ C_i ⇒ F_ialways occurs.

 

The subtraction argument establishes failure admissibility, not deterministic failure.

The current mapping is: