A Taxonomy of AI Governance Approaches: Distinguishing Visibility, Alignment, and Authorization

The term “AI governance” has become semantically overloaded, applied indiscriminately to logging, guardrails, model alignment, dashboards, and policy workflows. This paper introduces a formal taxonomy that distinguishes three fundamentally different governance problems: visibility (what happened), alignment (is the system generally safe), and authorization (was this specific action permitted under policy at execution time). It maps common vendor “governance” claims to the problems they actually solve. The taxonomy defines deterministic AI governance as a pre-execution authorization layer in which identical governed state yields identical governance verdicts and the system emits verifiable authorization artifacts sufficient for independent third-party offline replay. The current capability tier is tamper-evident; signature-grade proofs are roadmap. It specifies the normative structure of governed state, the Minimum Evidence Package (Normative), an enforcement triad (ALLOW / DENY / ABSTAIN, where ABSTAIN blocks execution pending authorized human override), and disqualifying evaluation methods, including anti-laundering checks designed to prevent trust-based or vendor-dependent imitation of governance. FERZ Governance Doctrine (v1.1): Observability explains what happened. Enforcement determines what is allowed to happen. Enforcement is realized through a non-bypassable authorization boundary that emits a proof-carrying decision prior to execution. This work is intentionally testable and disqualifying rather than aspirational. It provides enterprise buyers, regulators, auditors, and researchers with a shared vocabulary and concrete conformance criteria for evaluating AI governance claims in high-stakes, regulated deployments. The framework is architecture-agnostic and may be applied to any AI governance solution. Update (July 2026, v1.7): Version 1.7 aligns Section 4.6 with the Five Tests Standard (5TS) v1.2.0: Stop, Ownership, Replay, Escalation, and Provenance. Provenance is the established origin of the inputs grounding a verdict; it is origin, not truth. The current machine-checkable conformance bundle covers the four predecessor tests; machine-checkable Provenance conformance is deferred until input-origin binding is specified. Artifact terminology is aligned to authorization artifacts and the Doctrine block is standardized at v1.1 across editions. The three-problem taxonomy, the deterministic governance definition, and the conformance methodology are unchanged. This record contains the v1.7 kit: the full taxonomy, an Executive Summary, a Vendor Evaluation Supplement, and Evidence Package Examples. Update (June 2026, v1.6): Version 1.6 aligned the taxonomy package with the predecessor Four Tests Standard, the Authorization Artifact Test, and FERZ Technical Advisory TA-2026-01, which names the artifact gap: the evidentiary condition that arises when observability is relied upon to satisfy an ex-ante authorization requirement. The companion evaluation kit was updated accordingly, and the Evidence Package Examples added an agentic tool-use example in which an external data transfer is blocked before dispatch. The Five Tests Standard, which adds Provenance as a fifth normative test, supersedes the Four Tests Standard for current-standard references as of v1.7. Update (Jan 2026): Released a companion evaluation kit including an Executive Summary (board/C-suite orientation), a Vendor Evaluation Supplement with decision logic for determining when authorization-layer governance is required, and Evidence Package Examples demonstrating independently replayable ALLOW, DENY, and ABSTAIN verdicts conformant with the Minimum Evidence Package requirements.

Hali tarjima qilinmagan