Governance-as-Physics: Authority Operators as a Testable Layer for Governed Systems

This paper specifies Authority Operators: a mechanistic governance layer for governed systems where admissibility, refusal, and sealing are treated as testable operator dynamics rather than informal process. The core unit is a closed-world bundle whose evidence surface is restricted to in-bundle artifacts, enabling verifier-implementable, fail-closed evaluation. The specification defines canonical run commitments (hashes over a fixed run-core projection), deterministic ordering rules for all constructed lists, and a committed trace subset (trace_commit) that allows verifiers to check graph↔trace consistency without relying on runtime-only facts. Refusals are standardized as FailureID-keyed outcomes, with deterministic gate precedence, verdict normalization (not emission order), and a bijection requirement between gate decisions and committed trace events. The work introduces conformance levels (CORE, SEAL-Lite, SEAL), determinism tiers, and a vectorized test suite requirement (POS/NEG coverage for reachable failures). SEAL adds tamper-evident receipt chaining and authenticated receipts with an explicit trusted keyset model. Extensions are disabled by default and, when enabled, are commitment-included to prevent silent divergence. Overall, the result is a governance layer whose integrity properties are machine-checkable, replay-verifiable (as required by tier), and resistant to evidence smuggling, policy drift, and post-hoc rationalization within the bundle’s declared semantics. Keywords authority operators; governance as operators; admissibility; refusal codes; FailureID; conformance testing; vectorized test suites; deterministic ordering; canonical JSON (RFC 8785); receipt hashing; trace_commit; graph–trace consistency; closed-world bundles; tamper-evident logs; authenticated receipts; signature policy; trusted keysets; determinism tiers; replay verification; schema binding; extension envelopes