Deterministic Governance Is Multi‐Dimensional: Beyond Bounded Execution Gating in AI Systems

This paper introduces the Multi-Dimensional Deterministic Governance Model, a vendor-neutral framework for evaluating AI governance architectures in regulated environments. Version 2.0.0 recasts the argument. A bounded execution gate, a pre-execution check that returns ALLOW, DENY, or ABSTAIN within a declared workflow, is necessary for automated consequential actions and can support genuine pre-execution authorization within that closed world. It does not by itself establish what its inputs mean, whether the policy it applies is the policy in force, whether its evidence has an established origin, or whether its verdict can be independently reconstructed. The paper asks when a bounded gate’s authorization claim can extend beyond its declared closed world, and what must be controlled and demonstrably composed before an architecture can claim deterministic governance across a broader scope. Deterministic governance is defined, per the FERZ AI Governance Taxonomy, as a pre-execution authorization layer where identical governed state produces identical governance verdicts and rationale, and where the system emits verifiable authorization artifacts sufficient for independent third-party replay and verification. The model specifies five assurance functions that must compose at the runtime authorization boundary for that definition to hold beyond a bounded declared workflow: governance ontology, which stabilizes and versions the meaning of governed terms; constraint codification, which transforms policy into a machine-verifiable constraint regime within a declared policy scope; deterministic decision logic, which produces identical verdicts for identical governed state; the authorization artifact, a tamper-evident record that binds the proposed action, versioned meaning, policy and version state, authority chain, inputs, provenance evidence, time, and verdict so that an independent party can reconstruct the verdict; and execution enforcement, which conditions execution on the verdict and the required artifact with fail-closed behavior. The functions are not layers that end in a gate. They are related to the three orthogonal properties of the Authorization Boundary Integrity Model: output integrity, input integrity, and replay integrity. Provenance is the input-integrity requirement; the artifact binds provenance evidence, but binding does not convert origin into truth or appropriateness. Reconstruction language replaces correctness language throughout. An authorization artifact enables an independent party to confirm that the same bound inputs, under the same policy and version state, produce the same verdict under a declared replay mode. It does not establish that the inputs were true, that the policy was legally correct, or that the action was substantively wise. Formal analysis of the evaluation function supports claims about its determinism and internal consistency; whether the runtime boundary is non-bypassable and fail-closed across a declared execution-path scope requires separate architectural and empirical evidence. The paper provides a diagnostic evaluation framework of five questions, one per assurance function, and adopts the Composition Test from The Closed-World Bargain: material consumption of the required artifact, a declared replay mode, and fail-closed behavior demonstrated across a declared execution-path scope. Governance completeness means that all five concerns are controlled and demonstrably composed. Five functions that coexist without composing produce a sixth failure mode, composition failure. Each uncontrolled concern produces a distinct, observable failure mode that strength in the remaining functions cannot compensate for, and a compact example across all five functions distinguishes bypass from verdict content. This work is intended for enterprise buyers, regulators, CISOs, general counsel, and governance architects evaluating AI governance infrastructure for high-consequence environments including healthcare, financial services, government, and defense. It states a general doctrine and an evaluation framework; it is not a product description. It is published to support open dissemination, architectural evaluation, and prior-art establishment. Version 2.0.0 (August 2026) supersedes v1.1.0 (July 2026, subtitle “Beyond Authorization in AI Systems”, DOI: 10.5281/zenodo.21224294). The subtitle, model topology, function names, Figure 1 (now a conceptual assurance map), and completeness criterion were recast, and the references were updated. This concept DOI resolves to the current version. Related publications: A Taxonomy of AI Governance Approaches (DOI: 10.5281/zenodo.18275969), The Authorization Boundary Integrity Model (DOI: 10.5281/zenodo.20929115), The Closed-World Bargain (DOI: 10.5281/zenodo.21643658), The Five Tests Standard (5TS) (DOI: 10.5281/zenodo.21040295), Versioned Meaning: How to Make Ontologies Audit-Stable (DOI: 10.5281/zenodo.18328587), Governance Laundering: A Taxonomy of Failure Modes in AI Compliance Architectures (DOI: 10.5281/zenodo.18746522), and The Enterprise AI Governance Buyer’s Guide (DOI: 10.5281/zenodo.18002693).