Intent Integrity: CIA and Non-Repudiation as Properties of Intent, Not Data

The information-security canon names confidentiality, integrity, and availability (CIA), plus non-repudiation, as the load-bearing properties of *data*. Decades of operational practice — at the protocol level, at the storage level, at the wire level — operate against this property set. Governed agentic systems require an analogous property set applied to a different artifact: **intent**, the operator-pinned envelope that the system is supposed to remain aligned with across its operating horizon. Intent-CIA-NR is not derivable from data-CIA-NR; the two property sets operate on different artifacts with different threat models, different verification primitives, and different operational disciplines. This paper specifies intent-CIA-NR as the security model that the intent horizon — named in Paper One of this series — operationally requires. Confidentiality of intent is the property that *only the operator's authorized governance ceremony* can read or modify the pinned horizon. Integrity of intent is the property that the system's reasoning chain preserves the operator-pinned commitments end-to-end through every micro-decision the agentic execution layer makes. Availability of intent is the property that the operator can recover, in real time, the system's current intent — *not* its current output, *not* its current state, but the envelope the system is currently treating as authoritative. Non-repudiation of intent is the property that every horizon-event (pin, drift, storm, recalibration) is signed, logged, and cryptographically attributable to the governance authority that issued it. The argument proceeds in five movements. Section 2 documents the failures of treating intent-security as data-security with intent-shaped variable names — five operational patterns in which data-level CIA is satisfied while intent-level CIA is violated invisibly. Section 3 specifies intent-confidentiality and intent-integrity, with the threat models and verification primitives each requires. Section 4 specifies intent-availability and intent-non-repudiation, with operational examples drawn from the heterogeneous federation documented in MR-P9. Section 5 places intent-CIA-NR within the HGC³AE² role ordering and shows how the prior architecture's runtime mechanisms acquire enforcement specificity once intent is the artifact under security. Section 6 hands off to IH-3 (Confident Misalignment as Horizon Failure), where the diagnostic consequences of intent-integrity loss are developed.