💻 computer science

Reconstructive Authority Model: Runtime Execution Validity Under Partial Observability

The paper introduces the Reconstructive Authority Model (RAM), a framework that improves autonomous system safety by shifting the focus from merely verifying the integrity of data (attestation) to ensuring that the observable state provides sufficient coverage to justify a specific action.

Original authors: Marcelo Fernandez - TraslaIA

Published 2026-04-28

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Marcelo Fernandez - TraslaIA

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Perfect Receipt" Fallacy

Imagine you are a bank manager. A customer walks in with a perfectly valid, government-issued ID and a signed receipt showing they have $1,000 in their account. Everything looks perfect. You check the ID (that’s Attestation), and it’s authentic. You check the receipt (that’s State Proof), and the math is correct.

You approve the withdrawal.

But here is the catch: While the customer was walking from the ATM to your desk, they actually lost their wallet, or perhaps a judge just froze their account in a different city, or they are currently being flagged for fraud in a system you don't have access to.

The "receipt" was authentic, and the "ID" was real, but the reality of the situation had changed in ways your paperwork couldn't see. You made a "correct" decision based on "perfect" paperwork, but you made a "wrong" decision based on the real world.

This paper argues that current AI and autonomous systems suffer from this exact problem. They are great at proving that their data is untampered with, but they are terrible at realizing when their data is no longer a complete picture of reality.

The Solution: The Reconstructive Authority Model (RAM)

The author introduces RAM. Instead of asking, "Does this paperwork match my records?" RAM asks a much tougher question: "Based on what I can see right now, can I actually prove I have the right to act?"

Think of the difference between a Security Guard and a Detective.

The Current Way (Attestation): The Security Guard looks at your badge. If the badge is real and hasn't been tampered with, you’re in. He doesn't care if you're currently carrying a stolen briefcase; if the badge is good, the door opens.
The RAM Way: The Detective doesn't just look at the badge. He looks at the badge, and he looks at your behavior, and he looks at the weather, and he looks at whether the lights are flickering. If he can't see enough of the "big picture" to be 100% sure you belong there, he doesn't let you in. He doesn't guess. He doesn't assume. He simply says, "I don't have enough information to say yes, so the answer is no."

Three Key Concepts of RAM

1. The "Coverage Envelope" (The Blind Spot Map)

RAM forces the system to admit what it doesn't know. It creates a "map" that includes:

What I know: (The proven facts).
What I'm assuming: (The "educated guesses" we're making to keep things moving).
The "Dark Zone": (The stuff we know exists but we simply cannot see right now).

By acknowledging the "Dark Zone," the system avoids the trap of pretending it knows everything.

2. Non-Persistence (Authority is not a "Pass")

In most systems, once you are "authorized," you stay authorized for a while. RAM treats authority like a flashlight in a dark forest. You don't just turn the flashlight on once and walk through the woods; you have to keep pointing it at the ground with every single step. If the light flickers or the batteries get low, you stop moving immediately.

3. Privilege Narrowing (The "Dimmer Switch")

If the system is only mostly sure, it doesn't have to shut down completely. It can use a "dimmer switch."

Full Light: "I see everything clearly. You can transfer $1,000."
Dim Light: "I'm a bit unsure about your location. You can only transfer $5."
Total Darkness: "I can't see anything. I'm freezing all activity."

The Bottom Line

The paper proves mathematically that as long as there is a gap between "what we can prove" and "what is actually happening," current systems will eventually make dangerous mistakes.

RAM's philosophy is simple: It is better to be "too cautious" and stop an action because of uncertainty than to be "too confident" and execute an action that is actually a disaster. It moves AI governance from "Is this data valid?" to "Is this reality sufficient?"

Technical Summary: Reconstructive Authority Model (RAM)

Title: Reconstructive Authority Model: Runtime Execution Validity Under Partial Observability
Author: Marcelo Fernandez (Agent Governance Series — Paper 5)
Date: April 2026

1. The Problem: The "Coverage Gap" in Autonomous Governance

The paper addresses a fundamental structural flaw in current autonomous agent governance. Existing frameworks rely heavily on attestation-based governance (e.g., Trusted Execution Environments (TEEs), oracle-signed state proofs, and cryptographic attestations). These mechanisms ensure integrity—proving that a computation was performed correctly on the observed state.

However, the author argues that integrity is not sufficient for semantic correctness. In real-world systems, agents operate under partial observability: the true execution-relevant state ( $S_r$ ) is always larger than the provable/observable state ( $S_p$ ). This creates a "state gap" ( $\delta = S_r \setminus S_p$ ).

The core failure mode: An agent may pass all cryptographic attestation checks because its observed state ( $S_p$ ) is consistent with its previous authorization, yet the execution is actually invalid because a critical change occurred in the unobserved residual ( $\delta$ ). This results in "false positive" executions—systems that are cryptographically valid but semantically catastrophic.

2. Methodology: The Reconstructive Authority Model (RAM)

The paper proposes a paradigm shift from enforcement (verifying consistency with the past) to reconstruction (deriving authority from the present).

Key Concepts:

Non-Persistence of Authority: Unlike admission-based models where authority is granted at $t_0$ and assumed to persist, RAM treats authority as a non-persistent property that must be re-derived at every single execution step.
The Coverage Envelope ( $E$ ): Instead of just looking at the proven state, RAM reasons over a triple: $E(t) = \{S_p(t), H(t), \delta(t)\}$ , where $S_p$ is the proven state, $H$ represents declared assumptions about the unobserved, and $\delta$ is the acknowledged unobservable residual.
The Authority Constructor ( $F$ ): A deterministic function that maps the coverage envelope and a requested action class ( $\alpha$ ) to an outcome.

The RAM Execution Gate:
Instead of a binary "Allow/Deny," the RAM constructor provides three distinct outcomes:

Full Scope ( $\alpha$ ): Coverage is adequate; execute normally.
Narrowed Privileges ( $\alpha' \subset \alpha$ ): Coverage is partial; execute only a safe subset of the action.
Halt/Defer ( $\perp$ or $false$): Coverage is insufficient or a definitive violation is found; the system "fails closed."

3. Key Contributions

Formal Characterization of Attestation Limits: The paper provides a formal proof (Theorem 5.1) demonstrating that no attestation-based system can guarantee execution validity if the invalidating condition lies within the unobservable state gap.
The RAM Formal Model: Defines the mathematical framework for reconstructive authority, including the treatment of invariants as constructive conditions (requirements for authority) rather than mere validation checks.
Hybrid Architecture: Proposes a system where Attestation and RAM work together: Attestation ensures the integrity of the computation, while RAM ensures the semantic validity of the decision.
Theoretical Proofs: Establishes the "Necessity of Reconstruction," proving that the only way to guarantee validity under partial observability is to adopt a conservative halting policy when information is insufficient.

4. Results and Experimental Evaluation

The author conducted synthetic experiments (100,000 steps) comparing Attestation, Oracle-extended systems, and RAM under various "drift injection" scenarios (hidden, delayed, and ambiguous state changes).

Invalid Execution Rate (IER):
- Attestation-based systems exhibited high IER (up to 42.3% in low-coverage scenarios). Even at "full" coverage, they maintained a baseline error rate because they treat "undefined" states as benign.
- RAM achieved an IER of 0.000 across all coverage levels. It successfully identified all invalid execution attempts.
Safety vs. Efficiency (The OCR Trade-off): The paper introduces the Over-Conservatism Rate (OCR). While RAM is perfectly safe (zero invalid executions), it may halt valid executions if the observability is too low. The paper demonstrates that as observability investment increases, the OCR decreases, allowing the system to approach optimal efficiency without sacrificing safety.

5. Significance and Implications

The paper concludes that for high-stakes autonomous systems (e.g., autonomous finance, critical infrastructure), the "default to continue" mindset of current systems is mathematically indefensible.

Major implications include:

Design Philosophy: Systems must be designed to "fail closed" (halt) when they cannot reconstruct authority, rather than proceeding under uncertainty.
Observability as a Security Metric: The gap between current observability and the requirements of the authority constructor (the OCR) serves as a formal signal for where a system needs more sensors or better data pipelines.
Simplification of Drift Management: Instead of building complex "drift detectors," engineers can focus on building robust "authority constructors," as drift naturally manifests as an inability to reconstruct authority.