🤖 AI

Algebraic Semantics of Governed Execution: Monoidal Categories, Effect Algebras, and Coterminous Boundaries

This paper presents a mechanized algebraic semantics for governed execution, formalized in 32 Rocq modules using interaction trees and coinduction, which establishes a symmetric monoidal category where governance is axiomatized, compositional, and coterminous with expressibility, ensuring that all constructible programs are governed while preserving Turing completeness and excluding unmediated I/O.

Original authors: Alan L. McCann

Published 2026-05-06

📖 5 min read🧠 Deep dive

CC0 1.0

Original authors: Alan L. McCann

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a complex robot that can think, talk, remember things, and even go out into the world to buy groceries or call a friend. You want this robot to be incredibly smart and capable, but you also need to make sure it never does anything dangerous, illegal, or against the rules while it's working.

This paper presents a new way to design the "brain" and "rules" for such a robot. Instead of just hoping the robot behaves, the authors have built a mathematical fortress around its actions. They call this "Governed Execution."

Here is the breakdown of their idea using simple analogies:

1. The Problem: The "Wild West" of AI

Currently, we try to control AI in two ways:

The "Filter" Approach: We train the AI to be polite or filter its answers after it speaks. This is like trying to stop a leaky faucet by mopping the floor. It doesn't stop the water from coming out; it just tries to clean it up later.
The "Guardrail" Approach: We put fences around the robot. But often, these fences are just suggestions or soft rules that the robot can accidentally (or intentionally) jump over.

The authors argue that we need a system where the rules are hard-coded into the very fabric of the robot's ability to act. If the robot tries to do something without permission, it literally cannot do it.

2. The Solution: The "Three-Legged Stool" (The Algebra)

The authors created a mathematical framework called a Governance Algebra. Think of this as a three-legged stool that must be perfectly balanced for the system to work. If any leg is missing, the whole thing falls. The three legs are:

Safety: The robot must never take an action without a "permission slip" (a governance check).
Transparency: If the robot does have permission, the rules shouldn't change what it does, only that it checked first. (It shouldn't slow down the robot or change its answer, just ensure it's safe).
Properness: The rules must be consistent. If two robots do the same thing, the rules must treat them exactly the same way.

3. The "Interaction Tree": The Robot's Thought Process

To prove this works, they represent the robot's thinking as a giant Tree.

The Branches: Every time the robot thinks, it splits into branches.
The Leaves: The final actions (like "Call a friend" or "Write a file").
The Trunk: The path the robot takes to get there.

In their system, every single branch of this tree must pass through a Security Gate (the Governance Operator) before it can grow. If a branch tries to grow without going through the gate, the tree simply refuses to exist.

4. The "Dual Guarantee": The ID Badge and The Security Guard

The paper introduces a clever two-part safety system:

The ID Badge (Capabilities): Before the robot even starts, it gets an ID badge that lists exactly what it is allowed to do (e.g., "Can read files," "Cannot delete files"). This is a static list.
The Security Guard (Governance): As the robot moves, a Security Guard checks every single step. Even if the robot has an ID badge, the Guard stops it if the specific action looks suspicious at that moment.

The paper proves that both must happen at the same time. You can't just have the ID badge (because the robot might get confused), and you can't just have the guard (because the guard might miss something). They work together to ensure that every single action is both authorized and checked.

5. The "Coterminous Boundary": The Perfect Match

This is the most exciting part of the paper. The authors prove a "Perfect Match" theorem.

The Claim: In their system, everything the robot is capable of building is automatically safe.
The Analogy: Imagine a toy factory where the only toys you can build are the ones that come with a safety certificate. You cannot accidentally build a toy that is unsafe. If it's not safe, the factory machine won't even let you start building it.
The Result: The "safe" zone and the "possible" zone are exactly the same size. There is no "gray area" where a robot can do something risky. If the robot can express a thought or an action, it is guaranteed to be governed.

6. The "Black Box" Proof

The authors didn't just write this down; they built a massive digital proof machine (using a tool called Rocq) with over 12,000 lines of code and 454 mathematical proofs.

They proved that if you follow their rules, the robot cannot accidentally do something bad.
They proved that the robot is still smart enough to do complex tasks (it's "Turing complete," meaning it can solve any problem a computer can).
They even built a "Ledger" (like a tamper-proof diary) that records every single permission check and action, so if anyone tries to cheat later, the diary proves they did.

Summary

This paper says: "We have built a mathematical cage for AI actions. Inside this cage, the AI is free to do anything it wants, but it is physically impossible for it to do anything unsafe. The rules aren't just suggestions; they are the laws of physics for this specific system."

They have proven this mathematically, tested it with millions of random scenarios, and shown that the "safe" version of the AI works just as fast as the "unsafe" version. It's a way to make AI powerful without making it dangerous.

Technical Summary: Algebraic Semantics of Governed Execution

Problem Statement

Current AI workflow systems, which compose language model calls with data retrieval, code execution, and external API access, lack a formal framework for governed execution. Existing governance approaches fall into two categories:

Behavioral approaches (e.g., RLHF, Constitutional AI, guardrails) that filter or train model outputs but fail to address whether the system's structural effects (API calls, file writes) pass through a governance boundary.
Structural approaches that enforce invariants at the execution layer but often lack machine-checked proofs or fail to address composition. They typically verify individual programs rather than proving that governance is closed under the system's composition operators.

The core challenge is to establish a semantics where governance is not merely an external filter but an intrinsic, compositional property of the execution model itself, ensuring that the set of expressible programs coincides with the set of governed programs.

Methodology

The paper develops an algebraic semantics for governed execution, mechanized in 32 Rocq modules (approximately 12,000 lines of code, 454 theorems, 0 admitted lemmas). The framework relies on three primary technical pillars:

Interaction Trees (ITrees): Programs are represented as coinductive trees with three node types: Ret (pure values), Tau (silent steps), and Vis (visible events). The system uses the DirectiveE type to model 14 distinct external capabilities (e.g., LLM calls, HTTP requests, file operations).
Governance Algebra: Governance is axiomatized as a parametric record (GovernanceAlgebra) defined by three axioms:
- Safety: The governance operator G ensures that interpreted programs satisfy a coinductive safety predicate (gov safe).
- Transparency: Under permissive conditions (all checks pass), governed interpretation is observationally equivalent to ungoverned interpretation.
- Properness: Equivalent handlers produce equivalent governed handlers.
Monoidal Categories and Algebraic Effects: The framework extends the category of programs (Mashin) with a symmetric monoidal structure. It constrains the algebraic effect system such that only handlers carrying a machine-checked safety certificate (GovernedHandler) can be constructed in the safe fragment.

The formalization uses parameterized coinduction (via the paco library) to prove properties like gov safe and within caps (capability bounds). The system is extracted to OCaml and integrated as a Native Implemented Function (NIF) into the BEAM runtime, with property-based testing (70,000+ random inputs) verifying behavioral equivalence between the specification and the runtime.

Key Contributions

1. Parametric Governance Algebra and Monoidal Structure

The paper defines a GovernanceAlgebra record. From the three axioms, it derives convergence, compositional closure, and goal preservation for any system satisfying these axioms.

Monoidal Structure: The category Mashin is proven to admit a symmetric monoidal structure with verified pentagon, triangle, and hexagon coherence.
Governance Preservation: Crucially, every tensor composition (parallel/sequential independent composition) preserves governance. The proofs are computational rather than coinductive because structural morphisms are pure.

2. Governed Algebraic Effects

Unlike standard algebraic effect systems where any handler is valid, this framework restricts the handler algebra.

GovernedHandlers: Only handlers bundled with a proof that their interpretation satisfies gov safe can inhabit the GovernedHandler type.
No Ambient Effects: A theorem proves that programs in the empty capability set emit only observability directives. They cannot perform LLM calls, HTTP requests, or other effects unless explicitly authorized by the capability set.

3. Capability-Indexed Composition and Dual Guarantee

Programs are bundled with machine-checked capability bounds (CapMorphisms) verified by a trust lattice.

Composition: Sequential, tensor, and branch composition operators preserve capability bounds.
Dual Guarantee: A central theorem establishes that for any program, capability bounds (what the program can do) and governance safety (what the program is allowed to do) hold simultaneously. Static capabilities bound the potential effects, while dynamic governance ensures every effect passes a check before execution.

4. The Coterminous Boundary

The paper's capstone result defines the relationship between expressibility and governance within the formal model:

Expressible (E): Programs constructible from four primitive morphisms (code, reason, memory, call).
Governed (G): Programs where the interpretation through G satisfies gov safe.
Result: $E = G$ . Every expressible program is governed under interpretation, and every governed program is the image of an expressible program.
Implications: Turing completeness is preserved inside governance. Unmediated I/O is structurally excluded from the governed fragment. Governance denial is modeled as safe coinductive divergence (non-termination), ensuring no unsafe result is ever produced.

Results and Verification

Formal Verification: The entire framework is mechanized in Rocq with zero admitted lemmas.
Runtime Extraction: The extracted OCaml code runs as a NIF in the BEAM runtime.
Testing: Property-based testing with over 70,000 random inputs showed zero disagreements between the Rocq specification, the extracted NIF, and the Elixir interpreter.
Performance: The governed execution path adds no measurable overhead (median 0.23 ms vs. 0.24 ms for ungoverned execution).
Trace Semantics: The framework derives trace-level properties, proving that governed execution produces "well-governed" traces where every I/O event is preceded by a passing governance check. These traces map to a tamper-evident ledger via hash-chaining.

Significance and Claims

The paper claims to provide the first mechanized framework that combines governance-constrained interpretation, capability-bounded algebraic effects, and a coterminous expressibility/governance theorem over an interaction-tree-based execution model.

Structural vs. Content Governance: The work distinguishes itself from behavioral approaches (which filter outputs) by enforcing structural governance (mediating effects). Theorem 3.3 establishes that structural governance provides guarantees that output-oriented controls cannot replicate within this formal model.
Parametricity: The GovernanceAlgebra is parametric; derived theorems hold for any system satisfying the three axioms, not just the specific Mashin instantiation.
Compositionality: The framework proves that governance is closed under all system composition operators, addressing a gap in prior work that verified individual programs but not their composition.
Limitations: The authors note that the tensor product is sequential-independent (not truly concurrent), the hash chain relies on an abstract injective hash (requiring further work for concrete cryptographic hashes), and the NIF wrapper itself is not formally verified. The coterminous boundary is established specifically for the four-primitive execution model.

In summary, the paper argues that by axiomatizing governance as an algebraic structure over interaction trees, one can achieve a system where governance is coterminous with expressibility: if a program can be written in the system, it is structurally guaranteed to be governed.