🤖 AI

Operational Identity: A Finite Audit of Declared and Implemented Rules of Sameness

This paper formalizes a finite audit framework that detects systematic divergences between declared and implemented identity rules by comparing their respective partitions of a record domain within a refinement lattice, utilizing a three-valued, non-monotonic evaluation to identify specific divergence witnesses without necessarily revealing the underlying implementation basis.

Original authors: Denise M. Case

Published 2026-07-24

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Denise M. Case

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Invisible Rules of "Same-ness"

Imagine you are playing a massive, complex game of "connect the dots" with a friend. You both have a rulebook that says, "If we change the color of a dot, it's still the same dot. If we move it to a new page, it's a new dot." This is how many computer systems work: they have a Declaration, which is the official rulebook written down by the designers. It tells the system how to decide if two pieces of data are "the same" (co-referencing) or "different."

But here's the twist: the computer doesn't just read the rulebook; it also has a Mechanism, which is the actual code, the hidden switches, and the automatic buttons it presses while playing the game. Sometimes, the computer's hidden buttons press a different rhythm than the rulebook says. Maybe the rulebook says "color changes don't matter," but the computer's code secretly says, "If the color changes, we must treat it as a brand new dot!"

This paper lives in the world of Computer Science and Logic, specifically looking at how we keep track of things (like legal rules, AI agents, or database records) as they change over time. The big problem is that systems often lie to themselves. They might follow a hidden rule perfectly consistently, yet that rule is completely different from the one they promised to follow. If you don't check, you might think you are talking about the same thing, while the computer thinks it's talking about something totally different. This matters because if your bank, your medical records, or a legal contract are built on these hidden mismatches, the whole system can crumble when you try to trace what happened.

The Great "Same-ness" Audit

This paper introduces a clever way to catch these hidden mismatches. The author, Denise Case, calls it an Operational Identity Audit. Think of it as a detective story where the detective doesn't just read the suspect's diary (the Declaration); they also watch the suspect's hands while they type (the Implementation).

The Two Partitions
Imagine you have a pile of 100 clay balls.

The Declared Partition: The rulebook says, "If you squish a ball, it's still the same ball." So, you group all the squished balls together. This is the "Declared Partition."
The Operational Partition: Now, watch the robot that handles the balls. Even though the rulebook says "squish = same," the robot has a secret sensor. Every time a ball gets squished, the robot paints a tiny dot on it and puts it in a different box. The robot is following a hidden rule: "Squish = New Ball." This is the "Operational Partition."

The paper's main job is to compare these two groupings. It asks: Does the robot's hidden grouping ever split up a group that the rulebook said should stay together?

The "Divergence Witness"
If the robot splits a group that the rulebook kept together, the paper calls this a Divergence Witness. It's like finding a single pair of clay balls that the rulebook says are twins, but the robot treats as strangers. The paper proves that you don't need to check every single ball to find a problem; finding just one of these mismatched pairs is enough to prove the system is lying about its own rules.

The "Sibling" Detective Work
Sometimes, the robot isn't just following a random secret rule; it might be following a different official rule that the system designers forgot to mention. The paper introduces the idea of Siblings.

Imagine the rulebook says "Color matters" (Rule A).
But there's a known "Sibling Rule" (Rule B) that says "Shape matters."
If the robot is splitting balls based on shape, the audit can say, "Ah! You aren't following Rule A, but you are following Rule B."
However, the paper is very careful here. It proves that just because the robot matches the "Shape" rule inside the groups the rulebook made, it doesn't mean the robot is fully following the "Shape" rule everywhere. It might be mixing and matching. The paper creates a specific "lattice" (a fancy grid) to classify exactly how the robot's secret rule differs from the official one.

The "Version Field" Trap
One of the paper's most fun examples involves a "Version Field." Imagine a document where every time you change a single letter, the version number goes up (1.0, 1.1, 1.2).

The Rulebook: "If the meaning of the text stays the same, it's the same document."
The Robot: "If the version number changes, it's a new document!"
The Result: The robot splits the documents into tiny, tiny groups based on the version number, even though the rulebook says they should be one big group. The paper shows that this is a specific type of mismatch called "Sub-sibling Divergence." The robot is being too picky, splitting things up more finely than even the "Shape" rule would.

The "Passing" Trap (Non-Monotonicity)
Here is the most mind-bending part of the paper. Usually, if you pass a test, you pass it forever. But this paper proves that in this kind of audit, passing is not permanent.
Imagine you check the robot today with 10 balls, and it passes. You declare it "Faithful."
Then, tomorrow, you add one more ball to the pile and connect it to the others. Suddenly, the rulebook says, "Oh, these two balls are actually the same!" But the robot still treats them as different because of its secret sensor.
Now, the robot fails! The paper calls this Non-Monotonicity. A "Pass" verdict is only true for the specific history of events you looked at. If you add more history (more changes, more time), a system that passed yesterday might fail today. You can't get a permanent certificate of "Good Behavior"; you can only get a report card for "Behavior up to this specific moment."

What the Paper Rules Out
The paper is very strict about what it doesn't do.

It does not tell you which rule is the "right" one (e.g., whether "Color" or "Shape" is the true definition of the object). It just checks if the robot is following the rulebook it was given.
It can find hidden rules, but only if those rules are disclosed or discovered by the auditor. The audit works by examining a "registry" of mechanisms (like specific code fields, workflow states, or configuration values) that the system operator shows the auditor, or that the auditor finds through investigation. If a mechanism is hidden in undocumented code or a secret practice that no one reveals, the audit cannot see it. The audit is only as good as the list of switches the designers showed the detective or that the detective managed to uncover.
It does not say the robot is "broken" if it merges two things the rulebook kept separate. The paper only cares if the robot splits things the rulebook kept together. Merging might be okay; splitting is the crime.

The Bottom Line
This paper gives us a mathematical tool to catch systems that are "honest" in their own way but "dishonest" compared to their promises. It turns a vague feeling of "something feels wrong" into a concrete, checkable list of mismatches. It shows that in the digital world, just because a system is consistent doesn't mean it's truthful. And it warns us that our trust in a system is always temporary, because adding just one more piece of history can reveal that the system was never following the rules we thought it was.

Technical Summary: A Finite Audit of Declared and Implemented Rules of Sameness

1. Problem Statement

Modern record systems, particularly those supporting accountability and legal alignment, often operate under persistent disagreement regarding what occurred, which rules apply, and who bears responsibility. To maintain stable reference during disputes, these systems must preserve the identity of records as they are transformed (amended, forked, refined) and exchanged.

The core problem addressed is the divergence between a system's declared identity regime (what the system states determines sameness) and its implemented identity behavior (what the system actually does). A system may apply a consistent rule of sameness that no artifact declares. For instance, a schema may declare content-fixed identity, while a workflow or application logic uses a version field to treat every textual edit as a new entity. This divergence is often invisible to standard consistency checks because the system issues no contradictory claims; its provenance graph and audit logs may be internally consistent, yet the operational rule of sameness differs from the declared one. The paper seeks to formalize this "operational identity" and provide a method to audit the gap between declaration and implementation.

2. Methodology

The paper proposes a formal audit procedure that compares two partitions of a finite record domain $R$ : the declared partition and the operational identity partition.

2.1. The Declared Partition ( $\pi_\tau$ )
Derived from a declared identity regime $\tau$ and a family-labeled transformation history $H$ . The regime defines an identity basis (e.g., content-fixed, structure-fixed) and a classification function that determines whether transformations preserve, break, or are neutral to identity. The declared partition is the equivalence relation generated by non-breaking edges in the history.

2.2. The Operational Identity Partition ( $\pi_d$ )
Derived from a disclosed implementation mechanism (a "surface") $d$ and its identity-relevant uses.

Mechanism Registry ($DB$): A finite set of disclosed implementation artifacts (fields, workflow states, predicates) with computable observation maps.
Identity-Relevant Outcomes: The audit focuses on specific outcome types: referent-identifier assignment, resolution, persistence, transformation treatment, applicability selection, or operation admissibility.
Surface Control: A mechanism is an audit surface only if its identity-relevant uses factor through its value. If uses are jointly controlled by multiple artifacts, the audit escalates to a joint mechanism.
Operational Partition: Records are grouped by their "identity-treatment signatures" (the vector of outcomes produced by the surface). Records with identical signatures belong to the same block in $\pi_d$ .

2.3. The Audit Process
The audit compares $\pi_\tau$ and $\pi_d$ within the refinement lattice:

Faithfulness: A surface is faithful if $\pi_\tau$ refines $\pi_d$ (i.e., the surface never splits a declared co-reference class).
Divergence Witness: A pair $(r, s)$ where $r \sim_\tau s$ (declared as same) but $IT_d(r) \neq IT_d(s)$ (operationally treated as different).
Classification: If a sibling identity basis $\tau'$ $τ^{'}$ exists (e.g., structure-fixed vs. content-fixed), the divergence is classified locally within declared classes into four cases:
1. Sibling-aligned: The surface splits exactly as the sibling does.
2. Sub-sibling: The surface splits strictly more finely than the sibling.
3. Super-sibling: The surface makes some but not all of the sibling's distinctions.
4. Sibling-incomparable: The surface makes distinctions the sibling does not and omits others.
Regime Substitution: A stronger global condition where $\pi_d = \pi_{\tau'}$ on the entire domain. The paper proves that sibling alignment does not imply regime substitution.

3. Key Contributions

The paper makes five specific contributions:

Operational Identity Partition: It defines the rule of sameness induced by an implementation surface as a computable object over a disclosed mechanism registry.
Faithfulness and Divergence: It defines faithfulness as a refinement relation and provides a finite divergence witness that refutes it. It establishes that faithfulness is one-directional: splitting a declared class is a fault, but merging distinct declared classes is not necessarily a fault of a single surface (it may be a store-level conflation).
Divergence Classification: It introduces a four-way local lattice classification for divergence when a sibling basis is available, distinguishing this local alignment from the global condition of regime substitution. It provides a concrete construction (a version field incremented on every edit) that occupies the sub-sibling case.
Non-Monotonicity of Pass Verdicts: It proves that a "pass" verdict is not monotone under the extension of transformation history. Adding history can merge previously separate declared classes, creating a divergence witness among records that were previously examined and found faithful, without any change to the surface or the records themselves.
Disclosure-Relativity: It explicitly frames the audit as relative to three disclosure boundaries: the artifacts in the registry, the surfaces evaluated, and the identity-relevant uses identified. Each boundary carries a completeness claim that the procedure cannot discharge but can refute with a finite witness.

4. Results and Decidability

Finite Decidability: Under the assumption of a finite record domain, finite history, and decidable classification functions, the declared partition, operational partition, faithfulness, divergence witnesses, and divergence classification are all computable.
Complexity: Constructing partitions requires $O((n+h)\alpha(n))$ time using union-find, where $n$ is the number of records and $h$ is the history length. Verdicts and classifications can be computed in $O(n^2)$ time via pair enumeration or expected $O(n)$ time using hashing.
Three-Valued Verdict: The audit returns pass, fail (with a witness and classification), or indeterminate (if preconditions like history accuracy or surface control are not met).
Worked Example: A legal-alignment scenario demonstrates a system declaring content-fixed rule identity ( $RULE\text{-}C$ ) while a version field implementation splits records on every text change. The audit identifies this as a sub-sibling divergence (finer than both content-fixed and structure-fixed bases), proving that the system is not running the declared regime, nor is it simply running the sibling regime ( $RULE\text{-}S$ ).

5. Significance and Claims

The paper claims to supply the "other half" of the comparison between what a system should declare and what it does. Its significance lies in:

Formalizing the Invisible: It makes the "undeclared rule of sameness" computable and auditable, distinguishing it from simple inconsistency or contradiction.
Neutrality: It does not determine the "correct" identity basis (e.g., whether content or structure should define a rule). Instead, it takes the effective declared regime as an input and checks if the implementation is faithful to it.
Audit Rigor: It establishes that a passing verdict is a statement about a specific history and disclosure set, not a permanent certificate of a store. It highlights that extending history can retroactively invalidate a pass verdict.
Limitations: The paper is modest about its scope. It does not discover hidden mechanisms outside the disclosed registry, nor does it resolve substantive legal or causal questions. It provides a formal object (the operational partition) and a finite witness for divergence, leaving the identification of the specific basis responsible for the divergence to the auditor.

The audit is presented as a necessary precondition for examining higher-order questions of responsibility and legal interpretation, ensuring that the reference to the subject matter of a dispute remains stable and inspectable.