An Architectural Framework for Enforceable Decision Boundaries in AI Systems

Key points

• The core failure is not intelligence or alignment but the absence of an enforceable decision boundary between recommendation and action.
• Semantic control cannot enforce action boundaries: prompt injection shows that instructions and user input share one inference process.
• Four design rules: inference may propose but never authorise; authority is resolved outside the model; execution is impossible without resolved ownership; stop and escalation are system states, not conventions.
• A deterministic decision layer returns allow, escalate or block. Missing authority is a hard condition, not a warning.
• Provenance is first-class: policy evaluation, ownership resolution and execution authorisation are recorded when authority is resolved, not narrated afterwards.

The structural failure

Most reliability work tries to improve model behaviour: bigger models, better prompts, longer context, retrieval, fine-tuning, verification. As outputs are wired directly into automated workflows, the distance between recommendation and action collapses, and correct reasoning is no longer sufficient. What matters is whether the system was structurally authorised to act. Failures appear quietly, as actions nobody explicitly approved, with responsibility surfacing only after execution.

Why semantic control is not control

Prompts shift the probabilities of a model’s output. They do not grant or revoke authority, and they cannot halt a downstream process once it has started. If user input can override system instructions, those instructions were never constraints. Prompt injection is therefore structural evidence, not an edge case to be patched.

The architecture

The framework composes five layers. An orchestration layer maintains a canonical system state and prevents any subsystem from progressing to execution without passing required checkpoints, with throttling and drift control for long-running and multi-agent flows. Context and memory are held outside the model as structured, durable state; models receive projections of it rather than being the source of truth.

A deterministic decision layer evaluates scope, authority, risk thresholds, compliance constraints and state, and returns allow, escalate or block. Execution control turns a proposal into a controlled cycle: plans are validated, failed validations trigger bounded correction rather than free regeneration, and humans act as authority nodes whose resolution is required in defined situations. Provenance records each decision path at the moment authority is resolved, creating a chain of custody that can be audited without relying on model explanations.

What the paper does not claim

This is an architectural white paper describing design intent and principles. It is not a certification, a security evaluation or a performance claim; those must be established for the implemented system and each deployment.

This page is a summary written by One World AI. The paper on Zenodo is the authoritative version.

Cite this paper

Bański, P., & Sobieski, S. (2026). An Architectural Framework for Enforceable Decision Boundaries in AI Systems. Zenodo. https://doi.org/10.5281/zenodo.18233853

More research

• Standing to Stop — A stopping point is not enough. The party at it needs presently valid, traceable authority, and the stop must actually change what can happen.
• Architectural Constraints in AI Governance — Governance of AI-enabled operational systems has to live in the architecture that decides which state transitions are admissible — including across sequences of individually acceptable steps.
• Prompt Engineering as a Control Illusion — Prompts influence what a model says. They cannot decide what a system is permitted to do.
• The Missing Place for “Stop” — Systems that work well for years can still drift into decisions nobody can defend — because no one is structurally placed to stop them before execution.