IDENTITY
Verified
Tenant, role, function and scope.
Intelligence Can Be Probabilistic.
Financial Authority Cannot.
Models will improve. They will also remain fallible. GARD does not make model reliability the boundary protecting enterprise control.
PRINCIPLE
The system that wants to act shouldn’t decide whether it may act.
The intelligence plane reasons, recommends and forms intent. The governance plane evaluates identity, mandate, policy and authority. Authorised enterprise systems execute permitted outcomes. These responsibilities remain distinct.
CONTROL
No identity. No authority.
An agent’s ability to call a tool creates access, not delegated authority to use it consequentially. Every GARD resolves to an enterprise identity and organisational context.
MANDATE
Explicit
Authority is delegated, not inferred.
FAILURE
Closed
No verified authority means no governed transition.
BOUNDARY
Governance that can be bypassed isn’t governance.
Consequential agentic actions should cross an enforceable control boundary — not another prompt, suggestion or optional API call. Every Agent. Every Mandate. Governed Before Consequence.
EVIDENCE
Evidence, not just logs.
Logs describe activity. Governance evidence reconstructs the decision: who acted, under which identity, against which mandate and policy, with which verdict, human decision where required, execution and outcome.
ENTERPRISE
Governance authority is not payment authority.
★GARD governs. GARDs operate within mandates. Humans retain their assigned powers. ERP remains the system of record. Banks and payment providers execute financial movement. That separation is deliberate.
CONTROL PLANE
Keep intelligence, governance and execution structurally distinct.
The separation is the security idea: the component forming intent does not grant itself authority, and the governance layer does not need to become the payment rail.
SEPARATION OF RESPONSIBILITIESFAIL CLOSED
INTELLIGENCEReason
Model · agent · recommendation · intent.
GOVERNANCEDecide authority
Identity · mandate · policy · human requirement.
EXECUTIONAct
ERP · bank · payment provider · enterprise system.
EVIDENCEProve
Decision receipt · actor · outcome · accountability.
Don’t trust the claim. Test the control.
★GARD / SECURITY POSTURE — ARCHITECTURE · THREAT MODEL · FAILURE BEHAVIOUR · EVIDENCE
Separation of responsibilities — a consequential action crossing the control boundary
01 / INTELLIGENCEModel, agent and plan. Forms intent. Grants itself nothing.
02 / GOVERNANCEIdentity, mandate, policy and human requirement resolved deterministically.
03 / VERDICTClear, human required, or block. Unverified authority fails closed.
04 / EXECUTIONERP, bank or payment provider acts on permitted outcomes only.
05 / EVIDENCEActor, mandate, policy, verdict, human decision and outcome, bound together.
INTENTAUTHORITY DECIDED HERECONSEQUENCE