A deterministic pre-execution governance layer for AI systems, with verifiable chain-of-custody
Organizations are handing AI systems decisions that carry legal and fiduciary weight, in banking, housing, healthcare, telecommunications, and child safety, faster than they can govern them. Gatekeeper is the governing layer. It decides whether a proposed AI action is permitted before that action executes, and it emits a verifiable record of every decision. What the system refuses to do is as load-bearing as what it does.
The workflows AI is entering are not unregulated. They are governed by enacted statute and regulation: the Telephone Consumer Protection Act for outbound and wireless communications, the Federal Communications Commission's DA 23-1016 for SIM-swap and port-out protections, HIPAA for health information, the Fair Credit Reporting Act for credit decisions, and a growing body of state and international AI-specific law. When a human actor in one of these workflows is replaced or substantially augmented by an AI system, the statutory obligations do not lapse. They continue to attach to the action and to the entity that authorized it.
The mechanism by which compliance is demonstrated, however, was designed for human actors whose decisions leave records produced by identifiable people following defined procedures over time. AI systems do not produce such records by default. The internal state of a generative model is not directly inspectable, its decision boundaries are not deterministic in any sense a regulator or court can use, and the operational logs it does produce describe outputs, not decisions. When a regulator asks why the system took a specific action, the available answers within the dominant deployment pattern are weak: the model was trained to behave this way, the probability threshold was set here, the prompt was structured thus. None of these map to the evidentiary standards courts and regulators have developed over two centuries.
This produces what we call the defense gap. When an action attributable to an AI system violates statute or regulation, the entity that deployed the system bears the liability, and it must then build a defense in a forum that runs on evidentiary standards predating modern machine learning by decades. The canonical defense, that the model decided, is not a defense. It is an admission that the entity relied on a probabilistic process whose specific failures it could not predict. The gap is structural, and three plain statements capture it: a log is not a control, a probabilistic check is not a guarantee, and a record that can be edited after the fact is not evidence.
The contemporary AI safety and governance field has produced four broad categories of intervention. Each has value. None of them produces an admissible decision record for a specific action, because none of them was designed to.
Probabilistic guardrails, including alignment training, system-prompt engineering, and in-model safety classifiers, condition the model toward better outputs. They improve aggregate behavior, not individual accountability, and their output is a probability rather than a verdict. Post-hoc observability and logging record what an AI did, often at high fidelity, but the records are produced after the action, are typically held in mutable backends, and establish no authority under which the action was taken. Observability documents; it does not decide. Human-in-the-loop review paces the AI to a person, which negates the throughput that justified deploying AI in the first place, and under volume the reviewer's attention degrades to rubber-stamping. Output filters and content classifiers run a second model over the first model's output, looking for patterns associated with violations. They inherit the probabilistic problem, and they evaluate text patterns rather than the actual legal authority governing the action.
Gatekeeper is a fifth category, structurally distinct from the four above. It is a deterministic pre-execution governance architecture: same input, same rule set, same verdict, every time, produced before the action is taken and grounded in the specific provision of law it enforces.
Gatekeeper places a deterministic governance checkpoint at the proposal-commit boundary, the point at which an AI agent has formulated an action it would take but has not yet executed it against the world. At that boundary the action exists as a structured proposal: the agent's identity, the proposed action class, the target, the parameters, the inferred context, and a tenant identifier. Gatekeeper interposes there and resolves the proposal to one of three outcomes.
The proposal is consistent with every applicable rule under the active policy packs. The action proceeds, and an artifact is produced and chained.
The proposal raises a rule whose application is conditional or ambiguous, or that requires a judgment which cannot be made deterministically from the available information. The action is held pending an authorized reviewer, whose identity is recorded in the artifact upon adjudication.
The proposal violates at least one rule in the active policy packs. The action is stopped, and the artifact records the violation and the cited statute.
In all three cases the evaluation produces an artifact. The artifact is the unit of evidentiary record: it captures the proposal, the rules consulted, the verdict, the reasoner used, the timestamp, the reviewer identity where one was involved, the tenant, and a cryptographic hash of the whole record chained to the hash of the prior record. Under uncertainty or partial failure the engine does not fall back to permit. It holds at an escalating level, and defers rather than allowing an ungoverned action through.
The design rests on four commitments that hold across every deployment. The decision is deterministic: the same input and the same rule set produce the same verdict every time. It happens before execution, not after. It fails closed: if the engine cannot be reached, nothing proceeds. And the record is append-only: no code path edits or deletes an artifact.
Gatekeeper is a single governance engine driven by an ontology and versioned policy packs, exposed through an API and packaged for on-premises or local-first deployment so sensitive data need never leave the client network. It is model-agnostic behind a single configuration value, so the governed layer outlives any single model and applies whether the AI is built in-house or supplied by a vendor. Every product surface built on top of the engine extracts state and renders verdicts; no surface decides permit versus block on its own. Governance disagreement between surfaces is impossible by construction, because they run the same engine.
Rules are encoded as named individuals in an OWL 2 DL ontology, the W3C standard for formal ontologies amenable to automated reasoning. The ontology defines classes for rule categories (obligation, permission, prohibition, conditional, escalation), the relationships between rules, and the metadata required to evaluate a rule against a proposal. Domain rules are grouped into versioned policy packs, each a coherent collection applicable to one regulatory domain.
Each rule maps to one of three Standard Deontic Logic operators applied to an action class: obligation, permission, or prohibition. Standard Deontic Logic is the formal logic developed for normative reasoning, the logic implicit in how statute and regulation are drafted, which is what allows direct translation from the obligation, permission, and prohibition vocabulary of law. A rule such as "it shall be unlawful to send an autodialed communication to a wireless number without prior express consent" maps to a prohibition on that action absent consent, with the statutory citation attached. When multiple rules apply, conflict resolution follows a stated convention: prohibition dominates permission, specific supersedes general, jurisdiction-specific supersedes default, and the stricter regime wins at bind. The conflict-resolution layer is part of the ontology and is reasoned about, not hardcoded, so it can be inspected and audited.
Every rule carries a FOLIO IRI, a permanent identifier from the SALI Alliance legal-information ontology, that resolves to a specific provision of enacted law in a form any legal forum accepts. This decouples the rule from the implementing code: the rule's authority derives from the cited statute, not from a policy author's discretion. Two consequences follow for the record. The artifact carries the citation alongside the verdict, so any later review can confirm the rule applied is the rule the statute requires. And the chain of reasoning reads as rule, then statute, then verdict, which is interpretable by counsel and regulators without specialized AI expertise.
Each artifact includes a SHA-256 hash computed over the canonical serialization of its content concatenated with the hash of the prior artifact in the same tenant chain. Any alteration of any earlier artifact changes its hash, which invalidates every hash that follows, so tampering is computationally detectable by re-verifying the chain from any known-good point. The construction is similar to the hash chain used in distributed ledgers, but without a distributed consensus layer: the chain is per-tenant and authoritatively held, with each client's artifacts kept in a dedicated, isolated space. A torn record is reported as damaged rather than silently accepted or quietly repaired into a false clean state.
Three invariants govern the engine under uncertainty, partial failure, and adversarial pressure, and are treated as charter-level commitments of the architecture. Escalating holds: where a deterministic verdict cannot be reached, because a reasoner has not returned, a policy pack is degraded, or the chain backend is unavailable, the engine holds at an escalating level rather than defaulting to permit, traversing defined levels from re-evaluation up to higher-authority review. An undecidable proposal never defaults to permit. Adaptive admissibility: the criteria by which an action is judged admissible can shift with the operating regime, but only within stated bounds, and every shift is itself emitted as an artifact, so there is no silent regime change. Constructibility at bind: an action's admissibility must be independently reconstructible at the moment of decision, from the artifact and the cited rules, without relying on cached results, which rules out replaying a prior false permit to authorize a later action.
A governance system earns trust by its boundaries. The following are not gaps or roadmap items. They are refusals, designed in, and they are the reason the record means something.
The architecture is designed so that its claims are verified rather than asserted. Verification runs along four lines.
Independent reasoners. The rule set is reclassified by two independent, open-source OWL 2 DL reasoners, HermiT and Pellet, each well established in the description-logic community. We require that both agree on a validation pass over the full ontology before any policy pack enters a production deployment. If they were to disagree, that disagreement is itself information, logged as a divergence for human review. The reasoner outputs are reproducible from the published policy-pack representations, without access to proprietary code.
Adversarial testing. Proposals are constructed specifically to induce a false permit: salami sequences of individually permissible actions that aggregate to a violation, exfiltration chains that distribute a violation across proposals, and decomposition attacks that restructure a prohibited action to evade the surface form of a rule. Every finding in a build review must survive a dedicated skeptic pass against the actual code before it is accepted, and every accepted fix carries a regression test.
Architectural stress testing. The enforcement architecture is exercised across ten layers, from malformed-input parsing and degraded reasoner availability through chain-write contention, tampered-artifact replay, cross-tenant isolation, cascading reviewer unavailability, and complete simulated reasoner outage. The three invariants in Section 4, escalating holds, adaptive admissibility, and constructibility at bind, were hardened through this testing and adopted as charter-level commitments.
External review and honest markers. Corpora and technical claims are put in front of outside reviewers and grounded in primary sources before they are treated as closed. Inside the product, any citation whose primary source is not yet confirmed is shown as unconfirmed rather than silently trusted.
As of ontology version 1.2.0, the rule set comprised 93 named rule individuals across 30 policy packs, expressed as 168 deontic rules in 1,749 RDF triples. Loaded independently into HermiT and Pellet, the ontology validated as consistent and coherent, and both reasoners independently reclassified 77 rules as prohibitions based on conflict-graph and suppression-chain interactions, a convergence we report as evidence of internal coherence. Across the documented adversarial test corpus, 26 of 26 crafted proposals were correctly identified with a violation artifact emitted in each case and no false permit produced; the corpus is not exhaustive and is extended over time. A commercial pilot with a regulated-industry customer covered six tenants, with policy packs spanning TCPA wireless communications, SIM-swap and port-out protections under FCC DA 23-1016, and a composite vertical pack of invariants, producing backward-linked SHA-256 artifact chains over live traffic.
These figures describe a specific ontology version and test corpus. Live engine metrics are maintained in the running specification and confirmed against the production engine before external use, so this document is read alongside the current figures rather than treated as their fixed source.
Gatekeeper's near-term application is regulated administrative workflows in the public and private sector. In government automated decision systems, a predictive model may flag a case, detect missing documentation, suggest routing, or surface urgency, and Gatekeeper determines whether the resulting action is authorized, explainable, reviewable, and auditable before it can affect a person. The operating rule is stated plainly:
If a required condition is missing, the boundary closes and the action is blocked, escalated, or deferred. If the action proceeds, Gatekeeper emits a reconstructable artifact showing the policy pack, the rule path, the verdict, the reason, the previous hash, and the artifact hash. The claim is kept deliberately tight. Deterministic enforcement, policy-path reconstruction, synchronous pre-execution gating, human-review escalation, and a SHA-256 backward-linked artifact chain are defensible against the build. Fairness is framed as agency-defined fairness and review requirements enforced as gating rules, not as a generic built-in fairness engine, unless a dedicated fairness pack is added and tested.
Beyond the near term, Gatekeeper is the implementation layer of a broader framework. Work is in progress to extend the enforcement architecture to autonomous AI agents that transact in economic systems, and longer-range deployment visions, including cross-border financial transparency at sovereign scale, are held explicitly as strategic frameworks rather than as shipped systems. We describe them as visions, and we distinguish them from what is deployed today.
The architecture has a documented public provenance. The patent application covering the proposal-commit boundary, the cryptographic artifact-chain construction, and the related enforcement primitives was filed on March 6, 2026, with a priority date of November 14, 2025. The project's public code, ontology, and policy-pack representations are accessible through the GitHub organization at github.com/OakandSparrowSystemsEnterprises, where the first public commit defining the enforcement primitives is timestamped February 3, 2026, and architectural development has been documented publicly on a continuing cadence since.
Gatekeeper is the work of Oak & Sparrow Systems Enterprises. The architecture described in this paper was designed and built here, and its sequence is documented by the patent priority date and by public commit history rather than asserted in this document. External parties have stress-tested the architecture adversarially, and that testing is described in Section 6; it did not originate the architecture.
We are explicit about the boundaries of the claim. Gatekeeper does not solve AI alignment in general. It addresses the narrower and more tractable problem of producing an admissible decision record for AI actions in regulated workflows. It does not ensure that a model's outputs align with broader human values, that the model is safe under all adversarial conditions, or that any given rule set is complete for its regulatory domain. It does not produce court-tested admissibility: no AI governance audit trail, including ours, has been litigated to final judgment, so whether a specific court accepts a specific artifact remains an open question to be answered in future litigation rather than asserted here. The architecture is built on primitives already accepted in evidentiary contexts, SHA-256 hashing, statutory citation, and deterministic decision logic, but their composition into an AI governance audit trail has not yet been tested in court. And Gatekeeper does not remove the need for high-quality rule authoring: it executes a rule set, and a poorly authored policy pack will produce deterministic but legally inappropriate verdicts. Rule authoring is done by competent legal and domain experts.
Because the claim is falsifiable, we state the conditions under which it would be considered refuted. If HermiT and Pellet produce different consistency or classification results on the published ontology, the coherence claim is refuted until resolved. If an adversarial proposal of the documented classes produces a permit in production, the prohibition guarantee is refuted for that class. If a documented procedure can alter a prior artifact without breaking SHA-256 verification, the chain-integrity claim is refuted. If a court of competent jurisdiction issues a published ruling rejecting a Gatekeeper artifact chain on grounds related to the construction described here, the admissibility argument is materially weakened. And if an independent party loads the published ontology into either reasoner and obtains different results than reported, the validation claim is refuted. We invite those attempts.
Most AI safety tooling tells you what happened. Oak & Sparrow decides what is allowed to happen, before it does, and hands you a record you can prove. What the system refuses to do is the guarantee. Build the boundary before the machine becomes the court.