NO_UNGOVERNED_CAUSAL_EFFECT_PATH
No causal path from untrusted computation to a relevant external consequence may succeed unless it crosses an explicit governed effect boundary for the exact effect under current authority.
`NO_DIRECT_EFFECT_PATH` remains the compatibility identifier used by existing implementation, tests and receipts. This page names its complete causal semantics.
What is governed is causal capacity.
Untrusted computation may think, plan, simulate, disagree or fail internally. What it may not do is convert internal state into a relevant external state transition through an ungoverned path.
API, tool, system call, actuator.
AI output → human → consequential action.
AI → agent/workflow/machine → action.
Files, queues, databases, cache, memory.
Credentials, tokens, capabilities, actuators.
Compute, storage, network, energy, cost, availability.
Callbacks, event handlers, plugin loading, fallback paths.
Telemetry triggers, training data, ranking and feedback loops.
Timing or other externally observable causal signal.
Uninventoried path → fail closed.
When is a boundary governed?
A boundary counts only when it is explicit, exact-effect-bound, currently authorized, enforceable before commitment, fail-closed and evidenced. Isolation, rollback and compensation may help recovery but are not prerequisites. Some consequences cannot be undone; unauthorized commitment must therefore be prevented.
Architecture is not deployment proof.
The invariant is absolute as a design requirement. A production claim is not automatic. The concrete deployment must inventory reachable effect paths, bind each to enforcement, fail closed on unknown paths, preserve evidence, and re-verify when topology, configuration, credentials, plugins, operators or integrations change.
If one consequential path remains outside governance, the deployment is not conformant for that path.
From access mediation to causal mediation.
Zero Trust continuously verifies whether a subject/request may access a resource. Consequence Governance generalizes that discipline from access to consequence: may this causal capacity become this external state transition now?
Zero Trust comparison · Formal verification methods · Governed Effect Path