FORMAL CAUSAL INVARIANT

NO_UNGOVERNED_CAUSAL_EFFECT_PATH

No causal path from untrusted computation to a relevant external consequence may succeed unless it crosses an explicit governed effect boundary for the exact effect under current authority.

`NO_DIRECT_EFFECT_PATH` remains the compatibility identifier used by existing implementation, tests and receipts. This page names its complete causal semantics.

What is governed is causal capacity.

Untrusted computation may think, plan, simulate, disagree or fail internally. What it may not do is convert internal state into a relevant external state transition through an ungoverned path.

Direct
API, tool, system call, actuator.
Human relay
AI output → human → consequential action.
Agent relay
AI → agent/workflow/machine → action.
Shared state
Files, queues, databases, cache, memory.
Authority-bearing
Credentials, tokens, capabilities, actuators.
Resource effect
Compute, storage, network, energy, cost, availability.
Dynamic route
Callbacks, event handlers, plugin loading, fallback paths.
Implicit influence
Telemetry triggers, training data, ranking and feedback loops.
Side channel
Timing or other externally observable causal signal.
Unknown
Uninventoried path → fail closed.

When is a boundary governed?

A boundary counts only when it is explicit, exact-effect-bound, currently authorized, enforceable before commitment, fail-closed and evidenced. Isolation, rollback and compensation may help recovery but are not prerequisites. Some consequences cannot be undone; unauthorized commitment must therefore be prevented.

ExternalEffect(e) ⇒ KnownBoundary(e) ∧ ExactEffectBound(e) ∧ AuthorizedNow(e) ∧ DenyEnforceable(e) ∧ FailClosed(e) ∧ Evidenced(e)

Architecture is not deployment proof.

The invariant is absolute as a design requirement. A production claim is not automatic. The concrete deployment must inventory reachable effect paths, bind each to enforcement, fail closed on unknown paths, preserve evidence, and re-verify when topology, configuration, credentials, plugins, operators or integrations change.

If one consequential path remains outside governance, the deployment is not conformant for that path.

From access mediation to causal mediation.

Zero Trust continuously verifies whether a subject/request may access a resource. Consequence Governance generalizes that discipline from access to consequence: may this causal capacity become this external state transition now?

Zero Trust comparison · Formal verification methods · Governed Effect Path