No causal path from untrusted computation to a relevant external consequence may succeed unless it crosses an explicit governed effect boundary for the exact effect under current authority.
`NO_DIRECT_EFFECT_PATH` remains the established identifier in implementation, tests and receipts. NO_UNGOVERNED_CAUSAL_EFFECT_PATH is the formal name for its complete causal semantics.
Reasoning, planning, simulation, disagreement, hallucination and arbitrary internal state evolution may remain untrusted while they remain inside the bounded domain and create no relevant external causal influence. The security-critical event is the crossing from internal computation to external consequence.
Internal freedom → governed consequence boundary → world.
If any other causal path reaches the world, the deployment is not conformant for that path.
A boundary counts as governed only when it is explicit, exact-effect-bound, currently authorized, enforceable before commitment, fail-closed and evidenced. Rollback or compensation is optional recovery capability, not a substitute for preventing unauthorized commitment.
The invariant is absolute at architecture level. A production claim is bounded to the concrete installation: reachable paths must be inventoried, mapped to enforcement and re-verified when topology, code, configuration, credentials, plugins, operators or integrations change. Unknown paths fail closed.
Formal invariant · Formal verification · Zero Trust comparison · Governed Effect Path