NO_UNGOVERNED_CAUSAL_EFFECT_PATH

No causal path from untrusted computation to a relevant external consequence may succeed unless it crosses an explicit governed effect boundary for the exact effect under current authority.

NO_DIRECT_EFFECT_PATH remains the compatibility identifier used by existing implementation, tests and receipts.

Every causal crossing is in scope

Internal computation remains free while it stays inside its trust domain. The inventory includes direct APIs and actuators, human and agent relays, shared state, messages, files and artifacts, credentials and tokens, resource consumption, side channels, callbacks and plugins, telemetry-triggered effects, fallback routes and downstream feedback, ranking or training influence. Unknown or unclassified crossings fail closed.

Explicit declaration
The path and effect are named.
Exact-effect binding
The authorization binds the concrete consequence.
Current authorization
Authority is checked at consequence time.
Mechanical DENY
Refusal occurs before commitment.
Fail closed
Unknown, stale or mismatched state cannot commit.
Evidence capability
The decision and outcome can be receipted.

Deployment proof remains bounded

The architectural invariant is absolute. A deployment proof is bounded to declared, inventoried reachability and evidence that each reachable path maps to an enforced boundary; it does not automatically prove every deployment safe. Rollback or compensation is optional recovery capability.

Formal verification · Zero Trust comparison · Governed Effect Path