Chapter 4: Deterministic Governance
Executive Governance Series
Deterministic Governance
Deterministic governance is the substrate-level alternative to attestation-based compliance. The defining property: given the same canon and the same inputs, the substrate always produces the same evidence — byte-for-byte. This chapter explains what determinism buys operationally, why it is the response to the compliance paradox and to drift, and how the substrate enforces it.
What “deterministic” means here
Three properties characterize deterministic governance, distinct from “automated” governance:
- Reproducibility. Same canon, same inputs → same bundle. Independent re-execution by an assessor is the test.
- Provenance. Every claim carries the full envelope (issuer, classification, timestamps, lineage_hash) per
15_ProvenanceProfile.qmd. - Hash-verifiable lineage. Bundle hash is computed over per-claim hashes; modification anywhere breaks the bundle hash.
Automation produces faster output. Determinism produces the same output regardless of who runs it or when. Only the second property gives a 3PAO independent verification.
At a glance — automation is not determinism:
| Property | Automation delivers | Determinism delivers |
|---|---|---|
| Speed | Faster output | Faster output |
| Reproducibility | Output may vary by run, operator, or time | Same canon + inputs → same bundle |
| Provenance | Optional | Full envelope on every claim |
| Independent verification | Not guaranteed | A 3PAO re-runs and compares hashes |
Why determinism is the response to the paradox
The compliance paradox emerges because reported state and substrate state diverge between audit cycles. Determinism collapses the cycle:
- Re-running is cheap. A 3PAO does not have to re-engage the operator to re-execute; the substrate runs the assembly itself.
- Drift findings are first-class. Between audits, drift findings are emitted continuously and carried into the bundle deterministically.
- No “snapshot rot.” The bundle from yesterday is regeneratable today, and the regeneration is the verification.
The audit cycle stops being load-bearing for evidence freshness. It becomes a review event for canon changes, ADR decisions, and program posture — which is what an audit cycle should be.
What determinism is the response to in the drift model
Drift is detected, classified, and remediated through canonical contracts. Determinism makes those contracts evidence:
- A remediation contract emitted at time T is part of the bundle for any window covering T.
- Re-running the bundle for that window months later produces the same contract record, byte-identical.
- The AO can verify the program responded to drift correctly by re-executing, not by reading a narrative.
This is why drift detection without determinism is incomplete: the findings exist but are not assessor-reproducible.
How the substrate enforces it
the program decision declares the four properties evidence emission must satisfy:
- No silent drops.
- Append-only writes.
- Ordered records.
- Idempotent ingestion.
the program decision declares the bundle lifecycle: assemble → seal → submit → close. Once sealed, the bundle is immutable; updates produce new bundles that supersede prior ones with explicit provenance.
Together these constrain every OSCAL emission the substrate makes. SSP, POA&M, KSI dashboard entries, Component Definition records — all emerge from the same deterministic pipeline.
What changes for the program
For program leadership, three operational properties:
- Evidence is regenerable. The program does not have to preserve point-in-time bundles forever; they can be recreated from canon plus archived inputs.
- Vendor lock-in shrinks. The substrate’s deterministic emissions do not depend on the vendor’s GRC tool to assemble them.
- Post-incident reconstruction is cheap. A 3PAO investigating a past period can regenerate the evidence for that period without the original team’s involvement.
For the AO, the operational property is simpler: independent verification is a re-run, not an interview.
Honest limits
- Determinism applies to the evidence layer. Canon correctness is a separate concern; the substrate is faithful to canon, not a check on canon.
- Continuous event-time capture across all adapters is target state. Adapters that ship interval evidence today (e.g. ScubaGear) are deterministic per interval; continuous deterministic capture is engineering ahead.
- Deterministic regeneration depends on archiving the inputs alongside the canon version. Programs that discard inputs after assembly lose the regeneration property.
Key takeaways
- Determinism is the response to both the compliance paradox and the drift problem.
- It is reproducibility + provenance + hash-verifiable lineage — three properties, not just automation.
- the program decision + the program decision constrain every OSCAL emission to the deterministic contract.
- For the AO, independent verification becomes a re-run.
- Honest limit: determinism is faithful to canon; canon correctness is a separate (and primary) concern.
Next: Chapter 5 — The Adapter Model — how tools and control planes enter the deterministic substrate without absorbing their idiosyncrasies into canon.