Deterministic Governance

The Deterministic Governance Plane — where ObsidianWall's enforcement decisions live, and why AI does not govern here.

The Deterministic Governance Plane is one half of ObsidianWall’s Two-Plane Doctrine. It is where every enforcement decision is made.

What “Deterministic” Means Here

A deterministic system produces the same output every time it receives the same input. Given an identical Terraform plan and an identical policy file, Verdict will produce the identical governance decision — every time, on every machine, regardless of when it runs.

This is a deliberate constraint, not a limitation. Governance decisions that affect production infrastructure, regulatory exposure, and audit evidence cannot be probabilistic. An auditor reviewing a decision six months later needs to be able to re-run the same evaluation and get the same answer.

What Lives in This Plane

Verdict       Pre-deployment governance decision engine
Sentinel      Post-deployment reality observation
Risk Ledger   Cryptographically signed decision record

Every component in this plane shares one property: their output is reproducible, explainable, and attributable to a human-authored policy.

The Rule

AI may not authoritatively govern in this plane.

This is the most important architectural constraint in ObsidianWall. No probabilistic model — no LLM, no machine learning classifier, no AI agent — produces or alters a governance decision inside the Deterministic Governance Plane.

Every ALLOW, DENY, DENY_WITH_OVERRIDE, and every condition evaluated to produce that decision, traces back to:

A human-authored policy file
  → A deterministic condition expression
    → A reproducible evaluation
      → A typed, attributable decision

If two different engineers run the same evaluation against the same plan and the same policy a year apart, they get the same answer. That property — not speed, not sophistication — is what makes a governance decision defensible to an auditor, a regulator, or a board.

Why This Matters

Policy evaluation tools that incorporate AI judgment into the enforcement decision itself create a category of risk that does not exist with deterministic evaluation: the decision cannot be fully explained, cannot be guaranteed reproducible, and cannot be defended with the same confidence in an audit.

“An AI model reviewed this Terraform plan and judged it acceptable” is not evidence an auditor or regulator can rely on. “This policy condition evaluated to true against this specific input, and here is the exact expression and the exact values” is.

The Deterministic Governance Plane exists so that every governance decision ObsidianWall produces can be defended with the second kind of statement, not the first.

Where AI Does Operate

AI is not absent from ObsidianWall. It operates in the Probabilistic Intelligence Plane — advising, explaining, correlating, and recommending. See Governance Intelligence for how that plane works, and how the two planes connect through Forge.

Platform Architecture → · Governance Intelligence → · Vocabulary →