The Governed Data Foundry

Abstract

Enterprise data architecture widens its responsibility whenever the consumer of data changes. Databases served applications, warehouses served analysts, semantic layers served business users, and the current generation increasingly serves machines. That transition is already well underway: the major data platforms and an Apache-incubated specification effort are turning governed business meaning into a portable, vendor-neutral property of the data estate rather than a downstream convenience.

The next transition differs in kind. When software crosses from reading enterprise state to changing it, the architecture must answer questions no conventional data platform was designed to answer. Which of several legitimate interpretations governs this decision? What evidence supported it at the moment it was made, and what was merely unavailable? Whose authority is being exercised, through what chain, and did any hop expand rather than narrow it? What has the actor demonstrated, and how much of the principal's authority does that evidence justify delegating? Is the constraint at stake one the enterprise may release at all? What state changed, whether it can be reversed, and what the institution should permit next time?

The Governed Data Foundry is a reference architecture for that transition. It organizes ten logical responsibilities into a closed loop running from operational state through meaning, context, standing, evidence, competence, authority, and enforcement, returning consequence as institutional memory. It does not prescribe ten products. It specifies ten questions that any implementation governing consequential machine action must be able to answer, even when several answers are supplied by one platform.

The v3.4 architecture makes one correction that changes the logic of the upper half of the stack: evidence does not originate authority. Authority originates with an accountable principal capable of bearing responsibility for the delegation. Evidence, competence, and retained outcomes determine how much of that authority may responsibly be delegated, to whom, for which decisions, and for how long. The architecture therefore has to preserve the chain from principal to actor, verify that every hop attenuates rather than expands the grant, bind each delegation to the rule state that authorized it, and re-derive the grant when that rule changes.

A second change is equally consequential. The decision is no longer governed only by consequence magnitude and reversibility. It also depends on releasability. Some constraints are internally releasable under a named authority. Others are externally owned by a lender, counterparty, regulator, filing, or contract. No internal executive can “approve through” such a constraint because the enterprise does not own the right to release it.

The architecture continues to consume what the modern data, identity, policy, ontology, and agent-protocol stacks already solve rather than recreating them. It retains the v3.3 requirement that analytical computation may be delegated without surrendering semantic meaning, and it preserves the distinction among false, unknown, unavailable, redacted, missing, and approximate states throughout the decision path.

Three constructs remain central. The interpretation warrant records which of several legitimate meanings governs a consequential decision, where the governing constraint originated, and who may release it. The reversibility class makes recoverability part of the authority decision rather than an operational afterthought. The portable competence assertion allows one institution to attest to what an agent has demonstrated without carrying institutional authority across the boundary.

The result is a future data architecture whose product is not merely trusted data, shared meaning, or model context. Its product is governed enterprise state: a representation rich enough for humans and machines to understand what is happening, trace whose authority is being exercised, distinguish what is false from what could not be established, determine whether a constraint may be released at all, decide what consequential action is permitted, enforce the boundary before execution, and learn from the outcome.

1. The Constraint

Everything in the architecture is tested against one constraint:

When a machine can change consequential enterprise state, the institution must be able to reconstruct, after the fact and from retained evidence, which interpretation governed the decision, what supported it at the time, whose authority the actor was exercising and through what chain, why that actor was permitted to act, how the boundary was enforced, what changed, and whether the change can be undone.

Three properties of that constraint drive every decision downstream.

It is reconstructive rather than merely preventive. A conforming system must preserve state that no one may know will matter until months after an action occurs. A governance architecture that prevents some failures but cannot later explain why a permitted action was legitimate is incomplete. So is an audit system that can describe an event but cannot reconstruct the institutional conditions under which permission was granted.

It is temporal. Reconstruction has to use what was knowable then rather than what is knowable now. An action may have produced a bad outcome even though the decision was defensible on the evidence available at the time. Another may have produced a good outcome despite weak evidence and poor authority discipline. Governance must distinguish those cases, which means evidence, policy, actor state, semantic definition, delegation state, dataset state, and evaluation context have to be preserved as they existed at decision time rather than reconstructed from current state.

It is also closed-loop. Reconstruction cannot terminate in an archive. Outcomes have to feed back into what the institution accepts as evidence, what it believes an actor has demonstrated, whether a standing delegation remains justified, which interpretations remain credible, and what authority it is prepared to delegate next.

That test converts an abstract governance ambition into an architectural acceptance criterion. A system that cannot answer all seven may still be useful, secure, auditable, or well instrumented, but it has not implemented the Governed Data Foundry as defined here.

The deeper cause is not regulation. It is the collapse of management latency.

The twentieth-century enterprise could leave considerable authority implicit because time separated observation from decision, decision from execution, and execution from consequence. Managers could interpret boundaries, escalate exceptions, halt actions, and withdraw delegations before effects compounded. That latency was not merely bureaucratic waste. It was one of the load-bearing conditions that made informal authority survivable.

Once consequential action moves at machine speed, an organizational understanding can no longer serve as the control surface. It cannot execute, cannot bound an agent, cannot prove whose authority the agent is exercising, and cannot refuse an action before it lands. The portion of institutional authority delegated to machines therefore has to become computationally legible and enforceable at the moment of action.

Regulation dates that requirement rather than causing it. The high-risk obligations of the EU AI Act took effect on August 2, 2026. Article 12 requires automatic event recording across the system lifetime. Article 14 requires human oversight capable of intervention rather than after-the-fact reading. Article 26 requires deployers to retain generated logs for at least six months. Recitals 99 and 100 extend the compliance boundary through chains of agents. For financial entities, the Digital Operational Resilience Act adds an overlapping operational-resilience obligation. At the same time, the relevant logging and oversight standards remain drafts, leaving enterprises to satisfy outcome-defined requirements without one conformant implementation pattern to purchase.

The commercial evidence converges on the same architectural point. Gartner forecast that more than forty percent of agentic AI projects would be cancelled by the end of 2027 and named escalating cost, unclear business value, and inadequate risk controls rather than model capability. The important signal is not the exact percentage. It is the location of the failure. Programs can demonstrate comprehension and still stall when an institution has to state, in a form that survives scrutiny, that a machine may proceed without asking.

2. What the Current Stack Already Solved

The Governed Data Foundry begins with an intentionally conservative premise: do not call an existing capability whitespace simply because the architecture needs it.

Modern semantic and ontology systems already cover a significant portion of what an agent needs in order to understand an enterprise. Identity vendors are rapidly establishing the agent as a governed actor. Policy-as-code has already solved important parts of decision and enforcement separation. Agent protocols are standardizing communication paths. Runtime-governance research is formalizing execution evidence. A credible future architecture should build on that work, not erase it.

3. The Ten-Layer Architectural Model

The Governed Data Foundry is ten logical responsibilities arranged as a closed loop. Each answers exactly one question.

The layers group into four larger zones. Layers 1 through 3 form the Foundation, making enterprise information reliable, computable, governed, and semantically useful. Layers 4 and 5 Understand and Interpret, turning information into operating context and determining which interpretation has standing. Layers 6 through 9 Decide and Control, connecting evidence, authority lineage, competence, permission, and enforcement. Layer 10 Learns and Adapts, returning consequence into the architecture.

The practical reason for separating the questions is failure analysis. If one platform happens to implement semantics, context, identity, policy, and logging, the enterprise should still be able to identify where governing meaning was established, where authority entered, where the grant was narrowed, where evidence was evaluated, where permission was decided, where enforcement occurred, and where the observed outcome entered the record.

Three properties of that control flow are load-bearing.

First, authority enters the architecture from an accountable principal. The loop does not manufacture authority from evidence, competence, or successful outcomes. Those signals condition the extent of a delegation that already has a legitimate institutional origin.

Second, every delegation hop attenuates rather than expands. The grant reaching an agent must be a subset of the grant held by its grantor in category, ceiling, exposure, duration, exclusions, and obligations.

Third, enforcement does not reach the system of record directly. The enforcement point permits or refuses; a separately credentialed effector performs the write. Accountability then receives the enforcement verdict, the effector result, and the observed outcome from the system of record so the record can distinguish what was allowed from what actually occurred.

The return path is still the purpose of the model. Traditional data architecture moves information upward toward comprehension. The Governed Data Foundry also governs movement downward toward action and returns consequence into the layers that determine what may happen next. What the return path can revise is the extent and standing of a delegation, never its institutional origin.

4. The Governed Action Record

The central noun of the architecture is the governed action record. It is not a transaction log and it is not an agent trace. It is the artifact required to reconstruct why a consequential machine action was institutionally permissible.

Every upper layer either contributes to this record or consumes something from it.

governed_action_record:
  id: gar-2026-09-01-a41c9f

  proposal:
    actor: agent://procurement/supplier-onboarding/v4
    intent: approve_purchase_order
    parameters:
      po_id: PO-88213
      amount: { value: 10000, currency: USD }
      supplier: entity://supplier/nordvale-gmbh
    proposed_at: 2026-09-01T09:14:02Z

  authority:
    accountable_principal: person://cfo/j-marek
    instrument: resolution://board/2026-03/delegation-schedule-4
    chain:
      - holder: person://cfo/j-marek
        grant:
          categories: [procurement]
          ceiling: { value: 5000000, currency: USD }
      - holder: person://procurement-director/l-okonjo
        grant:
          categories: [procurement]
          ceiling: { value: 250000, currency: USD }
      - holder: agent://procurement/supplier-onboarding/v4
        grant:
          categories: [purchase_approval]
          ceiling: { value: 25000, currency: USD }
        excluded: [new_counterparty, sanctioned_jurisdiction]
        obligations: [notify_controller_above_5000]
    attenuation_verified: true
    issued_under_rule: policy://procurement/approval@v12
    valid_until: 2026-12-31
    expiry_condition: aeas_below(700) OR override_rate_above(0.05)

  interpretation_warrant:
    warrant_id: iw-margin-operating-2026Q3
    concept: contribution_margin
    governing_definition: def://finance/margin/operating-plan@v7
    scope: procurement_approval
    mandate: role://cfo
    valid_from: 2026-07-01
    valid_until: 2026-09-30
    alternatives_not_selected:
      - def://finance/margin/statutory@v3
      - def://finance/margin/covenant@v2
    constraint_provenance:
      origin: internal
      set_by: person://finance/controller
      set_on: 2026-06-28
      release_authority: role://cfo

  evidence_envelope:
    asserted_at: 2026-09-01T09:14:02Z
    claims:
      - claim: supplier_sanctions_clear
        kind: evidence
        information_state: present
        truth: true
        source: system://compliance/screening
        observed_at: 2026-08-31T22:00:00Z
        staleness_budget: PT24H
        confidence: 0.99
      - claim: beneficial_ownership_verified
        kind: evidence
        information_state: unavailable
        truth: unknown
        source: system://registry/eu-ubo
        attempted_at: 2026-09-01T09:13:58Z
    contradictions: []

  actor_state:
    identity: idp://agent-identity/8f21
    earned_authority:
      score: 782
      task_class: purchase_approval
      context_band: established_supplier_eu
      sample_size: 431
      last_override_at: 2026-05-02
      decay_applied: true

  authority_decision:
    verdict: permit_with_conditions
    policy: policy://procurement/approval@v12
    rule_state_established_at: 2026-08-15T00:00:00Z
    conditions:
      - notify: role://controller
      - resolve_before: beneficial_ownership_verified
    unresolved_predicates:
      - beneficial_ownership_verified
    consequence_class: financial_commitment
    reversibility_class: compensable
    releasability: internally_releasable
    delegated_predicates:
      - predicate: supplier_spend_trailing_12m
        target: semantic://analytics/spend-model@2026-09
        lowering: exact
        snapshot: ds-2026-09-01T00:00:00Z
        approximation_permitted: false
    decided_at: 2026-09-01T09:14:03Z

  enforcement:
    outcome: permitted
    enforced_at: 2026-09-01T09:14:03Z
    effector: effector://erp-write/po-service
    idempotency_key: gar-2026-09-01-a41c9f
    compensation: erp://purchase-order/cancel?po_id=PO-88213
    pivot_reached: false

  outcome:
    state_change: erp://purchase-order/PO-88213#status=approved
    observed_at: 2026-09-01T09:14:07Z
    realized: pending
    review_due: 2026-11-30

Eight properties of the record are normative.

First, every consequential action traces to an accountable principal through a recorded delegation chain and an institutional instrument. An actor that possesses credentials but cannot trace the authority being exercised back to a principal capable of bearing responsibility is not institutionally authorized.

Second, no hop in that chain may grant more than it received. Attenuation is checked at decision time rather than discovered in audit because once the action has landed, a silently expanded grant can look indistinguishable from a legitimate one.

Third, each delegation binds the rule state under which it was issued. If the governing rule changes, the standing delegation rests on a basis that no longer exists and must be re-derived rather than grandfathered silently.

Fourth, the interpretation warrant preserves the governing definition and the alternatives not selected, but v3.4 adds constraint provenance and release authority. A downstream field containing a threshold is not enough. The record must retain who established the constraint and whether anyone inside the enterprise has the right to release it.

Fifth, the evidence envelope distinguishes evidence from testimony, preserves staleness, and keeps information state separate from truth value. Present, partial, null, missing, unavailable, redacted, and error remain different conditions. A predicate that cannot be established is recorded as unresolved rather than silently converted into false.

Sixth, the authority decision records three different dimensions of exposure: consequence class, reversibility class, and releasability. A low-value action can still be terminal. A reversible action can still cross an externally owned covenant. The three axes answer different questions and none substitutes for the others.

Seventh, enforcement carries the compensation handle and pivot state at decision time, while delegated predicates preserve their lowering classification and dataset snapshot.

Eighth, every business concept resolves through a stable semantic identifier, and every mutable dataset, semantic model, policy module, or external table that influenced the decision carries reproducible snapshot state. A stable identifier gives the historical reference an address; it does not reproduce the value that address returned at the time.

The competence score shown in the example is deliberately replaceable. The reference architecture requires a bounded, context-scoped, decaying measure of demonstrated capability. That measure conditions how much of a principal's authority may be delegated. It does not originate authority itself.

5. Three Constructs Without Prior Art

The architecture introduces three constructs that remain absent from the systems catalogued above.

6. Predicate Delegation and Semantic Lowering

The decision point will routinely evaluate predicates over business concepts that are analytical in nature: trailing aggregates, percentiles, windowed comparisons, filtered counts, cohort measures, and related calculations.

Reimplementing those calculations inside an authority layer would be a mistake. The data and semantic platforms already know how to compute them correctly at scale. Delegation is therefore the right architectural move.

The problem is that delegating computation can silently delegate meaning.

A policy may ask whether twelve-month supplier spend exceeds a threshold. The canonical predicate belongs to the policy and semantic model. The analytical system is merely a target capable of evaluating it. If the target's SQL dialect, null semantics, approximate aggregation, timestamp behavior, collation, or default filters are allowed to redefine the predicate, the architecture no longer has a stable authority decision. It has a query result with a verdict attached.

Three requirements follow.

7. Five Candidate Architectures

Five realizations of the reference model are plausible. Each solves part of the problem. Each is evaluated against the standing constraint rather than against feature breadth.

8. The Recommended Architecture

The recommendation remains a mediating control plane above a rented semantic foundation and beside an external identity substrate, with ontology-platform-native delivery accepted as an implementation accelerant where such a platform is already strategic.

The investment logic matters as much as the technical decomposition.

Layers 1 and 2 are permanent and external. A Governed Data Foundry implementation should not rebuild systems of record, general storage, compute, or model infrastructure.

Layer 3 is converging. It should increasingly be rented under an Apache Ossie conformance contract. Its integration value remains high even as its differentiating value declines.

Layer 4 is contested from three directions at once: warehouse and lakehouse platforms are moving upward into context; operational ontology platforms already occupy significant portions of it; and a foundation-governed specification is beginning to define a conceptual layer above the physical and logical model.

The safer response is to hold context federatively and conform to emerging ontology interchange as it stabilizes. The architecture should be able to surrender more of Layer 4 to standards and incumbent platforms over time without losing adjudication, evidence, authority lineage, competence, permission, enforcement, or outcome memory above it.

Predicate delegation reinforces that strategy. The authority layer should not reimplement analytical computation merely to remain self-contained. It should preserve canonical meaning, delegate computation under a governed lowering contract, and retain enough provenance to reproduce how the result was obtained.

Layers 5 through 10 contain the durable governed-consequence problem. The identity portion of Layer 7 is external and permanent, but authority lineage and competence remain distinct responsibilities. Identity providers model technical actors and scopes; they do not model the institutional delegation schedule that explains why this actor is entitled to exercise this portion of this principal's authority.

Layers 8 and 9 extend the policy-as-code lineage and inherit its maturity. Layer 10 is still the compounding asset and is required independently of whether broad autonomy arrives, which makes it the correct first build.

Outcome memory, however, no longer “creates” earned authority. It changes the evidence supporting an existing delegation. A deteriorating record may narrow or expire the grant. A strong record may justify a broader grant when an accountable principal chooses to issue one. The institution remains the source of authority.

That sequencing reduces technical and institutional risk. The enterprise can begin preserving decision lineage and observed outcomes while humans still approve consequential actions, then use the resulting record to determine whether standing delegations remain defensible or should be re-derived.

9. Twenty-Three Invariants

The architecture remains governable only if several boundaries are treated as invariants rather than implementation preferences. v3.4 groups them by the failure they prevent: separation, epistemic integrity, delegation integrity, execution integrity, and record and reversal.

10. The Write Path

The read path is familiar: systems to data, data to semantics, semantics to operational context.

The write path is where the Governed Data Foundry becomes a different class of architecture.

A governed write begins when an actor proposes an intent against the current operational context. Before the decision point can evaluate the proposed action, it must establish whose authority is being exercised and verify the chain by which that authority reached the actor.

The decision point then evaluates the proposal against the authority chain, the interpretation warrant, semantic classifications, the evidence envelope, the actor's competence, the consequence class, the reversibility class, the releasability of the constraint at stake, and the governing policy state. Analytical predicates may be delegated, but only under the lowering contract described in Section 6.

The resulting verdict may permit, refuse, narrow, require additional evidence, escalate to a human principal, or require compensable execution. A predicate that is unknown remains unresolved. A constraint that is externally owned admits no internal override.

Policy enforcement applies the verdict. On permit, the enforcement layer hands a signed execution grant to a separately credentialed effector together with an idempotency key derived from the governed action record. The effector performs the write against the system of record. The enforcement verdict, effector result, and observed system response all return to accountability and outcome memory.

Compensation, where needed, becomes another governed action rather than a privileged bypass.

Three production failure modes remain central.

11. Delegation Lineage and Cross-Boundary Authority

Authority enters this architecture from outside it.

An accountable principal holds authority by virtue of an institutional instrument—a board resolution, role charter, delegation schedule, legal mandate, ownership right, contractual authority, or equivalent source. The principal delegates a portion of that authority and remains answerable for what is done under the grant.

The architecture's job is not to invent that authority. Its job is to carry the grant faithfully, narrow it correctly at each hop, refuse action outside it, and preserve enough state to reconstruct whose authority produced a consequential change.

A representative chain may run from accountable principal to executive, from executive to operating leader, from operating leader to an agent, from that agent to a sub-agent, and finally to an action. At each hop the question is not simply whether the recipient holds credentials. The question is whether the grant narrowed appropriately in category, ceiling, exposure, duration, exclusions, and obligations.

Delegations also decay against their own basis rather than only against the clock.

A review date says when someone will look again. An expiry condition says what would make the grant indefensible: a competence score falling below a threshold, an override rate exceeding one, a jurisdiction changing, a risk classification worsening, or the governing rule being replaced. The second is the stronger construct because it allows evidence to narrow or expire a grant without pretending the evidence created the grant in the first place.

Rule-version binding is equally important. A delegation issued under procurement policy v12 cannot silently survive into v13 if v13 changes the threshold, category, release authority, or required evidence. The grant must be re-derived under the new rule state.

Cross-boundary delegation is the same problem with the chain broken at an organizational edge.

A2A can carry communication and signed identity across that boundary. A portable competence assertion can tell the receiving institution what the foreign actor has demonstrated. Neither transfers institutional authority.

The receiving institution evaluates the foreign competence assertion, applies its own interpretation warrants, evidence requirements, releasability rules, and policy, and then grants whatever local authority it chooses under its own accountable principal. The sender's operating history need not cross the boundary, and the receiver's policy is not delegated outward.

Intelligence federates on different terms. Models, evaluation methods, compute, tool adapters, and semantic infrastructure compound with scale and should often be shared. Authority does not, because the institution that bears the consequence retains jurisdiction over the context that makes an action legitimate.

This commitment has commercial cost because centralized control is easier to sell and operate. It is nevertheless architectural. The institution bearing the consequence must remain the institution whose principal originates the local grant.

The cross-boundary mechanism still depends on governance semantics above A2A that do not yet exist as a standard. Until they do, cross-boundary delegation conforms to this architecture only where the receiving institution can obtain equivalent assurance by bilateral agreement.

12. What Is Actually Differentiated

Prior art should be stated without softening.

Operational ontology platforms model objects, links, actions, permissions, action logs, and reverts. Snowflake and Databricks model governed semantics natively, and Databricks has entered part of the ontology and context problem. Apache Ossie is standardizing semantic interchange across vendors under foundation governance and extending toward conceptual ontology. Microsoft and Okta model agents as identities with delegated and autonomous flows. OPA established policy decision and enforcement separation. A2A and MCP standardize important agent and tool communication paths. Runtime-governance research formalizes authorization, path compliance, history integrity, and replayability.

The Governed Data Foundry therefore does not claim that meaning, identity, policy, or agent communication are new.

Its differentiation now lies in six commitments these systems do not presently make together.

First, it traces every consequential action to an accountable principal through an authority chain whose attenuation is verified before action, not inferred later from credentials or logs.

Second, it represents which of several legitimate interpretations governs a decision, using a versioned warrant that preserves the alternatives not selected, the provenance of the relevant constraint, and the authority—if any—that may release it.

Third, it lets retained outcome evidence condition the extent and continued standing of a delegation without treating evidence as the source of authority.

Fourth, it preserves the distinction between false and what could not be established, through the evidence envelope, the decision, and every analytical delegation boundary between them.

Fifth, it binds permission to reversibility and releasability as well as consequence magnitude, resolving both before execution.

Sixth, it treats competence as potentially portable across organizational boundaries while keeping authority local to the institution whose principal bears the consequence.

The differentiation is therefore compositional rather than territorial. The Foundry becomes valuable where several mature infrastructures have to meet, while preserving enough separation that no subsystem can silently convert comprehension, classification, entitlement, evidence, approximation, or platform permission into institutional authority.

13. Implementation Sequence

The Foundry should not be built by modeling the enterprise first.

That approach reproduces a familiar failure mode of master-data and enterprise-ontology programs: years spent pursuing completeness before the architecture encounters consequence.

The model should be earned through operating reality.

Begin with one consequential workflow. A procurement approval may require only supplier, contract, amount, jurisdiction, business unit, requestor, accountable principal, delegation instrument, actor identity, evidence, governing policy, release authority, reversibility, effector, and outcome. A second workflow reveals missing relationships. A third exposes a reusable semantic distinction. Repeated operating pressure progressively discovers the ontology and the delegation model.

The implementation sequence therefore follows four phases.

Phase I: Establish governed meaning. Extend the existing semantic estate rather than duplicating it. Critical concepts, metrics, lineage, quality, certification, classification, and ownership become machine-consumable under an Apache Ossie conformance contract. Stable semantic identifiers are a hard requirement because every later warrant and policy depends on referential continuity.

Phase II: Introduce operational context. Add the actors, relationships, temporal state, commitments, exceptions, and action-relevant objects required by one workflow. The test is whether the architecture can describe the world in which the decision occurs, not merely the data used to calculate it.

Phase III: Make delegated authority explicit. Introduce the accountable principal, delegation instrument and chain, interpretation warrant and release authority, evidence envelope, actor competence state, governing policy version, reversibility and releasability classes, delegation contracts for analytical predicates, escalation paths, and non-bypassable enforcement. Human approval may remain. The objective is explicit authority, not maximum autonomy.

Phase IV: Close the learning loop. Return outcomes into evidence and competence. Use that record to determine whether standing delegations remain justified, should narrow, should expire, or should be re-derived by an accountable principal under a changed rule.

One sequencing claim remains normative: among the durable core, Layer 10 is built first. Accountability is a present legal and operating requirement while broad earned autonomy remains a thesis.

The architecture is therefore grown from consequence inward rather than from an abstract enterprise model outward.

14. Conformance

A reference architecture is incomplete if no implementation can fail it.

The Governed Data Foundry therefore has explicit conformance conditions.

15. What This Architecture Does Not Cover

A reference architecture becomes less useful when it expands until every adjacent problem becomes part of it.

The Governed Data Foundry does not specify how models are trained, selected, evaluated, fine-tuned, or served. It does not specify agent planning, orchestration, memory strategy, or reasoning technique. It does not specify data storage, transformation, query execution, or the internal mechanics of the semantic layer.

It does not define an identity protocol, policy language, semantic-interchange format, or expression language for governed predicates. Those capabilities exist or are being standardized elsewhere and should be adopted rather than reinvented.

Section 6 states what any predicate language and lowering contract must preserve, not what syntax or implementation they should use.

The architecture also does not prescribe an institution's delegation schedule. It does not decide who should hold which category of authority, which monetary ceiling a role should possess, or which decisions a board should reserve. It specifies the properties that any such schedule must have once it becomes executable: a legitimate principal, traceable instrument, monotonic attenuation, rule-version binding, expiry conditions, release authority, and enforceable boundaries.

And the architecture does not decide which workloads should be delegated to machines.

That boundary matters because the architecture remains useful even if the pace of agentic autonomy proves slower than expected. Reconstruction, separation, authority lineage, evidence, information-state preservation, referential stability, reproducibility, reversibility, releasability, and outcome memory all retain value under human approval and bounded delegation.

16. What Would Prove the Architecture Wrong

The Governed Data Foundry should remain falsifiable rather than becoming an inevitable-sounding category claim.

The architecture weakens if enterprise agents remain permanently advisory and human approval queues remain the stable long-term boundary for consequential work. In that world, much of the upper Foundry could remain workflow, assurance, and logging infrastructure.

It weakens if identity platforms successfully absorb not merely agent identity and entitlements but full institutional delegation lineage, principal-to-agent attenuation, rule-version binding, competence-conditioned scope, and retained outcome memory. Several responsibilities proposed here would then consolidate below the boundary.

It weakens if operational ontology and semantic-interchange standards become sufficiently expressive to encompass semantic plurality, institutional adjudication, constraint provenance, releasability, delegated authority, separated enforcement, cross-platform outcome memory, and governed lowering. The logical model might remain valid while much more of the implementation boundary collapses into standardized infrastructure.

It weakens if institutions discover that static roles and conventional access policy are sufficient for nearly all economically important agent actions, making outcome-conditioned delegation and authority lineage unnecessary sophistication.

And it weakens if consequential machine systems can operate responsibly without distinguishing entitlement from authority, without preserving a principal-to-agent chain, and without re-deriving grants when the rule that authorized them changes.

The core claim is narrower than any product-category forecast: when machines can change consequential enterprise state, the institution must be able to reconstruct which reality governed, what evidence supported it, whose authority was exercised through which chain, why the actor was permitted, how the boundary was enforced, what changed, and whether the action could have been undone.

If enterprises can sustainably operate without that chain, the thesis fails.

17. Conclusion

The history of enterprise data architecture can be read as a progressive widening of responsibility.

Databases made operational state durable.

Warehouses made fragmented history analytically coherent.

Data lakes expanded what could be retained.

Lakehouses brought large-scale data and computation under stronger operational discipline.

Semantic systems made business meaning explicit.

Operational ontologies are making parts of the enterprise itself machine-readable.

Standards such as Apache Ossie are beginning to make more of that meaning and context portable across platforms.

Agentic AI introduces the next threshold because the machine is no longer merely asking what happened or what something means. It is increasingly positioned to determine what happens next.

The structural problem is management latency. Human institutions could leave authority partly implicit because time existed for hierarchy to interpret, escalate, halt, and reconcile before consequence compounded. Machine execution compresses that interval until an organizational understanding is no longer an adequate authority mechanism.

The enterprise therefore needs more than an authorization rule. It needs a machine-readable account of whose authority is being exercised, the institutional instrument from which that authority derives, the chain through which it was delegated, the proof that every hop narrowed rather than expanded, the rule state that authorized the grant, the evidence supporting its current extent, and the constraints no internal principal is entitled to release.

That changes how earned authority should be understood.

Evidence does not create authority.

Competence does not create authority.

A successful history does not create authority.

Those things determine how much of an accountable principal's authority may responsibly be delegated and whether that delegation should continue. The institutional right originates elsewhere.

The same architecture must preserve the epistemic distinctions introduced in v3.3: false is not unknown, unavailable is not missing, an approximate calculation is not exact, a stable identifier is not a reproducible snapshot, and moving a predicate to another analytical engine does not authorize that engine to redefine the predicate's meaning.

The enterprise therefore moves from data to meaning, from meaning to operational context, from context to institutional standing, from standing to authority lineage, from lineage to evidence and competence, from those inputs to bounded permission, from permission to enforcement, and from consequence back into institutional memory.

That is the Governed Data Foundry.

Its principal output is not merely a dataset, dashboard, metric, semantic model, knowledge graph, context window, agent trace, or access token.

Its output is governed enterprise state: an enterprise representation rich enough for humans and machines to understand what is happening, determine which interpretation legitimately governs, know whose authority is being exercised, decide whether the constraint may be released at all, distinguish what is known from what could not be established, bound the action before execution, and learn from what reality does afterward.

The Foundry closes a loop earlier generations of data architecture could leave open. Data tells the enterprise what happened. Semantics establishes what the information means. Operational ontology establishes the world in which that meaning exists. Adjudication determines which meaning has standing and who may release the relevant constraint. Authority lineage establishes whose institutional right is being exercised. Evidence and competence determine the defensible extent of delegation. Decisioning establishes what may happen next. Enforcement determines whether this attempt proceeds. Outcome memory determines whether the delegation remains justified.

The future of enterprise data architecture is therefore not simply about bringing more intelligence to data.

It is about building the institutional machinery required when intelligence becomes one of the actors capable of exercising delegated authority over the enterprise itself.

Appendix A: Conformance Checklist

An implementation conforms to the Governed Data Foundry reference architecture when it satisfies each of the following for any consequential action it permits.

Reconstruction. The implementation can produce the accountable principal, delegation instrument, and every hop of the authority chain with its grant; the governing interpretation warrant with rejected alternatives, constraint provenance, and release authority; the evidence envelope as asserted at decision time, including claim types, information states, and staleness; actor identity and competence for the relevant task and context; the governing policy version and established rule state; verdict, conditions, and unresolved predicates; delegation contracts and lowering classifications; enforcement outcome; effector and idempotency key; reversibility and releasability classes; compensation handle where applicable; resulting state change; and independently observed outcome.

Separation. Invariants I1 through I23 are enforced at the stated boundaries rather than by convention. Credential separation for I16 through I19 is demonstrable by inspection.

Attenuation. Every delegation chain is verified monotonic at decision time. An implementation that discovers expansion only in retrospective audit does not conform.

Establishment. No consequence can occur under a rule state that was never established in the execution path. If an action can land after the governing rule changed but before the change took effect where decisioning and enforcement occur, the rule is auditable rather than executable.

Referential stability. Every business concept referenced by a warrant or policy resolves through a stable identifier that survives renaming and platform migration.

Reproducibility. Every reference to a mutable dataset, semantic model, policy module, or external reference table carries snapshot information sufficient to reproduce the value used.

Temporality. Reconstruction uses the state available when the action was decided and a declared evaluation time rather than a target system's ambient clock.

Semantic preservation. Every delegated predicate is classified before execution, unrepresentable predicates are refused rather than approximated, and residual difference between canonical and realized computation is recorded.

Closure. Outcome memory demonstrably changes later institutional standing, evidence, competence, or the standing of existing delegations.

Non-bypass. No path from actor to effector omits the enforcement point. Failure of this condition invalidates the apparent completeness of the governance record.

Appendix B: What This Architecture Does Not Cover

The architecture does not specify model training, model selection, model serving, agent planning, orchestration, memory strategy, data storage, transformation, or query execution. It does not define an identity protocol, policy language, semantic-interchange format, or expression language for governed predicates; those capabilities exist or are being standardized elsewhere and should be consumed rather than reinvented.

Section 6 defines the semantic properties that any expression language and lowering contract must preserve, not the language or wire format itself.

The architecture also does not prescribe an institution's delegation schedule. It does not decide which roles should hold which authority, what ceilings should apply, or what a board should reserve. It specifies only the properties a delegation schedule must possess once it is expected to govern machine action: legitimate origin, traceable lineage, monotonic attenuation, rule-version binding, segregation of duties, release authority, expiry conditions, and enforceable boundaries.

It takes no position on which workloads should be delegated to machines. Its claim is narrower: when an institution chooses to permit consequential machine action, the conditions defined here must be satisfied for that action to be considered governed.

Appendix C: Mapping to the Author's Implementation

The reference architecture is implementation-neutral. For readers tracing it against the author's own implementation work, the responsibilities map as follows. These are working names for systems under active development; none is required for conformance.

The predicate-delegation requirements described in Section 6 are realized in the author's implementation through the Kata Language Specification (KS-001), which defines canonical typed and epistemic computation, lowering classification, and analytical interoperability profiles.

The enclosing governed operating machine is described in ADAM: A Governed Operating Machine for AI-Native Software and Multi-Agent Systems (SSRN 7245658).

Acknowledgements

The architecture was sharpened by the standardization and research work of the Apache Ossie community, the Agentic AI Foundation, the Open Policy Agent project, and the emerging literature on runtime execution attestation. Each resolved part of the problem that a new architecture should consume rather than rediscover.

Several of the v3.4 corrections also emerged from the broader argument developed around The Convergent Enterprise: the distinction between entitlement and authority, the requirement to reauthorize when the governing rule changes, segregation of duties at the policy layer, and the difference between a rule being published and being established in the actual execution path.

The term foundry is used here in its metallurgical sense: successive transformation of raw material into something capable of carrying greater purpose. The architectural lineage descends from earlier work on data infrastructure at Yahoo and the Big Data Foundry at Xerox PARC. The current formulation extends that lineage from shared and contextual data infrastructure toward governed enterprise state.

A Note on AI-Assisted Research and Intelligence Provenance

Portions of the synthesis supporting this note were produced with AI assistance under the 451 Labs Writing Covenant. Astra, the Adaptive Strategic Thesis Reasoning Agent, and Clearstory, the knowledge and intelligence provenance system that is the primary realization of the Astra thesis, are theses under active development at 451 Labs and are not shipped products. All analytical judgments remain the author's own.

The architecture itself remains implementation-neutral. The ten layers are not a claim that one organization should own the entire stack, but a statement that when machines are allowed to change consequential enterprise state, these ten questions must remain answerable and the path from comprehension to action must remain reconstructible.

Author's Note: Where This Architecture Comes From

I have spent roughly two decades near the systems institutions use to remember themselves, and this architecture is less a design than an accumulation.

Bell Labs taught me reliability at a scale where millions of ordinary lives depended on systems they never saw. The Oracle years moved the same seriousness into a different setting, where the records were customers, contracts, invoices, orders, inventory, approvals, and exceptions. What I came to understand there is that these are not data points. They are traces of obligation. A contract records that a promise was made. An invoice records that value was delivered. An approval records that authority was exercised. An enterprise runs on those traces, and when they fragment, the organization quietly loses the ability to act coherently.

The failure mode I kept encountering was not technical. It was formal memory drifting away from lived memory. The database stayed clean while the truth moved into side notes, shadow spreadsheets, and the head of the one person who happened to be on vacation. A system can produce exact numbers from flawed memory, and precision is not the same thing as truth. That decade left me with a conviction I still hold: before an organization can decide well, it must be able to remember well.

Internet scale at Yahoo pushed the same question outward. Data had to stop being trapped inside individual applications and teams and become common institutional infrastructure, because at that scale nothing else works.

At Xerox PARC I built the Big Data Foundry: hundreds of terabytes of enterprise data across Hadoop, SAP HANA, OpenStack, Kubernetes and OpenShift, supporting graph analytics, hypergraph recommender systems, and next-best-action work with SAP and global consumer brands. The word foundry was deliberate then and is deliberate now. A foundry is not a warehouse. It is where raw material is heated, shaped, tested, and made into something usable. What that period actually taught me was harder than the architecture. Big data did not make enterprises wise. It made the sensemaking problem impossible to ignore. Companies became richer in records and poorer in understanding, and a recommendation that never enters a workflow is an orphan, however good the model behind it.

Quantiply and Sensemaker were my attempt to answer that. The pattern I was building against was institutions becoming data-rich and decision-poor: fragmented signals, hidden relationships, models producing scores nobody trusted, and consequential decisions still being made by reconstructing reality from fragments. What the work demanded was decision infrastructure rather than analytics. Graph reasoning, because fraud, financial crime, customer risk, and supply-chain exposure are all relationship problems before they are record problems. Human judgment treated as part of the learning architecture rather than an obstacle to automation. Explanation, because a system that cannot be interrogated will not be trusted in a high-consequence workflow. And governance, because AML, fraud, and compliance environments do not tolerate experimental behavior. The cycle we kept returning to was sense, decide, act, learn.

Now the consumer of enterprise information changes again, and this time the change is categorical. An agent does not ask and wait. It reads records, invokes tools, writes updates, routes work, and acts inside processes that already carry authority, history, and human responsibility. Everything that was recoverable while a person sat between the model and the record becomes consequential when nobody does. Capability stops being the interesting question. Authority becomes the question.

That is why the ten layers in this document are not a taxonomy I invented. Each one is a place where I watched something break, in a different decade and a different company. Layers 1 through 3 are the memory problem the Oracle years exposed. Layers 4 through 6 are the sensemaking gap PARC made undeniable. Layers 7 through 9 are the decision and trust problem Sensemaker was built to answer, now carrying real consequence because the actor is no longer human. Layer 10 is the lesson underneath all of them, which is that an institution that cannot reconstruct its own actions cannot learn from them.

The question has followed me from soil and circuits through factories, transit systems, databases, cloud, and big data, and it has only ever changed in scale. How does a system turn signals into action it can be trusted with? This architecture is my current answer.

References

Agrawal, A., Gans, J., & Goldfarb, A. (2018). Prediction machines: The simple economics of artificial intelligence. Harvard Business Review Press.

Apache Ossie (incubating). (2026). Apache Ossie core specification and project repository. The Apache Software Foundation. https://ossie.apache.org and https://github.com/apache/ossie

Apache Ossie (incubating). (2026, July 10). Apache Ossie: the new name for Open Semantic Interchange. https://ossie.apache.org/updates/ossie-enters-apache-incubator/

Databricks. (2026). Unity Catalog semantics. Databricks Documentation. https://docs.databricks.com/aws/en/uc-semantics

European Parliament and Council. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). Articles 12, 14, 26; Recitals 99 and 100.

Gartner. (2025, June 25). Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027 [Press release]. https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027

Linux Foundation. (2026, April 9). A2A protocol surpasses 150 organizations, lands in major cloud platforms, and sees enterprise production use in first year [Press release].

Microsoft. (2026). Microsoft Entra Agent ID: Agent identities, authentication protocols, and OAuth flows. Microsoft Learn. https://learn.microsoft.com/en-us/entra/agent-id/

Open Policy Agent. (2026). How to deploy OPA. https://www.openpolicyagent.org/docs/deploy

Palantir Technologies. (2026). Ontology overview. Palantir Foundry Documentation. https://www.palantir.com/docs/foundry/ontology/overview

Reddy, S. (2026a). ADAM: A governed operating machine for AI-native software and multi-agent systems. SSRN. https://doi.org/10.2139/ssrn.7245658

Reddy, S. (2026b). Earned authority: Agent competency intelligence and the Agent Earned Authority Score. SSRN. https://doi.org/10.2139/ssrn.7268001

Reddy, S. (2026c). The ADAM earned authority kernel. SSRN. https://doi.org/10.2139/ssrn.7268938

Reddy, S. (2026d). The authority layer: Why the next enterprise AI infrastructure category is governed permission, not shared meaning. 451 Ventures.

Reddy, S. (2026e). The convergent enterprise: AI, enforceable delegation, and the end of management latency (451 Degrees standing thesis, v2.5).

Reddy, S., & Koduru, V. Enterprise genome. United States Patent 10,311,376 B2.

Rhodes, J., & Kang, G. (2026, April). Proof of execution: Runtime verification for governed AI agent actions [Preprint]. arXiv:2607.05397.

Snowflake. (2026). Overview of semantic views. Snowflake Documentation. https://docs.snowflake.com/en/user-guide/views-semantic/overview