Governance Before Generation: An empirical N=100 A/B measurement of answer-entitlement and context governance on Gemma 4 12B

Working paper (v0.1; owner review pending before deposit). A retrieval-augmented language model that ingests retrieved context naively will act on whatever that context contains — including instructions to ignore the user and credentials that ride along. We measure this on a single model, google/gemma-4-12B-it (4-bit), holding the weights fixed and toggling only a pre-inference governance layer: a local answer-entitlement router (MMV), context governance (RCGov), and a regex injection guard. Across N=100 distinct adversarial phrasings per condition, greedy decoding, the naive pipeline obeys an injected instruction in 57% of cases (95% Wilson CI 47–66) and repeats a planted credential in 57% (CI 47–66); under-specified prompts reach the model 100% of the time. With governance in front, all three fall to 0% (injection/secret CI 0–4; the model never receives the injected or secret tokens, verified by canary absence), at ~1.3 ms added latency versus ~1.9 s per generation. The paper is explicit that the 0% is a property of deterministic pre-inference removal on these phrasings — a test of filter recall, not a claim of universal robustness or of base-model resistance; the layer is hygiene, not a security boundary.

Companion to the mobius-governance reference implementation and the gemma-4-12b-mobius-custom model. Benchmark and raw counts are released for reproducibility.

AI co-observer: Claude Opus 4.8 (Anthropic), working method only; the registered author is the human author alone.