DARM: Machine-Checked Invariant Preservation at a Deterministic Authorization Boundary

As autonomous systems become increasingly capable of selecting, composing, and executing actions, a central security question is whether their authority can be bounded independently of the intelligence that selects those actions. DARM, the Deterministic Algebraic Reference Monitor, studies this question as a machine-checked formal theory of deterministic authorization boundaries, implemented in Lean 4 against Mathlib.

DARM treats the decision-maker as an arbitrary, potentially adversarial action selector. Rather than constraining what an agent reasons about, intends, or plans, it constrains the governed state transitions the agent is authorized to induce. Non-bypassability in DARM is a property of the modeled transition boundary: every governed effect is mediated by the modeled transition function. The theory separates a proven discrete capability-and-policy transition system (the Core) from a continuous authority model based on quantitative margin constraints.

The strongest results concern trajectory safety against adaptive adversaries. An adversary is modeled as an unrestricted, history-dependent policy that may select any event based on the entire observed history. Capability confinement holds against this unrestricted adaptive adversary over arbitrary finite trajectories, with no admissibility assumption. The stronger cross-stratum coherence property requires a per-step monitor-admissibility condition. An explicit counterexample shows that unguarded ratification breaks coherence, and the corresponding ratification guard is proved sufficient and necessary within the model.

DARM additionally establishes compositional boundaries as first-class machine-checked results: authorization enforcement does not imply noninterference; a state-independent algebraic bridge between the strata collapses; a rational multiplicative surrogate fails the required semigroup law; and a proposed typeclass abstraction is too restrictive for the required deployment family.

DARM is not a deployed security system, an AI-alignment mechanism, a cryptographic protocol, or a guarantee of physical safety. It provides a formal boundary theory for determining what deterministic authorization can guarantee, which assumptions those guarantees require, where composition fails, and where the proof boundary ends and implementation trust begins.