Constraining the Commit Boundary: A DIO/ODI-Informed Authorization Guardrail for Agentic Entity Resolution

This paper proposes a Digital Identity Optimization (DIO) and Ontology of Digital Identity (ODI)-informed authorization guardrail for persistent identity-changing mutations in Agentic Entity Resolution (ER).

Agentic ER systems iteratively plan actions, retrieve evidence, update hypotheses, and propose graph mutations. An erroneous identity hypothesis may therefore condition subsequent evidence acquisition and produce observations that appear to confirm the original error. The paper does not claim to eliminate this feedback mechanism. Instead, it distinguishes evidence available to an agent for reasoning from evidence eligible to authorize a persistent change to an entity’s identity.

The proposed architecture connects selected DIO/ODI reconstruction-failure distinctions—referential, semantic, temporal, and contextual—to domain-configured identity-preserving constraints. A diagnostic-to-constraint mapping specifies which identity or continuity propositions a mutation must establish, which relations are insufficient to establish them, and when temporal applicability, contextual requirements, or unresolved conflicts call for deferral.

An abstract two-phase Minimum Viable Digital Identity Optimization (MVDIO) Supervisor Layer separates evidence admission, claim-specific promotion, and protected graph commitment. Admission as UNVERIFIED permits exploratory reasoning but does not confer authorization eligibility. Evidence becomes eligible only for the proposition, evidentiary role, and applicability established under the declared policy. A persistent mutation may be committed only when the candidate graph satisfies the applicable constraints, each required proposition has appropriate claim-specific support, no unresolved material conflict blocks authorization, the operation remains within its authorized scope, and the relevant state and policy versions remain valid at commit time.

The paper develops this contract through a lifecycle-to-boundary analysis, a stylized model of apparent verification, an authorization invariant with explicit assumptions, abstract interface algorithms, and hypothetical corporate entity-resolution cases. A prospective evaluation protocol distinguishes the proposed DIO/ODI-informed mapping from conventional identifier rules, conservative abstention, and a generic authorization boundary configured from the same domain facts.

The contribution is an explicit specification of commit-boundary obligations, not a new matching algorithm, a stand-alone theorem of semantic correctness, or an implemented and empirically validated system. Its property remains conditional on domain-policy adequacy, claim-specific evidence promotion, recorded-provenance integrity, and enforcement of the protected boundary. The incremental value of the DIO/ODI diagnostic organization remains an open empirical question. Broader dependency-aware control of hypothesis-conditioned evidence acquisition and feedback is identified as a separate research direction.