Governed AI as Runtime Infrastructure: A Unified Authority and Evidence Architecture for Regulated Agentic Systems

Enterprise adoption of autonomous agentic AI in regulated industries requires deterministic proof of authority, non-repudiation, and auditability. We present the implementation, formal protocol specification, and empirical evaluation of the Executable Assurance runtime. The architecture decouples application logic from governance enforcement: an immutable domain-agnostic core runtime is specialized dynamically through domain packs across healthcare, financial settlement, algorithmic lending, legal due diligence, and public procurement.

We evaluate the architecture against two operational signing protocols: (1) managed cloud-native scale using AWS Key Management Service (KMS), and (2) dedicated tamper-resistant hardware security using single-tenant AWS CloudHSM (FIPS 140-3 Level 3). In a continuous 24-hour soak test governing 854,100 consecutive decisions across 2,847 batches, the system maintained flat throughput with zero failed batches and zero permit leakage. Under ten deliberate fault-injection drills—including simulated key revocation, storage outages, and receipt tampering—the runtime strictly adhered to fail-closed invariants, aborting releases before any byte reached external boundaries. Every approved decision, policy evaluation, and refusal is anchored in DSSE (Dead Simple Signing Envelope) signatures and written to WORM-compliant S3 Object Lock storage, producing four verifiable projections for machines, regulators, auditors, and affected persons.