0. Registry Classification

1. Purpose

1.1 What This Arc Repairs

Signed Decision Provenance repairs governance and system-change environments where decisions alter policy, constraints, access, ranking, enforcement, safety behavior, model behavior, resource allocation, or institutional posture without a durable record of who decided, why, under what assumptions, with what tradeoffs, and under what rollback criteria.

It applies when decisions become operationally real but remain weakly attributable, weakly justified, weakly reversible, or difficult to audit later.

This arc repairs decision opacity by:

• assigning a durable decision ID;
• naming the responsible actor, role, body, system, or authority path;
• recording rationale and context;
• recording tradeoffs, expected effects, and known risks;
• recording affected scope and affected nodes;
• defining rollback, suspension, or revision criteria;
• setting a review date or review trigger;
• preserving decision lineage across personnel, policy, model, vendor, or interface changes;
• making silent bias injection and hidden policy drift harder to hide.

Signed Decision Provenance is the canonical arc for making specific governance decisions traceable across time.

1.2 Core Restoration Function

This arc restores decision integrity by binding governance change to a signed record of ownership, rationale, tradeoffs, rollback criteria, and review timing.

Signed Decision Provenance prevents decisions from becoming ownerless facts.

2. Use Conditions

2.1 When to Apply

Use this arc when:

• a governance decision changes system behavior;
• a policy or enforcement rule changes;
• an AI model, evaluator, classifier, memory rule, tool rule, or guardrail changes;
• a platform changes ranking, visibility, access, appeal, moderation, or enforcement behavior;
• a security exception, override, suppression, escalation, or emergency measure is approved;
• a decision carries hidden bias, legitimacy, boundary, or recurrence risk;
• authority exists, but the specific decision record is weak;
• future auditors need to reconstruct why a change occurred;
• rollback must be possible if the decision creates harm;
• tradeoffs were made but not recorded;
• a decision may affect future cases, users, models, policies, or governance legitimacy.

Examples:

• a classifier threshold is changed without recording who approved it or what harm tradeoff was accepted;
• a platform policy is revised but no rationale or rollback condition is attached;
• a security exception is approved through chat and later becomes normal practice;
• a model behavior change is deployed without policy lineage;
• a governance committee decision is implemented without signed ownership;
• a public rule changes while internal interpretation shifts silently.

2.2 When Not to Apply

Do not apply this arc when:

• no meaningful decision or governance change occurred;
• the authority registry itself is unclear and RA-050 must occur first;
• active harm requires emergency stabilization before documentation;
• decision provenance is being used to delay urgent repair;
• disclosure would violate privacy, safety, security, or affected-node boundaries;
• the required repair is tamper-evident audit protection rather than initial provenance;
• the system refuses to name an accountable decision owner;
• the decision cannot be reconstructed with enough integrity to sign.

Signed Decision Provenance must not become paper-trail theater.

2.3 Required Preconditions

Before this arc begins, the following must be true:

If required preconditions fail:

Arc cannot validly begin.

The system must route to Authority Registry Clarification, Audit Surface Expansion, Responsibility Gradient Mapping, Tamper-Evident Audit Restoration, or Governance-Level Restoration.

3. Failure / Damage Signature

3.1 Pre-State Across S

3.2 Primary Failure Links

3.3 Origin-Layer Localization

Canon rule:

A governance change is incomplete when future actors cannot determine who decided, why, under what authority, with what tradeoffs, and when the decision must be reviewed or reversed.

4. Restoration Objective

4.1 Canonical Objective

Restore decision provenance by creating a signed, reviewable record that binds decision ID, owner, rationale, tradeoffs, rollback criteria, and review date.

Formal objective:

decision_traceability ↑
decision_owner_clarity ↑
rationale_integrity ↑
tradeoff_visibility ↑
policy_lineage_integrity ↑
rollback_readiness ↑
review_date_integrity ↑
bias_injection_risk ↓
H ↓
Au ↑
Φ/O divergence ↓

Expanded objective:

Convert hidden or weakly-owned governance change into a traceable, accountable, reviewable, and reversible decision record.

4.2 Non-Goals

This arc does not aim to:

• create documentation without accountability;
• sign decisions after the fact to launder unclear authority;
• hide tradeoffs under generic rationale language;
• use provenance to justify invalid decisions;
• expose sensitive data, security controls, or affected-node records unnecessarily;
• make every trivial choice bureaucratic;
• replace structural correction with recordkeeping;
• treat approval as legitimacy proof;
• make rollback optional where harms are foreseeable;
• preserve a decision record without review timing.

5. Operator Sequence

5.1 Minimal Operator Scaffold

Au decision ID / owner trace → Π affected-scope and disclosure boundary → Σ provenance / rollback invariant → FI review and impact feedback → Θ silent-drift damping → ℛ signed record / rollback / review routing → Λ decision-fit test → Τ review-date proof

Reference sequence from the registry:

create decision ID
→ name responsible actor(s)
→ record rationale
→ record tradeoffs
→ define rollback criteria
→ set review date

Universal grammar alignment:

Au + Π → Σ → FI → Θ → ℛ → Λ → Τ

Signed Decision Provenance may route into Authority Registry Clarification, Tamper-Evident Audit Restoration, Governance-Level Restoration, Constraint Recalibration Under Φ Growth, GEI Audit Restoration, or AI Classifier / Evaluator Restoration.

5.2 Operator Step Table

5.3 Sequence Notes

This arc is provenance-gated, rollback-gated, and review-date-gated.

The sequence must distinguish:

decision
authority
owner
rationale
assumption
tradeoff
affected scope
rollback criterion
review date
successor lineage

The following steps cannot be skipped:

decision ID
responsible actor or authority path
rationale record
tradeoff record
affected scope
rollback criteria
review date
lineage preservation

If a decision has a rationale but no owner, the arc is incomplete.

If it has an owner but no rollback criteria, the arc is incomplete.

If it has a rollback path but no review date, hidden drift can return.

6. Restoration Phases

Phase 0 — Identify Decision Object

Purpose: Name the decision requiring provenance.

Actions:

• identify policy, rule, constraint, override, deployment, access change, enforcement change, ranking shift, resource allocation, or governance decision;
• identify whether the decision is new, changed, inherited, emergency, experimental, or corrective;
• identify affected nodes and systems;
• identify decision class and risk level.

Validation:

decision object named
decision class visible
affected scope mappable

Phase 1 — Create Decision ID

Purpose: Make the decision individually traceable.

Actions:

• assign durable decision ID;
• timestamp decision;
• link decision to authority registry where available;
• link decision to prior decision lineage;
• distinguish decision from implementation ticket or public announcement;
• mark decision status: proposed, active, suspended, rolled back, superseded, expired, or under review.

Validation:

decision_traceability ↑
policy_lineage_integrity ↑
future reconstruction possible

Phase 2 — Name Responsible Actor(s)

Purpose: Attach ownership.

Actions:

• name responsible actor, role, body, or authority path;
• identify approver and implementer separately where needed;
• identify advisory influence where it materially shaped the decision;
• identify review owner;
• identify rollback owner;
• identify successor owner if role changes.

Validation:

decision_owner_clarity ↑
responsibility_attachment ↑
orphaned decision risk ↓

Phase 3 — Record Rationale

Purpose: Preserve why the decision was made.

Actions:

• record problem statement;
• record evidence basis;
• record assumptions;
• record expected benefit;
• record uncertainty;
• record constraints;
• record alternatives considered;
• record why this path was selected.

Validation:

rationale_integrity ↑
Au ↑
rationale erasure risk ↓

Phase 4 — Record Tradeoffs

Purpose: Prevent hidden bias or cost transfer.

Actions:

• record expected harms and burdens;
• record affected-node risks;
• record false-positive / false-negative tradeoffs where applicable;
• record privacy, security, access, fairness, usability, and legitimacy tradeoffs;
• record who bears the cost;
• record how costs will be monitored;
• record mitigation commitments.

Validation:

tradeoff_visibility ↑
bias_injection_risk ↓
H ↓

Phase 5 — Define Rollback Criteria

Purpose: Make the decision reversible or correctable.

Actions:

• define rollback trigger;
• define suspension trigger;
• define revision trigger;
• define appeal or exception trigger;
• define unacceptable harm thresholds;
• define monitoring data required;
• define who can roll back;
• define how rollback will be communicated.

Validation:

rollback_readiness ↑
K ↑
decision not self-sealing

Phase 6 — Set Review Date

Purpose: Prevent decision drift and institutional forgetting.

Actions:

• set review date;
• define review cadence if ongoing;
• define review owner;
• define required evidence at review;
• define affected-node or field-signal input;
• define expiry if no review occurs;
• define successor handoff.

Validation:

review_date_integrity ↑
future_auditability ↑
institutional forgetting risk ↓

Phase 7 — Validate Decision Fit Over Time

Purpose: Confirm the decision remains legitimate, coherent, and reversible.

Actions:

• monitor impact;
• monitor recurrence;
• monitor affected-node signal;
• monitor hidden costs;
• monitor whether rationale remains valid;
• monitor whether tradeoffs changed;
• monitor whether rollback criteria were triggered;
• update, suspend, supersede, or roll back the decision when required.

Validation:

decision_fit stable or ↑
H(t+n) ≤ H(t)
Φ/O divergence ↓

7. Gates

7.1 Required Gates

7.2 Gate Failure Rule

If any required gate fails:

∅ — Signed Decision Provenance cannot validly proceed in that form.

The system must either:

• clarify authority;
• identify responsible actor;
• restore rationale record;
• record tradeoffs;
• define rollback criteria;
• set review date;
• protect disclosure boundaries;
• route to tamper-evident audit restoration;
• suspend reliance on the decision until provenance is sufficient.

8. Diagnostics

8.1 Required Diagnostic Trends

8.2 Arc-Specific Diagnostic Thresholds

Suggested thresholds:

decision_traceability ↑
decision_owner_clarity ↑
rationale_integrity ↑
tradeoff_visibility ↑
policy_lineage_integrity ↑
rollback_readiness ↑
review_date_integrity ↑
bias_injection_risk ↓
H ↓
Au ↑
Φ/O divergence ↓

Signed Decision Provenance is not complete if:

decision ID is absent
responsible actor is unnamed
rationale is generic or unreconstructible
tradeoffs are hidden
affected scope is unclear
rollback criteria are missing
review date is absent
decision owner differs from actual authority path
decision record cannot survive future audit

9. Anti-Patterns / False Restorations

9.1 Common False Versions

This arc is being simulated, not executed, if:

• a decision is recorded but not owned;
• the owner is named but authority is unclear;
• rationale is vague;
• tradeoffs are omitted;
• affected scope is minimized;
• rollback criteria are absent;
• review date is missing;
• decision provenance exists only in informal messages;
• implementation tickets replace governance records;
• approval is treated as legitimacy proof;
• policy lineage is overwritten by the latest version;
• high-status decisions are exempt from signing.

9.2 Named Anti-Pattern Links

10. Completion Criteria

10.1 Post-State Signature

10.2 Temporal Proof

Signed Decision Provenance cannot be certified by record creation alone. It requires review and rollback readiness over time.

Template:

Completion requires decision_traceability ↑,
decision_owner_clarity ↑,
rationale_integrity ↑,
tradeoff_visibility ↑,
rollback_readiness ↑,
review_date_integrity ↑,
policy_lineage_integrity ↑,
bias_injection_risk ↓,
and decision review occurring when scheduled or triggered.

Minimum temporal proof:

• future actors can reconstruct the decision;
• owner, authority, rationale, and tradeoffs remain visible;
• rollback criteria are usable;
• review date is honored;
• impact evidence can update or reverse the decision;
• hidden bias or policy drift becomes harder to introduce silently;
• successor governance inherits the decision lineage.

10.3 Completion Statement

Canonical format:

This arc is complete only when the decision has a durable ID, accountable owner, reconstructible rationale, visible tradeoffs, defined rollback criteria, review date, protected disclosure boundaries, and successor-readable lineage that remains auditable over time.

11. Cross-Links

11.1 Related Restoration Arcs

11.2 Related Failure Modes

11.3 Related Diagnostics

Au, H, O, R, BΣ, K, FI, decision_traceability, rationale_integrity, tradeoff_visibility, rollback_readiness, review_date_integrity, bias_injection_risk, policy_lineage_integrity, decision_owner_clarity, Φ/O divergence

11.4 Related Laws / Invariants

INV — A governance decision must remain reconstructible.
INV — Authority without decision provenance creates hidden debt.
INV — Tradeoffs must be visible where burdens are imposed.
INV — Decisions that cannot be reviewed can become structure by default.
LAW — Hidden policy change compounds legitimacy decay.
LAW — Silent bias injection thrives in provenance gaps.
LAW — Rollbackless decisions become governance lock-in.
LAW — Φ deployment success is not O restoration.

12. Domain Notes

12.1 AI / Cognitive Infrastructure

Check:

• model version decision;
• evaluator change;
• classifier threshold;
• guardrail policy;
• memory retention rule;
• tool-use permission;
• ranking or recommendation logic;
• refusal behavior;
• appeal policy;
• rollback criteria;
• review date.

AI decision provenance requires that model and policy behavior changes remain attributable, reviewable, and reversible across versions. Silent evaluator or classifier changes are high-risk because they can alter cognition, access, legitimacy, and meaning interpretation invisibly.

12.2 Platform Governance

Check:

• moderation policy decision;
• enforcement threshold;
• account restriction rule;
• appeal routing change;
• visibility or ranking change;
• user notification policy;
• data use change;
• reviewer guidance;
• rollback and review schedule.

Platform users are affected not only by written policy but by decisions that change how policy is interpreted and enforced.

12.3 Security

Check:

• security exception;
• privileged access approval;
• incident response decision;
• patch deferral;
• detection rule change;
• override;
• emergency measure;
• rollback criteria;
• compensating control;
• review date.

Security decisions without provenance become future attack surfaces because no one can reconstruct why a risk was accepted, who accepted it, or when it must be revisited.

12.4 Justice / Governance / Legitimacy

Check:

• decision owner;
• authority basis;
• affected party;
• rationale;
• burden distribution;
• review path;
• appeal path;
• rollback or correction path;
• public explanation when legitimacy requires it.

Legitimacy depends on whether consequential decisions can be traced and challenged, not merely whether they were procedurally approved.

12.5 Economy

Check:

• pricing decision;
• debt decision;
• access decision;
• labor policy decision;
• contract interpretation;
• settlement term;
• burden allocation;
• cost externalization;
• review or rollback.

Economic decisions create hidden debt when they move burdens, restrict exits, or change terms without visible provenance.

12.6 CMS / Meaning / Archetypes

Check:

• interpretive decision;
• symbolic authority decision;
• inclusion / exclusion decision;
• taboo enforcement;
• role recognition;
• narrative change;
• collective memory revision;
• review date.

Meaning systems require provenance when interpretive authority changes what can be recognized, named, remembered, or restored.

13. Machine-Readable Metadata

id: "RA-051"
title: "Signed Decision Provenance"
aliases:
  - "Decision Provenance"
family_primary: "Governance / Auditability / Decision Integrity"
families_secondary:
  - "Core"
  - "AI Governance"
  - "Justice / Governance / Legitimacy"
  - "Auditability"
  - "Institutional Design"
  - "Security"
  - "Platform Governance"
  - "Boundary"
  - "Coherence"
  - "Scaling"
  - "Authority"
treatment: "Canon Parent Arc"
status: "Canon-Ready"
scope:
  - "Institutional"
  - "AI"
  - "Security"
  - "Platform"
  - "Economic"
  - "Governance"
  - "Civilizational"
  - "Cross-Domain"
u_layers:
  failure_origin:
    - "often U3 authority / decision process"
    - "often U4 policy / rule expression"
    - "often U5 provenance / memory / review layer"
  symptom_visible:
    - "U4 policy change / enforcement behavior / model behavior / access change / ranking shift / override"
  repair_required:
    - "same or lower than layer where decision ownership, rationale, or rollback path disappeared"
  validation:
    - "U6"
    - "U7"
operators:
  scaffold: "Au decision ID / owner trace → Π affected-scope and disclosure boundary → Σ provenance / rollback invariant → FI review and impact feedback → Θ silent-drift damping → ℛ signed record / rollback / review routing → Λ decision-fit test → Τ review-date proof"
  sequence:
    - "Au"
    - "Π"
    - "Σ"
    - "FI"
    - "Θ"
    - "ℛ"
    - "Λ"
    - "Τ"
state_variables:
  primary:
    - "Au"
    - "H"
    - "O"
    - "R"
    - "BΣ"
  secondary:
    - "K"
    - "FI"
    - "µᵢ"
    - "Φ"
diagnostics:
  - "decision_traceability"
  - "rationale_integrity"
  - "tradeoff_visibility"
  - "rollback_readiness"
  - "review_date_integrity"
  - "bias_injection_risk"
  - "policy_lineage_integrity"
  - "decision_owner_clarity"
  - "Φ/O divergence"
gates_required:
  - "FI-Gate"
  - "HR-Gate"
  - "MS-Gate"
  - "Au-Actuation"
  - "BΣ-Gate"
  - "Λ-Gate"
  - "☷ᵢ"
linked_failure_modes:
  - "Silent Bias Injection"
  - "Hidden Policy Change"
  - "Unowned Decision Path"
  - "Decision Provenance Failure"
  - "Policy Lineage Collapse"
  - "Rollback Failure"
  - "Governance Drift"
  - "Rationale Erasure"
  - "Tradeoff Suppression"
  - "Shadow Governance"
  - "Accountability Evasion"
  - "Institutional Forgetting"
linked_restoration_arcs:
  - "RA-004"
  - "RA-012"
  - "RA-040"
  - "RA-043"
  - "RA-046"
  - "RA-049"
  - "RA-050"
  - "RA-052"
  - "RA-053"
  - "RA-055"
  - "RA-056"
  - "RA-058"
  - "RA-060"
anti_patterns:
  - "Signature Without Responsibility"
  - "Rationale Fog"
  - "Tradeoff Suppression"
  - "Rollbackless Decision"
  - "Review-Date Omission"
  - "Ticket-as-Governance"
  - "Approval Laundering"
  - "Policy Lineage Erasure"
  - "High-Status Unsigned Decision"
completion_tests:
  - "decision_traceability increases"
  - "decision_owner_clarity increases"
  - "rationale_integrity increases"
  - "tradeoff_visibility increases"
  - "policy_lineage_integrity increases"
  - "rollback_readiness increases"
  - "review_date_integrity increases"
  - "bias_injection_risk decreases"
  - "hidden debt decreases"
  - "auditability increases"
  - "Φ/O divergence decreases"
summary: "Signed Decision Provenance repairs silent bias injection and hidden policy changes by assigning decision IDs, naming responsible actors, recording rationale and tradeoffs, defining rollback criteria, and setting review dates so governance changes remain traceable and reversible."

Final Calibration Rule

Signed Decision Provenance answers six questions:

What decision changed the system?
Who or what authority owns the decision?
Why was the decision made, and what assumptions supported it?
What tradeoffs, risks, burdens, and affected scopes were accepted?
What rollback, suspension, revision, appeal, or exception criteria apply?
When must the decision be reviewed so hidden policy change, silent bias injection, and decision drift do not become permanent structure?