Engineering · 8 min read · April 23, 2026
Atomic Decision Boundaries: Why Split Governance Fails at Runtime
Autonomous systems need decisions and state changes fused into one indivisible step; separation creates an architectural gap no policy can close.
Autonomous systems must couple policy decisions and state transitions atomically; split evaluation architectures cannot guarantee execution-time safety.
- — Atomic decision boundaries fuse evaluation and state transition into one LTS step.
- — Split systems separate decision from transition, allowing environment changes between them.
- — The architectural gap in split systems cannot be closed by any policy alone.
- — Existing systems (RBAC, ABAC, OPA, Cedar, AWS IAM) are split; only ACP is atomic.
- — Escalate outcomes transfer rather than eliminate the atomicity requirement.
- — Admissibility is an execution-time property, not an evaluation-time one.
- — Concurrent environments expose split systems to race conditions and state drift.
Frequently asked
- An atomic decision boundary is an architectural property where a permission decision and the resulting state transition occur as a single indivisible step in the system's execution model. This ensures that the system state at the moment the decision is made is the same state in which the action executes, eliminating race conditions and guaranteeing admissibility.