Intent-Driven Policy Spec

• The paper proposes a model where effectful actions are mediated by generating finite intents and evaluated by decidable policies to ensure auditability.
• It separates computation from I/O by requiring that all effectful interactions pass through a governance layer that records decisions on a tamper-evident ledger.
• The approach guarantees mediation soundness, ledger completeness, non-bypass, and termination of policy evaluations, thus reinforcing structural audit completeness.

Searching arXiv for the focal paper and a small set of closely related policy-governance works to ground citations. Intent-driven computing is a programming model for governed autonomous systems in which programs do not directly execute effects. Instead, programs produce intents—finite, structured data values describing proposed actions—and a governed runtime mediates every effect by evaluating each intent against a decidable policy language, recording the decision in a tamper-evident ledger, and realizing the effect only if the decision permits it. The model is presented as a response to a structural problem in conventional programming-language assumptions: when autonomous systems generate behavior dynamically, there is otherwise no structural mediation point between deciding to act and acting. Rather than attempting to decide arbitrary behavioral properties of Turing-complete programs, which Rice’s theorem rules out in general, intent-driven computing constrains the language so that all effectful interaction is reified as finite intent data, shifting governance from undecidable program semantics to decidable intent evaluation (McCann, 21 May 2026).

1. Architectural model and execution flow

The architecture separates program intent from effect realization. The program layer is Turing-complete but pure with respect to I/O: it performs arbitrary computation and produces intents, yet has no direct access to effects. The governance layer contains a governance interpreter, denoted $G$, and a policy language consisting of finite, decidable predicates over intent data and runtime context. The execution layer realizes an effect only after governance has examined the intent and appended a corresponding decision record to an append-only, tamper-evident ledger (McCann, 21 May 2026).

At the level of execution flow, the model is: program produces an intent; governance checks it; the runtime records the decision; and only then, if allowed, performs the effect. Decisions are drawn from $\texttt{allow}$, $\texttt{deny}$, and $\texttt{escalate}$. There are no alternative I/O paths outside this mediation path. The absence of ambient I/O is therefore not an incidental implementation detail but a constitutive property of the model: even library calls cannot leak effects outside governance mediation, and effect realization occurs only through the governance gateway (McCann, 21 May 2026).

This organization places intent-driven computing within a broader class of policy-mediated architectures, but with a stricter coupling between policy evaluation and effect execution than is typical in conventional policy engines. A plausible implication is that the key novelty lies not merely in evaluating policies before actions, but in making the production of intent values the only way a program can interact effectfully with the world.

2. Formalization of intents, governance, and decidability

An intent is defined as a finite structured value

$$i = (\mathit{action}, \mathit{target}, \mathit{params}, \mathit{context}),$$

and an intent-driven program produces a sequence of intents $[i_1, i_2, \dots, i_n]$ while remaining unable to execute effects directly. Governance is formalized as

$G(P, i, c) = (d, r),$

where $P$ is a policy set of decidable predicates, $i$ is an intent, $c$ is finite serializable runtime context, $\texttt{allow}$0 is the decision, and $\texttt{allow}$1 is the decision record for the ledger (McCann, 21 May 2026).

For each intent $\texttt{allow}$2, the runtime computes $\texttt{allow}$3, records $\texttt{allow}$4 in the ledger, and then either executes, refuses, or awaits further authorization depending on whether the decision is allow, deny, or escalate. Ledger integrity is hash-chained: $\texttt{allow}$5 so tampering is immediately detectable (McCann, 21 May 2026).

The decisive theoretical move is the restriction of governance to finite intent data and finite policy sets. Because each policy rule is a total, decidable predicate over finite inputs, governance terminates: $\texttt{allow}$6 This is the formal basis for the paper’s contrast with conventional program-level governance. Asking whether an arbitrary program always uses only allowed resources is an undecidable semantic question, while asking whether a specific finite intent targets an allowed resource is a decidable data question (McCann, 21 May 2026).

This framing aligns with older work on policy-based specifications, where the tractable object of analysis is the policy structure and its semantics over finite requests rather than unrestricted program behavior. In that literature, properties such as completeness, redundancy, disjointness, and coverage are formalized over request evaluation, reinforcing the same general methodological preference for machine-checkable policy objects over unanalyzable behavioral wholes (Margheri et al., 2015).

3. Enforcement guarantees and governance invariants

The model’s central theorems are stated as enforcement guarantees. Mediation soundness states that every effect realization occurs if and only if governance allowed it and a corresponding ledger record was written. Ledger completeness states that every intent, regardless of decision, is recorded in the ledger. Non-bypass states that no program can realize effects except via the governance gateway. Policy decidability states that for any valid finite decidable policy, intent governance is total and terminating (McCann, 21 May 2026).

These properties establish what the paper calls structural audit completeness. The audit trail is not merely extensive; it is structurally complete because every effectful proposal and every governance decision must pass through the same reified mechanism. This differs from many audit systems in which logs are partial observables of a process that could, in principle, have acted elsewhere. Here, the ledger is complete by construction with respect to effectful proposals (McCann, 21 May 2026).

The paper also states governance invariance under composition: if an intent-driven program composes with others, all intents remain governed, and capabilities only narrow through composition. This is significant because composition is a standard site at which policy assumptions fail in layered systems. A plausible implication is that composition-preserving mediation is necessary if the model is to scale beyond isolated components.

In neighboring research areas, policy-aware intentional agents and cross-layer declarative policy compilers likewise emphasize non-bypass and exhaustive mediation, but they do so at different enforcement boundaries. APIA integrates authorization and obligation policies into intentional-agent planning by reducing reasoning to answer-set computation with Clingo (Meyer et al., 2021). The Semantic Router DSL enforces exhaustive routing, conflict-free branching, referential integrity, and structurally coupled audit traces across inference, orchestration, protocol, and infrastructure layers (Chen et al., 28 Mar 2026). Intent-driven computing is narrower in that it centers on effect mediation as a language-runtime property, but broader in the sense that it treats all effectful interaction as governed data rather than a collection of subsystem-specific gates (McCann, 21 May 2026).

4. Emergent properties of the model

The paper identifies several emergent properties. The first is event sourcing by construction: every effectful action proposal becomes an event, and the ledger functions as an event store in which all state transitions are captured and replayable. The second is governance simulation: because the ledger contains the complete stream of intents and decisions, historical executions can be replayed against new policies,

$\texttt{allow}$7

allowing “what if” analysis without re-running the original autonomous system (McCann, 21 May 2026).

The third is structural audit completeness, already noted as a theorem-level consequence. The fourth is improved human comprehensibility. Intents are semantic data objects—such as a structured request to send an email—rather than opaque machine instructions. Policies are written over intent fields and runtime context, rather than over full program behavior. This improves reviewability and transparency because both governed artifacts are legible at the level of action semantics (McCann, 21 May 2026).

These properties connect the model to several adjacent strands of work. Purpose-aware privacy policies, for example, seek declarative semantics and runtime monitoring over purpose-linked workflows rather than latent code behavior (Masellis et al., 2015). Machine-understandable GDPR compliance systems similarly reduce compliance checking to reasoning over explicit policy classes and processing descriptions rather than over arbitrary software behavior (Bonatti et al., 2020). This suggests a common pattern: governance becomes more tractable when the relevant unit is a structured, explicitly typed artifact—intent, request, workflow trace, or policy instance—whose semantics are bounded and replayable.

A further plausible implication is that the model’s contribution is as much epistemic as operational. By forcing effectful proposals into finite semantic records, it changes what can be known, simulated, audited, and explained about autonomous behavior.

5. Implementation, proof, and validation

The model is not presented only abstractly. It is implemented in a concrete language compiling to the BEAM virtual machine and formalized in Rocq. The machine-checked development contains 454 theorems across 36 modules with zero admitted lemmas. The paper identifies governance mediation, non-bypass, ledger completeness, policy decidability, and composition preservation among the verified elements (McCann, 21 May 2026).

The implementation is additionally validated by property-based testing over 70,000+ random inputs, with zero disagreements between the formal specification and the runtime implementation. The paper further states that bugs missed by conventional testing, including capability misclassification, were caught by the formal model and testing regime (McCann, 21 May 2026).

This verification profile matters because the model’s claims are fundamentally semantic and structural. Assertions such as “no alternative path to effects exists” or “every intent is recorded” are difficult to substantiate by examples alone; they require either proof or an enforcement substrate narrow enough to permit exhaustive reasoning. In that respect, intent-driven computing bears comparison with work that embeds policy into strongly typed or formally verified frameworks. “Policy as Code, Policy as Type” argues that access-control policies can be expressed as types in dependently typed languages such as Agda and Lean, using the type system and proof assistant to ensure that only well-typed, policy-compliant actions are constructible (Fuchs, 2 Jun 2025). Intent-driven computing is different in mechanism—it governs runtime intent data rather than making compliance a compile-time inhabitance property—but both approaches aim to relocate policy assurance from informal convention to machine-checked structure.

6. Position within policy-governed autonomous systems

Intent-driven computing addresses governed autonomy at the programming-model level. Other recent systems govern autonomous behavior at adjacent layers. G-SPEC constrains telecom agent planning with a Governance Triad consisting of a telecom-adapted agent, a Network Knowledge Graph, and SHACL constraints, achieving zero safety violations on a simulated 450-node 5G Core by deterministically validating LLM-generated plans before execution (Vijay et al., 23 Dec 2025). The Semantic Router DSL extends a non-Turing-complete routing language from per-request LLM routing to multi-step agent orchestration and infrastructure deployment, with cross-target compilation and cross-layer verification (Chen et al., 28 Mar 2026). Intent-based cryptographic API design similarly replaces direct algorithm specification with intent vocabularies, scope-based substitution, policy-driven governance, and key-evolution operations, so that cryptographic migration becomes an operational process rather than an application rewrite (Rameshan et al., 11 Jun 2026).

These systems all share the idea that governance improves when action proposals are mediated through explicit, machine-checkable intermediate forms. Intent-driven computing can therefore be read as a language-theoretic generalization of this tendency: instead of inserting guardrails around selected interfaces, it makes the proposal of an intent the only route to effects. This suggests a unifying research direction in which policy enforcement depends less on predicting arbitrary behavior and more on constraining system interfaces so that governance targets decidable artifacts.

The model also states what it does not do. It does not decide arbitrary behavioral properties of programs, and it does not refute Rice’s theorem. Its claim is narrower and more precise: if effectful interaction is constrained so that all effects are represented as finite intent values, then governance can move from undecidable program semantics to decidable evaluation of those values (McCann, 21 May 2026). That limitation is not incidental; it is the model’s central design principle.

7. Significance and open interpretive questions

The paper’s significance lies in its reformulation of governance as a property of the programming model rather than as an external control plane. Event sourcing, simulation, audit completeness, and human comprehensibility are presented not as optional add-ons but as emergent consequences of the mediation architecture (McCann, 21 May 2026). This is especially relevant for autonomous systems, where dynamically generated behavior weakens the practical force of traditional assumptions about where and how effects occur.

A recurring misconception in discussions of governed autonomy is that sufficiently strong policy analysis could determine, in general, whether an arbitrary autonomous program will remain within bounds. Intent-driven computing explicitly rejects that premise. Its answer is architectural rather than omniscient: govern what is decidable by constraining the form in which effectful action can be proposed (McCann, 21 May 2026).

Another interpretive question concerns the relation between runtime governance and specification expressiveness. Work on dynamic information-flow policies emphasizes that security semantics depend on facets such as replaying flows, direct release, and whitelisting, and that policy mechanisms must be judged by both what they allow and what invariants they can enforce (Broberg et al., 2015). A plausible implication is that the long-term evaluation of intent-driven computing will depend not only on its mediation guarantees, but also on the practical expressiveness, legibility, and maintainability of its policy language in domains with changing norms, obligations, and institutional constraints.

Within the terms established by the paper, however, the core result is clear: by making intents the sole structural path to effects, and by ensuring that those intents are finite, decidable, recorded, and non-bypassable, intent-driven computing proposes a formally specified foundation for governed autonomous systems in which enforcement, audit, and simulation become properties of system structure rather than after-the-fact approximations (McCann, 21 May 2026).