WARDEN: Workload Authority for Reasoning and Deployment Enforcement Network Architectural Patterns for Governing Untrusted LLM Systems

This paper introduces WARDEN (Workload Authority for Reasoning and Deployment Enforcement Network), a control-plane-first architectural pattern for governing Large Language Model (LLM) systems with tool access. WARDEN is motivated by a simple premise: LLMs should be treated as untrusted reasoning components. Rather than relying on model alignment, intent, or cooperation, WARDEN enforces containment, auditability, and human override through externally enforced authority. The architecture separates reasoning from authority, ensuring that: Reasoning components may propose actions, but never decide what executes All execution, tool use, and side effects are mediated by a trusted control plane The system fails closed when authority is unavailable Long-running or non-progressing execution can be terminated unconditionally The paper defines fifteen architectural claims (C1–C15) covering control/inference separation, non-bypassable ingress, authority-owned context, capability-scoped tool invocation, evidence-on-denial, and authority-enforced termination. A threat model and enforcement taxonomy are provided, along with implementation prompts that enable independent reproduction of the architectural patterns without reliance on proprietary code. WARDEN is intended as an architectural specification and practitioner guide for enterprises deploying internal LLM systems where governance, safety, and operational control are required. It does not propose a new model, framework, or alignment technique; instead, it formalizes enforceable system-level constraints that remain effective regardless of model behavior. This artifact is archived for permanent reference and citation.