Governed Autonomous Execution: Authority Separation and Semantic Invariance Across Execution Boundaries

Autonomous systems are governed in pieces, with different bodies of work constraining the actor, the proposed action, the API request, the runtime trace, the execution environment, or the effect, and each making a different object primary. We ask whether governed autonomous execution can instead be organized around a single question, what a system is permitted to do here, answered by an authority relation that does not require a model of the worker that produced the proposal or of the substrate on which it runs. The model that results separates the properties that must not be mistaken for authority from the differences in representation that may safely be discarded because they cannot change what is authorized, and it is deliberately small, built from a handful of primitives and organized by two pillars we call authority separation and semantic invariance. We give a machine-checked formal core, proved in Lean without dependence on any implementation, in which the formalization also exposes a design condition for implementations that group states by a pairwise relevance criterion and take its transitive closure, shown with a concrete counterexample, and we machine-check that Figueroa quantization, a transformation from the system the theory was reduced from, is a sound relevance criterion whose equal quantizations preserve the full routing result over the policy's authored action domain, instantiating the model's admissibility and non-expansion results. We then run an external search for counterexamples and report graded evidence that ranges from direct instantiations in independently built systems down through structural analogues to failures we can only interpret through the theory. Generality, throughout, means the theory requires no model of the worker or the substrate, not that it is proven complete over all autonomous systems.