Policy decisions need extra steps for safe execution admission
Beyond Policy Engines: Binding-Complete Execution Admission
Cryptography and Security
Summary
Policy engines decide if actions are allowed based on rules, but saying yes doesn't guarantee that all sources were properly checked or that the context exactly matches. The authors show the gap between policy decisions and actual permission to run code, and they offer a new contract called BCEAC. This contract clarifies what is needed for safely admitting an action, like checking sources independently and binding decisions tightly to context. Their work provides a clear, testable framework rather than proving full security or correctness.
What this means in practice
- •For security architects: Design governance systems that verify not only policy decisions but also ensure correct contextual binding before execution admission.
- •For cloud infrastructure teams: Use BCEAC-based architectures to audit and verify policy decisions offline, improving confidence in permission checks before running workloads.
Authors
Lin Wang, Mengting Wu, Yong Zhang, Jiang Deng
Abstract
Policy engines determine whether evaluated policies permit a request, but a correct ALLOW decision does not establish complete governance-source participation, exact context binding, or sufficient grounds for execution admission. This paper examines the gap between policy evaluation and execution admission. We introduce the Binding-Complete Execution Admission Contract (BCEAC), a governance-relative contract for independently determined source obligations, exact policy and contextual binding, and typed admission outcomes under explicit trust assumptions. We propose a conditionally engine-agnostic architecture in which participating backends must satisfy declared semantic profiles, adapter contracts, and contextual correspondence obligations; an Execution Boundary Language (EBL) authoring syntax remains optional. The architecture separates governance resolution, policy evaluation, independent admission verification, and downstream execution mediation. We investigate two distinct experimental tracks: a finite Governance Source Completeness study and an OPA/Cedar experiment with archived native-engine records examined by offline review. The OPA/Cedar archive comprises 72 scenarios and 144 strict case-engine records (120 native-invoked and 24 pre-native), with eight additional permissive controls outside the strict denominator. The offline review did not rerun the original native OPA/Cedar executables. The results provide bounded evidence while retaining historical failures and unresolved implementation defects. The work does not establish constitutional adequacy, general semantic refinement, authenticated currentness, machine-checked execution-safety theorems, or protected external effects. Its contribution is an explicit, falsifiable framework for determining what must be established between a policy decision and an execution-admission judgment.