Backend
Beyond Policy Engines: Binding-Complete Execution Admission
arXiv cs.CR0 views
arXiv:2610.29701v1 Announce Type: new Abstract: Policy engines determine whether evaluated policies permit a request, but a correct ALLOW decision does not establish complete governance-source participation, exact context binding, or sufficient grounds for execution admission. This paper examines the gap between policy evaluation and execution admission. We introduce the Binding-Complete Execution Admission Contract (BCEAC), a governance-relative contract for independently determined source obligations, exact policy and contextual binding, and typed admission outcomes under explicit trust assumptions. We propose a conditionally engine-agnostic architecture in which participating backends must satisfy declared semantic profiles, adapter contracts, and contextual correspondence obligations; an Execution Boundary Language (EBL) authoring syntax remains optional. The architecture separates governance resolution, policy evaluation, independent admission verification, and downstream execution mediation. We investigate two distinct experimental tracks: a finite Governance Source Completeness study and an OPA/Cedar experiment with archived native-engine records examined by offline review. The OPA/Cedar archive comprises 72 scenarios and 144 strict case-engine records (120 native-invoked and 24 pre-native), with eight additional permissive controls outside the strict denominator. The offline review did not rerun the original native OPA/Cedar executables. The results provide bounded evidence while retaining historical failures and unresolved implementation defects. The work does not establish constitutional adequacy, general semantic refinement, authenticated currentness, machine-checked execution-safety theorems, or protected external effects. Its contribution is an explicit, falsifiable framework for determining what must be established between a policy decision and an execution-admission judgment.
Source:https://arxiv.org/abs/2610.29701PreviousVMSpec: A Decompiler-based Approach against Virtual Machine ObfuscationNextPrompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations
Related posts

The Roofline Model for LLM Inference
0dev.to Machine Learning
Deduplicate Your RAG Corpus Without Losing Its Citations
0dev.to Machine Learning

scm2cpp-learn: 44 scikit-learn estimators, same results, up to ~1000x faster
0dev.to Machine Learning
Marvell is buying Lumentum for $115B: what the optical bet means for AI cluster power, and what a fixed 4.5x exchange ratio really locks in
0dev.to Machine Learning
Terminal-Bench 2.0 vs 2.1 on Hugging Face: A 2.1 Score Is Ranked First on the 2.0 Board
0dev.to Machine Learning
How to read a failed CI log: find the first real cause in under a minute
0dev.to Tutorial