Final Authority in AI Governance

The Final Authority paper is now available on arXiv as Final Authority in AI Governance: Frontier-Provider Sovereignty and Action-Centered Deployer Governance.

Final authority asks a simple question: when an AI system acts inside an enterprise, who should hold the final governance decision?

The paper contrasts provider-centered sovereignty with action-centered deployer governance, arguing that real accountability lives closest to the environment, policy, and consequence of use.

OSuite position

OSuite does not remove model-provider safety. It adds the missing deployer-side authority layer that enterprises need to govern their own agents in their own operating context.

Why it matters

The provider can define model-side limits, capability reporting, and safety posture. The deployer still owns the production system, data boundary, release path, customer relationship, regulatory context, and business consequence. Final authority should therefore be explicit instead of inherited from whichever vendor, wrapper, or runtime happens to sit closest to the model.

Citation

@misc{wang2026finalauthority,
  title={Final Authority in AI Governance: Frontier-Provider Sovereignty and Action-Centered Deployer Governance},
  author={Wang, Zexun},
  year={2026},
  eprint={2607.13040},
  archivePrefix={arXiv},
  url={https://arxiv.org/abs/2607.13040}
}