🤖 AI Summary
This work addresses subtle inconsistencies that may arise between declared identity policies and their actual enforcement in systems. It proposes a three-valued auditing framework that formally models declared partitions and mechanism-induced operational partitions, enabling bounded verification over a refinement lattice. By introducing decidable divergence witness pairs, local sibling-base comparisons, and global alternative conditions—combined with set partitioning and typed identity modeling—the approach enables rigorous consistency checking. The method uncovers over-partitioning issues caused by mechanisms such as version fields and demonstrates that historical extensions can invalidate previously passed audit outcomes, thereby ensuring more reliable enforcement of identity policies.
📝 Abstract
A record system declares when two records refer to the same entity, occurrence, scope, or rule. Its disclosed implementation mechanisms induce a corresponding operational identity relation. The declared and implemented relations may diverge systematically without producing a provenance gap or detectable contradiction. A system can apply, consistently and with every record individually correct, a rule of sameness that no artifact declares. This paper formalizes that implemented relation. A declared identity regime partitions a finite record domain into co-reference classes; a disclosed mechanism, through its typed identity-relevant outcomes, induces an operational identity partition of the same domain. The audit compares these partitions in the refinement lattice. A mechanism is faithful when the declared partition refines the operational partition, so no declared class is split. A divergence witness is a pair the declaration merges and the mechanism separates; such witnesses are decidable by pair enumeration. When an imported sibling basis also splits a declared class, local comparison with its partition yields sibling-aligned, sub-sibling, super-sibling, or sibling-incomparable divergence. This result reports only the relationship; it does not identify the basis carried by the mechanism. Global equality of the operational and sibling partitions is defined separately as regime substitution and does not follow from sibling alignment. A version field incremented on every textual edit inhabits the sub-sibling case by splitting declared classes more finely than either imported basis. The audit is three-valued and relative to the disclosed artifacts, evaluated surfaces, and identified uses; each boundary has a finite refuting witness. A passing verdict is non-monotone because extending the transformation history can merge declared classes and create a witness among records already examined.