Who Authorizes Software Behavior? Governing the AI-Native SDLC
© 2026 Bhash Ganti Independent Researcher — Camas, WA, USA Contact: bachipeachy@gmail.com ORCID Profile: https://orcid.org/0009-0007-3810-6520 Abstract As software projects become increasingly agent-mediated, implicit authorization fails: the lifecycle is gated repeatedly—merge, release, deployment—and those disjoint approvals are assumed to compose, a composition living in reviewers’ heads that requires producers to be few, known, and sharing tacit context. Agents break all three, and no single point determines what behavior a system is authorized to realize. Authorization must instead be an explicit, independently checkable property established during governed construction and carried in a sealed state that execution realizes but cannot amend. Three tests are reported: a reference implementation assembling seven governed domains under one governance surface; an independent realization built from a frozen specification, claiming only the surfaces it exercised; and mutation testing in which removing two required guards left demonstrations unaffected, while a discriminating mutation of declared routing failed as expected. These address realizability, specification sufficiency, and evidence adequacy, exposing a concrete limitation of conventional evidence. ...