Constraining the Commit Boundary: A DIO/ODI-Informed Authorization Guardrail for Agentic Entity Resolution

Abstract

Agentic Entity Resolution (ER) systems iteratively plan actions, retrieve evidence, revise hypotheses, and propose graph mutations. An erroneous identity hypothesis may condition later retrieval and produce apparent confirmation. This paper proposes a Digital Identity Optimization (DIO) and Ontology of Digital Identity (ODI)-informed authorization boundary between evidence available for reasoning and evidence eligible to authorize persistent identity-changing mutations. A domain-governed constraint-binding function maps selected reconstruction-failure distinctions to identity-preserving constraints. An abstract two-phase supervisor permits commitment only when claim-specific authorization-eligible evidence supports every required proposition, relevant conflicts are resolved, scope is valid, and bound state and policy versions remain current. Admission as UNVERIFIED does not confer authorization eligibility; separate claim-specific promotion is required, and insufficient support or unresolved material conflict defers the mutation. The guarantee is conditional on adequate domain policy, sound claim-specific evidence promotion, and faithful enforcement; the specification does not independently establish promotion correctness or semantic truth. The proposed contribution is a DIO/ODI-informed diagnostic-to-constraint organization integrated with an explicit authorization contract for claim-specific evidence promotion and mutation-specific proposition requirements. Scope binding, conflict handling, and commit-time version checks are treated as necessary contract elements, not as novel mechanisms in isolation. This is a conceptual architecture without implementation or empirical validation. It does not prevent erroneous hypotheses or hypothesis-conditioned retrieval; dependency-aware evidence flow remains future research.