Prompt Governance

Status: Founding RFC — Approved Merged from: CFPO evidence spec + CFPO implementation contract

1. Abstract

Standard prompt engineering relies on prose instructions and manual template authoring. In governed inference, this fails: context budgets are tight, authority signals get buried by attention decay, and post-generation scoring catches failures too late to prevent them. This spec defines CFPO (Content–Format–Policy–Output), a strict section-ordering convention for runtime prompt assembly that makes governance mechanically enforceable inside the prompt itself. The Prompt Compiler implements this contract, assembling governed prompt artifacts at request time from evidence retrieved via Kura and the Crosswalk.

2. Problem Statement

• Attention decay buries authority: In unstructured prompts, critical grounding constraints placed early are weakened by mid-context degradation. The model “forgets” the rules by the time it generates.
• Static templates cannot govern: Hand-authored prompts cannot adapt to the evidence available for each request. Zone placement must be dynamic, driven by chunk metadata from the ingestion pipeline.
• Circular governance: Using the model to evaluate its own prompt structure introduces the same circular dependency the bounded-synthesis pipeline is designed to eliminate.
• Post-generation is too late: If the prompt allows the model to improvise, no amount of Claim Ledger evaluation can recover a fundamentally ungoverned generation.

Platform system	Layer	What this spec governs
Prompt Compiler	L0	Prompt compilation contract, rewrite passes, output constraints
Kura	Evidence store	How retrieved evidence chunks are shaped for prompt zones
Crosswalk	Retrieval + access control	Authority-zone routing and boundary metadata consumed by the compiler
Claim Ledger	L1–L4	Post-generation claim verification expectations the prompt must satisfy

3. The Target Architecture: CFPO

CFPO is the runtime prompt assembly contract:

1. Content — identity, mission, domain framing
2. Format — schemas, reference structures, taxonomies
3. Policy — behavioral constraints and compliance requirements
4. Output — response schema and exact emission format

3.1 Why This Order

• Primacy effect makes early framing sticky (Content first).
• Recency effect improves output-shape compliance (Output last).
• Mid-context weakness is real; place lookup/reference content in Format with mitigation.

3.2 Evidence Confidence

• Content primacy: moderate confidence
• Output recency: moderate confidence, model-family dependent
• Mid-context degradation: well-established
• Composite CFPO gain as a whole: theoretical but operationally validated in Kenshiki workflows

4. Runtime Assembly (Not Static Templates)

The Prompt Compiler does not serve static prompts. It assembles a governed prompt contract at request time from three inputs:

1. The question — what the caller asked
2. Governed evidence — chunks retrieved from Kura via the Crosswalk, scoped by the caller’s access boundary (OpenFGA/ReBAC)
3. The template skeleton — authored Markdown fragments that define the CFPO zones, versioned in a typed registry with model, temperature, and change summary

At runtime, the Compiler reads the question, receives the evidence set from the Crosswalk, maps each chunk into the correct CFPO zone based on its metadata, and assembles the final prompt contract. The model never sees the raw question or the raw evidence — it sees the compiled, zone-ordered, authority-scoped prompt.

4.1 Dependency on Ingestion

The Compiler’s zone-mapping decisions depend on metadata that the ingestion pipeline stamps onto every chunk in Kura:

• Clause IDs — extracted during ingestion, used to identify regulatory mandates that belong in the Policy zone
• Normative language markers — SHALL/MUST/REQUIRED flags from ingestion enrichment, used to separate mandatory constraints from advisory narrative
• SIRE tags — Subject/Included/Relevant/Excluded metadata from the Crosswalk, used to enforce authority boundaries and exclusion gates before chunks enter the prompt
• Source tier — primary/secondary/cross-domain/unverified classification from Kura, used to weight evidence authority in zone placement

If the ingestion pipeline does not stamp this metadata, the Compiler cannot make informed zone decisions. The prompt contract is only as governed as the evidence that feeds it.

4.2 Required Sections in the Template Skeleton

1. Voice (optional) — persona and domain framing
2. Mission (required) — what the system is being asked to do
3. Rules (required) — constraints and authority boundaries
4. Enforcement (required) — paired examples of violations and valid behavior
5. Output (required) — response schema and exact emission format

4.3 Enforcement Format

• Default to positive-first guidance.
• Use paired violation/valid examples only for non-obvious failure modes.
• If model output starts imitating violations, switch rule to valid-only immediately.

5. Compiler Rewrite Passes (Aligned with L0)

At assembly time, the Compiler executes five rewrite passes over the combined template + evidence:

1. Context placement optimization — positions chunks by CFPO zone and attention profile so evidence is visible where it matters. Uses chunk metadata from ingestion to determine zone assignment.
2. Instruction reinforcement — duplicates critical grounding constraints near the generation boundary (late Policy zone) to exploit the recency effect.
3. Authority zone isolation — separates evidence, instructions, and user input with validated delimiters so the model cannot confuse source material with instructions.
4. Mechanism competition handling — detects likely conflicts between the model’s parametric knowledge and the retrieved evidence, and strengthens retrieval authority signals to override priors.
5. Format-pressure resolution — resolves cases where the output schema requires fields that lack supporting evidence, enforcing grounding constraints over format completion pressure.

6. Chunk-to-Zone Mapping Rules

When Kura evidence chunks are inserted into the prompt contract, their zone assignment is determined by the metadata stamped during ingestion:

• Normative mandates (SHALL/MUST, clause IDs, regulatory citations) → Policy zone
• Structural definitions, schemas, taxonomies → Format zone
• Advisory narrative, domain context, background → Content zone
• Response templates, output schemas → Output zone

Authority constraints must never appear only in early prompt positions. The Compiler re-states them in the late Policy zone to ensure they survive mid-context degradation.

7. Algorithm: CFPO Prompt Compilation

Input: Query $q$, evidence set $C'$ (from SIRE-governed retrieval), governance profile, template skeleton $T$ (versioned CFPO zones). Output: Compiled prompt $P$ with evidence placed in CFPO zones.

Steps:

1. Zone classification. For each chunk $c$ in $C'$, classify into a CFPO zone based on ingestion metadata:

   • Normative mandates (SHALL/MUST, clause IDs, regulatory citations) $\to$ Policy zone
   • Structural definitions, schemas, taxonomies $\to$ Format zone
   • Advisory narrative, domain context, background $\to$ Content zone
   • Response templates, output schemas $\to$ Output zone
   • Chunks without normative markers or SIRE tags default to Content zone with reduced authority weight.

2. Template assembly. Load template skeleton $T$. Inject classified chunks into their respective zones in CFPO order: Content first, then Format, then Policy, then Output.

3. Context placement optimization. Position evidence chunks by CFPO zone and attention profile so high-authority evidence is visible where attention mechanisms will weight it. Exploits primacy effect (Content first) and recency effect (Output last).

4. Instruction reinforcement. Duplicate critical grounding constraints near the generation boundary (late Policy zone) to exploit the recency effect and mitigate mid-context degradation.

5. Authority zone isolation. Separate evidence, instructions, and user input with validated delimiters so the model cannot confuse source material with instructions.

6. Mechanism competition handling. Detect likely conflicts between the model’s parametric knowledge and the retrieved evidence. Strengthen retrieval authority signals to override priors.

7. Format-pressure resolution. Resolve cases where the output schema requires fields that lack supporting evidence, enforcing grounding constraints over format completion pressure.

Determinism guarantee: Given identical $(q, C', \text{governance profile}, T)$, the Compiler always produces identical $P$. Zone classification is a deterministic function of chunk metadata. Template assembly is a deterministic string operation. All five rewrite passes are deterministic transformations.

Audit guarantee: The compiled prompt $P$ is logged with the query, evidence set identifiers, template version, and zone assignments. The Claim Ledger can reconstruct which evidence was placed in which zone for any historical request.

8. Invariants

1. CFPO order is mandatory for every compiled prompt contract. No exception.
2. Output schema is always the closest block to the generation boundary (recency position).
3. Grounding and authority constraints must be re-stated in the late Policy zone to survive mid-context degradation.
4. The compiled prompt must preserve source attribution context from Kura and the Crosswalk so the Claim Ledger can trace claims back to specific evidence chunks.
5. Prompt artifacts are versioned. Changes are additive and auditable. The template skeleton carries model ID, temperature, and change summary.
6. The Compiler’s zone-mapping decisions depend on ingestion metadata. Chunks without normative markers or SIRE tags default to Content zone with reduced authority weight.
7. Given identical (query, evidence set, governance profile, template version), the Compiler always produces identical output. The compilation is deterministic.
8. The model never sees the raw query or raw evidence. It sees only the compiled, zone-ordered, authority-scoped prompt.
9. Zone classification is a function of chunk metadata stamped during ingestion, not of the model’s behavior or the query content.
10. The Compiler does not evaluate or modify evidence content. It positions evidence structurally. Content integrity is the responsibility of the ingestion pipeline and SIRE tags.