Observability Is Not Enforcement: A Doctrinal and Architectural Framework for Distinguishing Compliance Instrumentation from Runtime Authorization in AI Governance

The term “AI governance” is increasingly applied to heterogeneous systems ranging from logging dashboards and model alignment techniques to cryptographically signed audit trails and policy workflow engines. This conceptual broadening has obscured a critical architectural distinction: systems that document and monitor behavior are not equivalent to systems that enforce policy at the point of execution. This paper introduces a doctrinal and technical framework for distinguishing evidence-routing compliance systems from authorization governance substrates. Observability governs accounts of action—what happened and how it can be reconstructed. Authorization governs permission to act—whether a specific action was permitted under policy before execution. The paper formalizes this distinction along five architectural axes: enforcement locus, signature semantics, failure behavior, bypass resistance, and override governance. A six-criterion Enforcement Test Protocol is introduced to provide a binary classification of governance claims: authorization governance present or absent. The analysis demonstrates that systems may generate extensive documentation, cryptographic artifacts, and explainability bundles while still failing open when governance conditions fail. Documentation volume does not equal enforceability. Drawing on reference monitor theory and regulatory contexts including GDPR Article 22 and the EU AI Act, the paper argues that governance without non-bypassable, fail-closed runtime authorization remains advisory rather than determinative. Observability and authorization are complementary layers, but they provide different regulatory guarantees and address different threat models. The framework is intended for regulators, auditors, enterprise buyers, and researchers seeking operationally testable criteria for evaluating AI governance architectures in high-stakes and regulated environments. Zenodo canonical version: https://doi.org/10.5281/zenodo.18663864