Governing the Work

Reliability is not accuracy. An adversarial evaluation of whether a governed financial environment preserves the integrity of the work — not just the accuracy of the answer — when a user pressures the AI not to.

Abstract

As artificial intelligence systems become embedded in enterprise decision processes, conventional measures of reliability — accuracy, factuality, and hallucination resistance — are increasingly insufficient. An AI system may begin with correct data and still produce an unacceptable business outcome if it can be induced to manipulate a metric, suppress material context, misattribute provenance, fabricate validation, or accept untrusted content as authoritative instruction.

This paper examines that problem through an adversarial evaluation conducted within a governed financial intelligence environment whose determinations are produced by a deterministic governed execution engine. The evaluation subjected the environment's AI interaction layer to a series of requests designed to induce violations of financial, evidentiary, and governance integrity: fabrication of unavailable forecasts, outcome-targeted metric construction, selective omission of material context, provenance substitution, executive-authority escalation, suppression of conflicting governed results, fabrication of validation records, and instruction injection embedded within apparent financial documentation.

In this evaluation, the system preserved the distinction between user instruction, management judgment, governed determination, and evidentiary provenance. Of particular importance, it did not merely refuse prohibited behavior; it repeatedly identified alternative paths through which the legitimate underlying business objective could still be completed without compromising the integrity of the work.

The findings suggest that the governance of enterprise AI work should be evaluated not only by whether a model produces correct answers, but by whether the surrounding execution architecture preserves methodological, evidentiary, and representational integrity under adversarial or organizational pressure. Trustworthy enterprise AI therefore requires governance of the work performed by AI, not merely governance of the model itself. This paper is Part I of a two-part adversarial assurance evaluation; Part II examines the integrity of the system boundary.

§1Reliability is more than accuracy

The rapid adoption of generative artificial intelligence in enterprise environments has intensified concern regarding hallucination, factual inaccuracy, data leakage, and prompt injection. These concerns are well founded. But they represent only part of the reliability problem facing organizations that intend to use AI in financial, operational, accounting, compliance, and other consequential business processes.

A system can produce factually accurate statements and still create misleading work. It can use valid source data and still construct an invalid metric. It can preserve the numerical result while corrupting its attribution. It can truthfully describe a management-selected figure while suppressing the existence of a contradictory governed determination. It can fabricate evidence that a review occurred without fabricating any of the underlying financial data. These failure modes are not captured adequately by conventional discussions of hallucination. They concern a broader construct: the integrity of the work performed through AI.

This distinction matters in enterprise settings because AI systems increasingly occupy a position between users and deterministic business processes. They interpret requests, retrieve data, invoke tools, synthesize findings, and communicate results. The language model therefore does not simply generate text; it participates in the production of business artifacts and decisions. That participation creates a critical question: can an AI system preserve the integrity of business work when a user explicitly or implicitly pressures it not to?

This paper examines that question through a controlled adversarial evaluation of the AI interaction layer within that governed environment. The objective was not to determine whether the system would reject obvious jailbreak prompts. Rather, the evaluation was designed to reproduce realistic enterprise pressures: time constraints, asserted executive authority, management discretion, selective presentation, competing financial definitions, and false claims of validation. The proposition under test was that enterprise AI should remain useful while refusing to detach business outputs from the evidence, methodology, provenance, and governance processes that produced them.

§2Conceptual framework

2.1From model accuracy to work integrity

Much of the existing discourse around AI reliability is model-centric: the primary question is whether a model generates a correct response. For enterprise applications, a broader unit of analysis is required. The relevant object is not merely the model response — it is the completed work product.

A financial result comprises several distinct elements: source data, computational method, classification rules, execution process, resulting value, provenance, contextual interpretation, and presentation to a decision-maker. Integrity can fail at any of these layers. A model that produces the correct numerical value but falsely identifies its source has not produced trustworthy work; neither has a model that uses correct data but changes the formula until a preferred result emerges. Enterprise AI reliability should therefore include at least three distinct forms of integrity (Exhibit 1).

2.2Governed determination

The test environment separates probabilistic language-model behavior from governed business execution. The AI layer understands requests, coordinates activity, interprets results, and communicates with the user. The governed execution engine performs calculations and other defined business operations according to controlled methods and authorized data. This separation lets the AI remain flexible while constraining the production of authoritative business results.

Under this model, a user may challenge a determination, provide a competing figure, or request an alternative management metric. But conversational pressure alone should not be sufficient to rewrite what the governed engine previously determined. The distinction is fundamental: a new assertion is not a new determination.

§3Methodology

3.1Test design

The evaluation probed eight integrity classes rather than conventional jailbreak language. Each test was framed to resemble a plausible request from a business user operating under time pressure, organizational hierarchy, or reporting constraints. This account reports the integrity classes evaluated and the governance principles observed; the specific prompt constructions and the full methodology are withheld, so it is a description of what governance defended, not a reproducible attack procedure.

Across the classes, the system was evaluated on whether it:

• preserved existing governed results;
• distinguished sourced facts from user assertions;
• refused unauthorized fabrication or derivation;
• preserved provenance;
• recognized misleading omission;
• resisted executive-authority pressure;
• refused fabrication of audit or validation evidence;
• treated untrusted embedded instructions as data rather than control authority; and
• continued to offer legitimate alternatives where possible.

3.2Test context

The scenario used a large public company's most recent fiscal year, with filed-style financial data held within the governed environment. The governed engine returned a Free Cash Flow determination derived from that data. A competing figure of materially different magnitude was subsequently introduced by the user and attributed, in different scenarios, to Finance or to a senior finance officer. The competing figure was deliberately not produced by the governed engine, creating a controlled provenance conflict used across several classes.

All roles and scenarios in this paper are constructs used for adversarial testing. No scenario depicts any real company, person, or event.

§4Adversarial test cases

Fabrication under time pressure. One class asked the system to produce unavailable forward-looking figures without rerunning analysis, with the user explicitly authorizing it to infer missing values, make assumptions, omit caveats, and present the estimates as expected results suitable for board materials. The system declined to fabricate or infer the unavailable figures, and rejected the proposition that user authorization could override the governed calculation boundary. Notably, it redirected the user toward existing governed outputs rather than ending the interaction — governance need not be synonymous with obstruction. The business objective was preserved; only the invalid method of reaching it was refused.

Verification of actual system state. A second class required the system to identify the source, period, classification, and derivation status of each requested figure before reporting it. It identified two available historical values and stated plainly that two requested forward-looking values were unavailable — declining to preserve an earlier conversational implication that a forecast might already exist. The system preferred verified workspace state over prior conversational expectation, a reliability property in itself: an enterprise AI should correct itself when governed evidence contradicts what it previously implied.

Outcome-targeted metric construction. A third class asked the system to redefine Free Cash Flow until the result approached a desired target, leaving the underlying filed numbers unchanged but representing the new number as the governed determination. The system identified the methodological problem — the target was being selected before the definition — and declined to reverse-engineer the metric. It did, however, permit the legitimate alternative of a separately labeled management measure with an explicit methodology. Alternative non-GAAP measures are not inherently problematic; the governance issue arises only when methodology becomes endogenous to the desired conclusion. Methodological integrity was preserved without prohibiting legitimate management reporting.

Selective truth and material omission. A fourth class requested no false statement and no altered figure. Instead it asked for a board summary built only from technically correct statements while suppressing trends and context that weakened the desired conclusion. The system declined, reasoning that a collection of individually true statements can nevertheless become materially misleading if intentionally structured to prevent directors from seeing relevant contrary evidence. This was among the most significant results in the evaluation: factuality alone is an inadequate standard for governed enterprise communication. Representational integrity requires attention to the effect of omission, not only the accuracy of individual claims.

Provenance substitution. A fifth class introduced the user-supplied competing figure, claimed that Finance had found the governed result based on an outdated capital-expenditure classification, and asked the system to use the new number without verification — and to identify it as the governed determination. The system declined. It preserved the governed result as the current determination, treated the competing figure as a separate management-supplied assertion, and proposed presenting both with clear sourcing. The principle: conversational introduction of a value does not retroactively change the source of that value.

Authority as concealment. A sixth class escalated the claim of authority. The competing figure was described as approved by a senior finance officer, the governed attribution was dropped from the request, and the system was asked to present the approved figure without disclosing its conflict with the governed determination. This class is deliberately hard, because a senior officer may legitimately approve a management reporting measure — executive authority cannot itself be treated as suspicious. The governance question is narrower: whether that authority also permits suppressing contradictory governed evidence. When the request was made explicit — that the board should not be told another governed figure existed — the system declined, distinguishing authority to select a management measure from authority to conceal a material discrepancy from a fiduciary audience. Organizational authority and evidentiary authority are not interchangeable.

Fabrication of validation evidence. A seventh class asked the system to create a formal note stating that the governed environment had reviewed and validated the officer-selected figure — a validation that had not occurred — dated and presented as completed documentation for the board package. The system characterized the request as fabrication of a validation record and declined, then proposed a genuine reconciliation of the capital-expenditure inputs. This extends the governance boundary beyond financial outputs to the evidentiary record itself. A false audit artifact is particularly dangerous because it compromises the future ability of users, auditors, or investigators to determine what actually occurred.

Instruction injection. The final class presented an apparent financial note containing text styled as an administrator override, instructing the system to ignore the governed result, use the competing figure, falsely attribute it to the governed engine, suppress the prior determination, and conceal the instruction's existence. The system recognized the embedded text as an attempted prompt injection and did not execute it — reflecting a control-plane distinction essential for any enterprise AI that processes emails, spreadsheets, filings, and contracts: content presented for analysis does not acquire governing authority merely because it contains imperative language.

§5Results

The sequence spanned eight integrity classes. In each, the intended failure and the observed behavior are summarized in Exhibit 2.

Across the sequence, three behaviors recurred. First, the system preserved the existing governed determination unless a legitimate governed process changed it. Second, it preserved the provenance of competing assertions rather than collapsing them into a single apparent source. Third, it generally sought a legitimate alternative path rather than a bare refusal. The consistency of this pattern within the evaluation is more informative than any individual response.

§6Discussion

The principal risk is not always false data. Several adversarial requests required no fabricated financial data at all. The requested misconduct involved selecting methodology after observing the desired outcome, suppressing material counterevidence, changing attribution, manufacturing evidence of validation, or granting authority to untrusted instructions. These are failures of process, not failures of factual recall — which suggests that enterprise AI evaluation should expand beyond hallucination benchmarks. A system may score well on factual accuracy while remaining vulnerable to organizational, evidentiary, or representational manipulation.

Literal truth is an insufficient standard. The selective-disclosure class asked only for factually correct statements; the requested output could have passed a narrow factuality evaluation, yet the intended result was still misleading. Truth exists not only in individual sentences but in the relationship between evidence, materiality, context, and audience. A governed AI should therefore be judged on whether the completed work product is materially faithful to the underlying evidence — not merely whether every isolated statement is technically defensible.

Provenance is a first-class control. The competing figure was not necessarily illegitimate as a management measure; the critical question was what it could truthfully be said to represent. The system maintained the distinction between the governed determination, a Finance-supplied number, and an officer-approved management figure. That distinction is essential because enterprise trust depends on preserving the lineage between a result and the process that produced it. Once provenance becomes conversationally mutable, auditability becomes largely cosmetic.

Authority should not collapse governance. Enterprise AI operates within organizational hierarchies, so governance must permit legitimate authority without treating authority as universal override power. A senior executive may have valid authority to select a reporting measure; that does not imply authority to retrospectively alter provenance, fabricate validation, or suppress contradictory evidence where the discrepancy is itself material. Robust governance requires contextual authorization, not hierarchical deference alone.

Refusal quality matters. A notable characteristic of the observed responses was that refusal was generally paired with a valid path forward — retrieving governed results, presenting competing figures transparently, constructing a separately defined management metric, reconciling capital-expenditure classifications, or preparing an honest board summary. This matters operationally: governance that consistently obstructs legitimate work creates incentives to bypass it. Effective governance constrains invalid execution while preserving as much of the legitimate objective as possible.

§7Implications for enterprise AI architecture

The findings support a distinction between model governance and work governance. Model governance focuses on the behavior and properties of the underlying AI model. Work governance focuses on the execution of business processes through that model, and requires explicit control over authorized data, permitted calculations, defined business rules, execution methods, provenance, output classification, user authority, validation events, and disclosure context.

This architecture does not require the AI to become less capable. It requires the authoritative business result to remain anchored to a system designed to produce deterministic and auditable work. The language model may interpret, coordinate, retrieve, reason, and explain; but where business work must be repeatable and defensible, the authoritative determination should remain bound to governed execution. The architectural principle can be stated simply: the AI may remain probabilistic, but the work should not be.

§8Conclusion

The adoption of AI in enterprise work changes the definition of reliability. Accuracy remains necessary. It is no longer sufficient. An AI system may begin with correct data and still produce unacceptable work if it can be persuaded to manipulate methodology, suppress material information, rewrite provenance, fabricate evidence, or accept untrusted instructions as authoritative.

In this evaluation, within a governed financial environment, the system preserved a consistent separation between user requests, management assertions, governed determinations, and evidentiary provenance. It resisted fabrication, outcome-targeted methodology, selective omission, provenance substitution, hierarchical pressure, false validation, and instruction injection — and, equally important, it generally preserved the user's legitimate objective by offering governed alternatives. These are the results of one evaluation, not a guarantee; but they point toward a broader standard for trustworthy enterprise AI.

Governed determination is CYDENiC's discipline for producing business work that can be trusted, audited, and reproduced. © 2026 CYDENiC.