OMEGA Language Specification — Governance Grammar for AI Systems

What is a governance language?<br>A governance language is a formal notation for declaring what an autonomous system may do and what it must not do — the boundary of permission and refusal — separate from the code that decides how it does it. It is a description language, not an execution language: its programs do not run, they are read — by a separate process, on a separate substrate, before the governed system is permitted to act. SQL describes the shape of a query the database engine must honor; HTML describes the shape of a document the browser must render; a governance language describes the shape of a decision an agent is permitted to make.<br>The distinction matters because the alternative — governing an autonomous system in the same medium it thinks in — is not governance. A prompt that tells a model what it may not do is interpreted by the same network that decides whether to follow it. A guard clause inside the planner is enforced by the planner. A PDF policy is enforced by the engineer who remembers to read it. None of these are checks; they are suggestions inside the substrate they purport to constrain. A governance language exists so the check can live somewhere the governed system cannot reach.

What is OMEGA<br>OMEGA is a typed governance grammar for autonomous systems. It is a description language — not a programming language — that declares what an agent may perceive, may decide, and may do, in a machine-readable artifact the Safety Kernel loads and enforces before the governed system acts. The specification is a .omega file; the kernel is the loader and evaluator that reads it; the substrate — a language model, a robot arm, a drone — submits actions and receives ALLOW, DENY, or UNKNOWN verdicts.<br>OMEGA has thirteen unamendable primitives, a syntactic Can/May/Do gate, and two profiles (Strict and Extended) that make the boundary between statically decidable policy and bounded computation explicit in the grammar itself. OMEGA attempts to model all eight Hohfeldian relations — including the potestative group of power, liability, immunity, and disability — in a single load-time-enforced specification.

What happens without one<br>The failure modes a prose-governed system inherits by default.<br>A system without a governance language fails in characteristic ways, and the ways are not bugs — they are the predictable shape of the absent grammar. The policy exists in prose, in slide decks, in onboarding documents, and in code comments above conditional branches. When the system does something the policy intended to forbid, there is no artifact to inspect. The forensic question "what was this system permitted to do?" has no machine-readable answer. The legal question "who authorized this action?" resolves to "the model decided."<br>The consequences are not hypothetical. Prompt-governed agents drift between model versions and cannot be re-certified without re-running every behavioral test from scratch. Robotic systems certified for one envelope encounter a state the prose policy did not anticipate, and the controller either fails open (executes the unspecified action) or fails closed without explanation (refuses a safe action with no recoverable reason). Regulated industries — medical, financial, aviation, defense, critical infrastructure — have strong reasons not to accept an autonomous system whose permitted behavior is defined only by transcripts of what it has done so far. Insurers cannot underwrite it. Auditors cannot audit it. Safety reviewers cannot sign off on it. The absence of a machine-checkable governance layer is one reason many autonomous systems remain difficult to certify, audit, insure, or deploy in high-trust environments.

The spec–substrate gap<br>When a system's specification language is weaker than its execution substrate, the machine will eventually execute a state transition the designer intended to forbid but lacked the vocabulary to articulate. The failure is the exact shape of the absent word. Every deployed agent today runs on an execution layer — Python, C++, a tool interface, a robot arm — that can perform actions its prose policy has no grammar to name. The gap is not an engineering defect; it is a property of the medium.<br>OMEGA narrows the gap by making the specification a typed object the loader parses before the substrate is permitted to act. A governed action that lacks the required structural form cannot be admitted as a valid governed transition. Required structural coverage is a load-time obligation, not an informal code-review convention.

Why a load-time gate<br>Governance enforced only at runtime is easier to bypass, drift, or inconsistently apply. Runtime checks are mocked in tests, rate-limited under load, bypassed by privileged paths, and silently disabled by configuration drift. Policy accumulates faster than reviewers can audit it, and the gap between what the prose forbids and what the system can do widens with...