In the eBPF / LSM Reference Model, an upstream Governance Decision is passed from User Space to Kernel Space and applied to actual Execution. The example uses the Decision “DENY external transmission.”

This DENY is not generated by the Kernel. The semantic Decision has already been formed within the upstream Governance Layer based on Policy, Authority, Context, Governance State, and other relevant elements.

In User Space, the Decision is translated into a Machine-Enforceable Constraint. In the diagram, this is represented as destination = external, file_id = X, and action = DENY. This is not the Policy itself, but a Constraint containing only the conditions required for Runtime verification.

The User-Space Controller passes this Constraint into Kernel Space through a BPF Map. This allows only the minimum state required for Enforcement to be shared with the Kernel, without introducing complex Governance Logic into Kernel Space.

Within Kernel Space, the BPF LSM Program intercepts a System Action through an LSM Hook and compares the Execution Request with the Constraint. If an External Transmission involving file_id X matches the DENY condition, the Execution is BLOCKED.

The Kernel does not reinterpret Policy. It only verifies whether the requested Execution matches the provided Constraint. This separates semantic Decision from deterministic Enforcement.

If the Governance Decision changes, the Constraint can be updated from User Space and reflected in the Kernel Enforcement State. This also supports the principle of Minimal Kernel State, as the Kernel retains only the state necessary for Enforcement rather than the complete Governance structure.

This Reference Architecture therefore illustrates the connection through which a Governance Decision becomes a Machine-Enforceable Constraint and ultimately Blocks actual Execution.

eBPF / LSM is not presented as a validated Production Implementation, but as an exploratory Reference Architecture for examining how Governance Decisions could be connected to Kernel-Level Enforcement.