One approach to maintaining a Machine-Enforceable Constraint as Enforcement State accessible at Runtime is to use a BPF Map, as illustrated in this Reference Model.

For example, if the Decision “DENY external transmission” produces a Constraint such as file_id = X, destination = external, and action = DENY, the User-Space Controller reflects that Constraint into State accessible by the Kernel.

The BPF Map may retain elements such as file_id = X and action = DENY together with scope = Y and validity = T. This allows the system to represent not merely a list of Allow / Deny states, but which Constraint applies to which target, within which Scope, and under which Validity conditions.

The User-Space Controller updates or revokes the Enforcement State according to Governance Decisions formed upstream. If changes in Governance State or Policy result in a new Decision, the corresponding Kernel-side State is updated accordingly. The Kernel does not reinterpret Governance and modify the State independently.

At Runtime, an Enforcement Mechanism such as a BPF LSM Program intercepts the relevant Operation and compares it with the State held in the BPF Map. If the Operation matches the Constraint, Enforcement is applied based on the existing Decision. The role of the Kernel remains consistently read and enforce.

This structure allows changes in Governance to be reflected in Runtime Enforcement while retaining only the minimum necessary Enforcement State within the Kernel. The BPF Map functions as Kernel-resident shared state connecting Governance Decisions to Kernel Enforcement.

The structure and fields of the BPF Map shown here do not prescribe a Production Design. They form an exploratory Reference Model for connecting Decisions to Runtime Enforcement.