The article argues that JSON Schema alone cannot serve as an AI governance layer because it validates structure but cannot resolve semantic ambiguities that determine whether an agent action executes. Independent stress tests on the open PIC protocol revealed parser differentials: identical payloads validated against the same schema produced opposite authorization decisions due to implementation-specific behaviors. For example, Python and TypeScript verifiers resolved duplicate "invoice" provenance identifiers differently—first-match versus last-write-wins—causing one to approve a payment and the other to block it. JSON Schema cannot express cross-field constraints like unique evidence binding, and normalization habits (trimming whitespace, lowercasing hex digests, tolerating Base64 variants) silently rewrite signed values, breaking the link between what was signed and what policy evaluates. Trust labels in payloads are self-asserted and useless unless derived inside the enforcement boundary by verifying signatures against operator-controlled keyrings. The author proposes a three-layer stack: schema validation for wire format, semantic verification for reference resolution and trust derivation, and policy evaluation for the final allow/block decision. Conformance vectors—executable test cases covering ambiguous inputs (duplicate IDs, case variants, self-asserted trust)—are essential to align implementations. Secure defaults must survive every adapter (CLI, HTTP bridge, framework SDKs), and migration flags should require explicit opt-in with warnings. Governance ultimately reduces to a boolean returned by a verifier; if independent implementations disagree on the same bytes, an attacker can exploit the gap.