A Detector Has No Authority

Much of what is sold as AI governance is monitoring. A drift detector, an anomaly alarm, a dashboard that turns red. Each one raises an alert. An alert is a statement about something that already happened, and it carries no authority over the action that happens next.

The distinction is not coverage. It is whether the thing can change what the system does.

An alert is about the past.

A detector reads realized behavior and emits a signal after the effect is on its way. That is its design. It samples what the system did, compares it to a baseline, and reports a divergence once the divergence exists.

Run the detector at perfect recall. Give it every signal, zero missed events, an operator watching the screen. It still cannot withhold a single action. It can describe the action, score it, and page a human. The action proceeds while the page is read.

Coverage is a property of a sensor. Authority is a property of a control. A system can have complete observability and hold no authority over its own next step.

The governor is a different kind of object.

A governor sits in the path the action takes to the actuator and sets how much authority that action is granted, before it runs. It is a control loop, not a sensor. The monitor answers what happened. The governor sets what is allowed to happen next.

A detector at full recall still cannot withhold one action. That sentence is the whole line between observability and governance. One produces knowledge about the run. The other produces the run.

Position follows from this. A control that only reports can sit beside the log. A control that sets authority has to sit in front of the actuator, on the one path the action cannot avoid, or it is back to reporting.

What it reads, and when.

The governor reads the divergence of realized behavior from the assured trajectory, the same quantity a good detector reads. The difference is the clock. The detector may report at its leisure. The governor has to decide before the next action, because its decision is the authority that action carries. Late is the same as absent.

That timing turns into a default. When the forward look is uncertain, the governor grants less, not more. A detector that is unsure raises a softer alarm. A governor that is unsure withholds. Uncertainty resolves toward the actuator doing less, because the cost of granting authority the situation did not earn is paid at the actuator, not on the dashboard.

The obligation names the path, not the log.

SR 26-2 took effect April 17, 2026 and places generative and agentic AI outside its scope, with the interagency request for information it promised still unissued. The obligations that do reach agents are written elsewhere, and they are written about the path. A high-risk system under the EU AI Act must carry human oversight and a means to stop, correct, or override the system while it operates, with those duties applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744.

A means to stop or override is a control in the path. A dashboard is not one. An obligation to be able to intervene in a running action is discharged by the thing that sets the authority of that action at runtime, before it lands, not by the record written after it. The regulators are asking for the governor and describing it in the vocabulary of oversight.

Buying the sensor and calling it the control.

The failure mode is quiet. A firm instruments everything. Drift alarms, trace capture, a wall of green that goes amber. The program looks complete. Then an agent takes an action the firm would never have allowed, and every instrument performs exactly as designed. They all saw it. Not one of them was positioned to stop it.

Observability answers a question worth answering. It does not answer the governance question. The governance question is what authority the next action is allowed to carry, and only a control standing in the path of that action can answer it.

What we are building.

Wayfinder Systems Group builds the control that stands in the path. A runtime governor that reads each action against a declared envelope and sets how much authority it is granted, before the action reaches the actuator, granting less when the forward look is uncertain and never more than the system was already cleared to take. The system acts only inside what the governor grants, through a path it cannot step around. The governor emits a signed record of what it decided, which is the evidence, not the product. We call her Velma.