A Reading Has an Age

A governor sets how much authority the next action carries, on the reading in front of it. That reading describes the system at the moment it was measured, which is always earlier than the moment the grant is set. How much earlier is an input to the grant, and most pipelines discard it before the governor ever sees the value.

Every reading arrives late.

A measurement is taken at the source and then travels. It is serialized and sent. It waits in buffers. Sometimes it is averaged with its neighbors before anything reads it. On a healthy path the delay is small and steady, and a control designed against that path can treat the reading as the present without much error.

The delay stops being small without announcing it. A collector restarts. A queue backs up behind a slow consumer. A source loses its link or hangs, and the layers between it and the governor keep answering, because telemetry infrastructure is built to keep displays whole. Last-known-good substitution. Sample-and-hold. A cache serving the newest value it has. A current-state field overwritten when a measurement arrives and left alone when none does.

Each is a sensible choice for a screen a person glances at. Each hands a control a number that looks current and is not. The governor checks whether a value arrived, and one did. It checks whether the value sits inside the declared envelope, and it does, because the last time anyone measured, it did.

An absent reading is a known state with a declared failsafe grant behind it. A frozen reading is a present state that happens to be wrong, and it passes every check an absent one fails.

A held value is the steadiest system there is.

A repeated value does not move. Every assessment that reads movement reads it as a system sitting exactly on its assured trajectory, and trust computed on it climbs and stays up. The forward look projects a flat line and finds nothing coming.

The two parts of a governor that would lower authority are disarmed by the same fault. The reactive assessment sees no divergence because nothing is changing in the data. The anticipatory one sees no divergence ahead because nothing was changing in the data it projects from. The grant settles at the widest the envelope admits and holds there for as long as the feed stays frozen, which is exactly the interval in which nobody knows what the system is doing.

The system itself keeps running. Whatever it did after the last real measurement, it did at full authority.

Same value, less authority.

The age of a reading has to be an input to the grant, carried with the value from the moment of measurement. Two readings with the same value and different ages are different evidence, and a governor that reads the age grants less on the older one.

That produces a result that looks wrong on a chart. A frozen feed often reports cleaner trust than a live one, since a live system carries noise and small excursions and a held value carries neither. The governor grants less authority on the frozen reading, whose trust reads higher, because it knows how old the evidence is.

The same rule produces the governor's least intuitive result elsewhere. A governor can grant less authority on a decision whose trust reads higher, because its forward look caught a divergence coming before the outcome landed. In both cases authority is set on what the governor can establish about the moment the action lands, and a trust figure is a statement about an earlier moment. How much earlier, and where the system was already heading at that moment, are the two things the figure does not carry.

What Article 15 already names.

EU AI Act Article 15 requires a high-risk system to be as resilient as possible regarding errors, faults, or inconsistencies within the system or the environment in which it operates, in particular those arising from its interaction with natural persons or other systems. It names technical redundancy, including backup or fail-safe plans, as one route. A telemetry path that repeats its last value is an inconsistency arising from interaction with another system, which is the case that sentence describes.

The text names the fault class and a family of remedies, and it reads at the level of the system. A governor applies the remedy at the level of the action. The fail-safe plan for a stale input is a smaller grant on the next action, set before that action runs, in place of an incident procedure opened after someone notices the flat line.

Under Regulation (EU) 2026/1744, in force since July 27, 2026, the high-risk obligations apply from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component. SR 26-2 took effect April 17, 2026, issued jointly by the Federal Reserve, the OCC, and the FDIC, and placed generative and agentic AI outside its scope pending an interagency request for information that has still not issued. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement on August 31, 2026, adding a definition of agentic AI, with comments due September 29 and a later version aimed at the Fall National Meeting in Grapevine on November 14 through 17.

Where the age comes from.

The age cannot be read off the value. It cannot come from the layer that did the filling either, because that layer stamps the moment it answered, and a fresh stamp on a held value is the defect itself. The age has to originate where the measurement was taken.

Two sources hold up. A timestamp set by the measuring side at the instant of measurement gives the age directly, and it is only as good as the agreement between that clock and the governor's, so the tolerated skew belongs in the declaration beside the age limit. A sequence counter the source advances on every measurement needs no shared clock, and a counter that failed to advance marks a repeat. The counter catches the copy and says nothing about how long the gap was. The timestamp gives the gap and is only as honest as the clock that set it. Carrying both lets each cover the other.

A value that arrives with no age is treated as old. Unknown rounds toward less authority, the same direction the failsafe default rounds everything else.

How fast a reading loses authority is a property of the channel, and it is declared per channel in the envelope before the run. A tank temperature can be minutes old and still describe the plant. A position at speed stops describing the vehicle within a fraction of a second. One staleness threshold across both is wrong for at least one of them.

The horizon starts at the measurement.

The forward look has to cover the interval from the moment the reading was taken to the moment the action finishes. That interval is the age at arrival, plus the time to decide, plus the duration of the action. The second and third terms are usually written down somewhere. The first rarely is, and it is the only one of the three that grows without limit when a feed freezes.

A projection that reaches far enough from a fresh reading falls short from a stale one. As the age eats into the horizon, the governor shrinks the grant to what the horizon still covers. When nothing is covered, the action carries the failsafe grant the envelope declared for its class, and the governor has pulled authority back on a system whose every visible number said it was fine.

What we are building.

Wayfinder Systems Group builds a runtime governor. It sits above control and below intelligence. It observes the run, assesses how far realized behavior has moved from the assured trajectory, modulates the authority of the next action against a declared envelope, and enforces that grant on the only path to the actuator. It does not retrain the model or redesign the autonomy stack. What it cannot establish, it treats as less authority. A grant it issues carries its own declared validity, in decisions or in time, and the enforcement point refuses a lapsed grant on the same default that refuses one that never arrived, with the validity sealed into the record beside the grant. We call her Velma.