A Sign-Off Is Not a Bound

This week the Financial Stability Board published its final guidance on adopting artificial intelligence in finance, a set of twelve non-binding sound practices. One tells firms to set a risk threshold at which an agent must stop and get a person's sign-off. It tells them to limit what the agent can do on its own. It tells them to test the mechanisms that stop it.

The diagnosis is right. The remedy, a person waiting at the threshold, is the one a policy can write. It is not the one that scales, and it is not where a runtime governor puts the human.

What the board got right.

The guidance no longer frames an agent as a synthetic employee. It says an agent does not reason like a person and may read a goal in ways no one intended. That is the hard part, and naming it is the board's best move, because it rules out the comfortable idea that an agent can be governed the way a junior analyst is, by trusting it to act within the spirit of its instructions.

The thing that makes an agent useful is that it composes steps no one scripted. The same property is why its own account of what it is doing cannot be the thing that governs it. Limiting what the agent may do and testing the stop are both statements about authority, which is the correct object. The open question is what carries that limit on every action.

A sign-off is authority a person grants.

Follow what a human sign-off trigger actually does. The agent reaches the threshold, pauses, and sends a request to a person. The person reads it and approves. The agent proceeds. The authority the next action carries was granted by a person, in the middle of the run, from a reading of a request the agent composed.

That is an authority-raising act, performed under production pressure, on the agent's own telling of what it wants to do. It carries the exact weakness the board just named. The person is reading the request, the request is the agent's account, and an agent that reads its goals in unexpected ways is an agent whose account cannot be taken at face value. A sign-off raises authority. A bound only lowers it.

A bound is authority the action carries.

A governor does not wait at the threshold. It sets how much authority the next action carries against a bound declared before the run, in the action's own units, at the point the action would become a durable effect. A high-stakes action either proceeds inside a bound narrow enough to be safe or it does not proceed. The bound travels with the action rather than waiting on a click, and no person is in the loop for the action that fits.

The board's threshold is binary. The agent acts, or a person signs. Between those two there is a reduced-authority pass the threshold has no name for, the action running inside a narrower bound with no one needed to approve it. That pass is the normal case, not the exception, and a control that can only choose between full autonomy and a human queue throws it away.

The forward look is where the bound does the thing a sign-off cannot. The governor can grant less authority on an action whose present trust reads higher, because its forward look caught the run turning toward the threshold before the step landed. A person signs off after the agent has decided it reached the threshold. The governor set the bound before the agent got there.

Where the next unit of authority comes from.

The deeper split is the source of authority. A sign-off gate makes a person the source. Every high-stakes action waits on a human to grant it, and the authority the action carries is whatever the reviewer hands back on the click. A governor never raises authority on a click. It withholds authority by default and grants an action only as much as the envelope already allowed it, so the grant is a ceiling bounded above by what the system was already cleared to do. The burden sits on the action to be assured, not on a person to catch it after the fact.

This is also why the sign-off does not scale. Route every high-stakes action to a person and the result is a queue no one can staff, or a reviewer who approves at volume, which is a sign-off in name only. A class of actions handed wholesale to a person is not governed. It is ungoverned with a human attached.

The person still has a place. It is the residue a bound cannot make safe, the action the envelope was never given the terms to cover. The person is the last resort. The bound is the mechanism.

What the rule asks, and what it leaves open.

The board's practices are non-binding and sit alongside the instruments that are not. EU AI Act Article 14 asks that a high-risk system be designed so the people assigned oversight can monitor, override, or interrupt it, with high-risk obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744. SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope and the interagency request for information it promised still not issued. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement, with a later version targeted for the Fall National Meeting in November. On October 8 the United Kingdom's data protection authority opened a call for evidence on the data-protection risks of agentic AI.

Each names a person who must be able to oversee, override, or sign off. None asks the prior question, which is what set how much the agent was allowed to do before anyone was asked to sign. A sign-off governs only the actions that reach it. A bound governs the ones that do not.

What we are building.

Wayfinder Systems Group builds a runtime governor that sits above the control and below the model. It sets how much authority each action carries against an envelope declared before the run, holds that bound in the path so the only thing that reaches the actuator is the action already cut to the grant, and grades where the run is heading so it can pull authority back before a step lands rather than wait for a person to catch it. Authority is withheld by default, and the grant never rises above what the system was already cleared to do. A person is the last resort, not the loop. We call her Velma.