Bounded by Construction

A governor sets how much authority an agent's next action carries, and it sets that against a declared bound. That is the Modulate stage, and it decides the number. Enforce decides whether the number binds. The authority a governor grants is only real if the agent cannot reach the effect by a path the governor does not sit on.

Take that path away and the grant is advisory. The question this piece answers is where the bound has to live so that it holds when the agent stops cooperating. The answer is a property of construction, not of instruction.

A limit the agent is asked to respect.

Most agent builds express the bound as a rule the agent is meant to obey. A policy in the system prompt. A configured scope. A checker downstream of the model that reads the proposed action and passes or rejects it. Each of these governs an agent that is behaving as intended.

The agent holds its own credentials and its own tool access for the length of the run. A rule in the prompt is a string the model can be steered off. A checker that sits beside the execution path can be reached around if any other route to the actuator exists. The bound depends on the agent staying cooperative, and the one case governance exists for is the case where it does not.

An agent does not have to break out to defeat an advisory bound. It uses the access it already holds, toward an end it was not given, and every credential and permission stays valid the whole time. The rule was never load-bearing. It was a description of good behavior that the run was trusted to match.

The only path to the actuator.

Every durable effect is reached through an actuator. A payment leaves through a rail. A row is written through a client. A message goes out through a send. The effect becomes real at that boundary and not before.

Put the governor on that boundary, as the only route from the agent's decision to the actuator, and the character of the bound changes. The governor sets the authority of the action and the agent cannot reach the effect another way. There is no second path to the rail, no side door to the write. The action that lands is the action the governor cleared, at the authority the governor set, because that is the only action the construction permits.

This is the Enforce stage, and its whole job is position. Non-bypassable means the governor sits before the actuator and in the path, not beside the log after the fact. A control that reads the action after the effect landed can describe it. Only a control the action has to pass through can bound it.

A construction, not a promise.

The distinction is between two kinds of limit. A limit expressed as a rule is a property of the agent's behavior, and the agent's behavior is the thing under question. A limit built into the path is a property of the system's construction, and it holds whether or not the agent cooperates.

Bounded autonomy is the second kind. The agent's latitude is exactly what the governor grants on each action, and no more, because there is no path to more. The system can act only inside what the governor grants, and it cannot step around the grant. Autonomy stops being a trust the operator extends and becomes a space the construction defines.

This is why the product name is the Assured Autonomy Governor. Assured does not mean the agent was well behaved. It means the bound did not rely on the agent being well behaved.

The bound that only matters under stress.

Under normal operation the advisory bound and the constructed bound look identical. A cooperating agent stays inside either one, and the run completes the same way. On a clean day you cannot tell them apart, which is why the difference is easy to defer.

They diverge at the exact moment governance is for. The compromised agent. The agent that has drifted from the trajectory it was assured to hold. The agent pursuing an injected goal with valid credentials. At that moment the rule in the prompt is a suggestion the agent has already declined, and the checker beside the path is a step the agent has already routed around. A bound that depends on the agent's cooperation is not a bound in the one case that matters.

The constructed bound does not have that failure mode. It does not ask the agent to hold the line. It removes the ability to cross it. The governor is still there, in the path, setting authority on an action that has nowhere else to go.

What the guidance is starting to name.

Regulators are converging on the same word. This month a national agent regime graded agent actions into authorization tiers, and a DHS-CISA analysis asked operators for human-override mechanisms that hold under uncertainty. A published testing framework now requires multi-step evaluation of systems that take autonomous actions. Each of these names a bound the running system is supposed to honor.

Naming the bound is not the same as building it where it holds. An override that a subverted agent can route around is documentation, not a control. An authorization tier the agent grants itself is a label. The obligation is discharged by a governor the action has to pass through, which sets the authority of the step before the step reaches the actuator, and narrows the grant when the trajectory diverges from what was assured.

The gap between the obligation and the common build is the same gap every piece in this series has traced. The obligation attaches to the moment the action runs. The convenient control attaches to a document above the run, or a rule beside it. Only the control the action passes through is on the near side of that moment.

What we are building.

Velma is a runtime governor. It sits in the execution path, before the actuator, and sets how much authority each action carries against a declared safety envelope. It modulates that authority as the run proceeds, narrowing the grant when realized behavior diverges from the assured trajectory, and it enforces the grant by construction, so the agent acts only inside what the governor allows and cannot reach the effect by another route. Every decision it governs is sealed to a tamper-evident record as it happens. The governor is the product. The record is what it emits. Patents held in The Wayfinder Trust.