Decide, Record, Do Nothing

A governor packaged without its enforcement point still starts. It still reads telemetry, still sets an authority grant on every action, still signs every decision it made. The one thing it no longer does is change what runs.

Nothing in its output says which build you have.

The stage whose output is nothing.

Observe, assess, modulate, enforce, audit. Four of those stages leave something behind. Observation leaves telemetry. Assessment and modulation leave a grant, a quantity naming how far this action may reach. Audit leaves a record.

Enforcement leaves the action that did not happen. A write confined to a narrower scope than the one requested. A transfer capped below the amount proposed. A command that was never issued at all. Enforcement is the only stage of a governor whose output is an absence.

An absence cannot be looked up. Ask whether the governor is running and a build with no enforcement point answers yes. Ask whether it is producing decisions and it produces a stream of them. Ask whether the chain verifies and it verifies. Every question a health check knows how to ask is answered correctly by the build that governs nothing.

How the stage goes missing.

A governor rarely reaches the system it governs as source. It reaches it as a package. A vendored snapshot copied into another team's tree. A container image. A static library linked into a firmware bundle. A cut taken at one moment and carried into a build the governing team does not own and cannot watch.

Copies drop things. A snapshot taken before the enforcement point was written stays that way while the canonical engine moves on without it. A build list that enumerates source files by hand keeps whatever was there when someone last edited the list. A dependency pinned to a revision that predates the stage keeps the revision and loses the stage.

None of that requires an adversary. It requires a supply chain with more than one copy of the same engine in it, which describes every deployment of a control into a product that somebody else builds.

What the record is a record of.

A build that assesses and signs without enforcing produces a record that is well formed and true about itself. Every entry states what the governor assessed and what authority it granted. Every entry is signed. The chain verifies end to end.

What the entries stop being is a statement about what the actuator did. In a governed build the grant and the executed action are one object, because the enforcement point constructs the bounded action and hands the actuator that. In this build they are two objects that happen to be written down together. The record says authority was reduced. The action ran as proposed.

Set the two records side by side and they are indistinguishable. That is what makes this failure quiet, and it is the reason the check cannot be a check on the record.

Version is a claim. Capability is a measurement.

The usual control here is a version string. The package declares which engine it carries, and the integrator confirms the number matches the one that was assessed. A version string is a claim about provenance made by the artifact whose provenance is in question.

The check that holds compares the shipped package against the canonical engine by capability. Which translation units are present. Whether the enforcement point is among them. Whether the files that carry enforcement differ from canonical by a byte. A file that is missing is a capability that was dropped. A file that differs is a capability whose behavior is unverified. Both are findings a build gate can refuse on, and neither rests on anybody's account of what went into the package.

What the governor should refuse.

The gate catches the package before it ships. The governor also has to catch itself.

A governor that comes up with no enforcement point on the action path has started in a configuration where it is decorative. It reads, it scores, it grants an amount of authority, and none of what it grants reaches the action. A control that can start in a configuration where it changes nothing will eventually ship in that configuration.

So the startup path asks one question of its own build. Is the enforcement point present, and does it sit on the path the action takes. If the answer is no, the governor does not come up, and the system it was installed to bound does not run unbounded while reporting that it is bounded. This is the same reasoning that puts the safe state in the enforcement point rather than in the governor, applied one level up, to the artifact instead of the run.

Where certification meets the build.

A conformity assessment evaluates a system. A field deployment runs a build. Every packaging step in this piece sits between the two.

The EU AI Act's high-risk obligations now fall on December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component in a product already covered by EU product safety law. The embedded case carries the longest distance between the artifact that was assessed and the artifact that was installed, because the AI arrives inside a product built by another party, on that party's toolchain and release schedule. SR 26-2, effective April 17, 2026, left generative and agentic systems outside its scope pending an interagency request for information, which leaves the question of what was actually deployed with the institution running it.

An assessment that identifies a governor by name and version has assessed a claim. An assessment that identifies it by the capabilities present in the artifact has assessed the artifact.

What we are building.

Wayfinder Systems Group builds a runtime governor. It sets how much authority each action carries against a safety envelope declared outside the run, and it holds that grant at an enforcement point the action cannot step around, so what reaches the actuator is the action the governor allowed. The grant is set on where behavior is heading and not only on how clean the present step looks, which is why it can grant less authority on an action whose present trust reads higher. Every grant it sets is signed as it happens. We call her Velma.