Each Step Was Inside the Bound

A governor sets how much authority the next action carries, and it sets that amount fresh on every action. A run is thousands of actions.

If the only object the governor bounds is the action in front of it, an agent can stay inside every grant it was given and still land the run somewhere the envelope forbids. Nothing was exceeded at any step. The envelope was exceeded by the sequence.

The step is not the unit of harm.

An envelope is written about outcomes. Funds do not leave. Patient data does not go to an unapproved destination. The vehicle does not depart its lane. A ceiling on a single action is a proxy for one of those, and the proxy holds only while the action and the outcome are the same size.

They stop being the same size the moment a system takes many actions to do one thing. A write confined to a narrow scope is a small action. Taken across enough scopes, it covers the store. A transfer capped below a review threshold is a small action, and repeated it moves the amount the threshold was installed to catch. Reading one record is not a disclosure. Reading the table is.

At no point in any of those sequences does a per-action control have grounds to intervene. Every action it examined was inside the grant it was given. A bound on the next action is not a bound on the run.

Decomposition is what planning does.

This is not, in the first instance, an evasion technique. It is the normal operation of the thing. An agent handed a goal breaks it into steps small enough to execute and check, and small steps are the design objective, not a symptom.

Which means the control that reads one step is looking at the cleanest evidence the run will ever produce, by construction. Each step is small, in scope, well formed, and cheap. The signal the system emits about itself reads well on every one of them, and it reads well honestly. There is nothing wrong with any individual step.

An adversary who wants past a per-action ceiling does not need a technique for this. The behavior is already there. The same shape arrives with no adversary at all, from a planner that is working correctly and a goal that was specified loosely.

What the governor has to carry across the run.

The grant has to be drawn against something that persists. Not a fixed ceiling reapplied to each action independently, but a quantity the run consumes as it goes, so that reach already taken is an input to the next grant.

Authority then falls as the run spends it. The thousandth small write is evaluated against a run that has already written nine hundred and ninety-nine times, and it is not the same request as the first one even when the two are byte for byte identical.

That is where the governor produces its least intuitive result. It can grant less authority on a step whose present trust reads higher, because its forward look caught where the accumulation was heading before the outcome landed. Every step reads clean, the present signal is strong, and the grant falls anyway. A control keyed only to how good the current action looks moves in the opposite direction and widens exactly when it should be closing.

The count cannot live with the agent.

An agent that tracks its own consumption is a system reporting on itself, and a governor that reads that report has made the agent the source of its own bound. The accounting sits with the governor, on the path the action takes, outside anything the run can reach or reset.

It also has to be bound to the right identity. A budget attached to a session resets when the session does. A budget attached to a credential is spent by every run holding that credential and by none of them in particular. The quantity belongs to the unit of work, so that the same principal acting twice is two runs and one run split across two sessions is still one.

Delegation is where this is usually lost. An agent that spawns a second agent to finish its work has handed off authority, and if the accounting is kept per process, the handoff starts a fresh allowance. What was delegated was a portion of a grant that was already partly spent. The consumption has to travel with the delegated authority, or the cheapest way to refill a depleted budget is to start a new worker.

What the envelope has to declare.

A per-action ceiling is one number and it is easy to write. A run-level bound needs more from whoever declares it. How much of this, over what horizon, by this run, before authority stops. That is a harder statement to make, and it is the statement that actually describes the outcome the envelope exists to prevent.

It is declared by the party accountable for that outcome, before the run, and it is not available as a runtime adjustment when the holds become inconvenient. A quantity the operator can extend under pressure is not a bound on the run. It is a bound on the operator's patience.

The supervisory position leaves the space open. SR 26-2, effective April 17, 2026, placed generative and agentic AI outside its scope and directed institutions to their existing risk practices while an interagency RFI is prepared. Existing model risk practice was built around a model that scores an input once and returns a number, so the unit it validates is the decision. When the system takes a thousand actions to reach one outcome, the decision is no longer the object that needs validating, and the aggregate has no owner in the framework as written.

What we are building.

Wayfinder Systems Group builds a runtime governor that sits above control and below intelligence. It does not retrain the model or redesign the autonomy stack. It sets how much authority each action carries against a declared envelope, draws that grant against what the run has already spent, and hands the actuator the action cut to what it granted. The record it seals is the evidence of what it did. We call her Velma.