Field notes, week of September 20, 2026

A governor sets how much authority the next action carries, and it sets it before that action runs, on evidence gathered before that. Everything it holds at the instant of the grant is older than the thing it is governing. This week took three ways that gap opens.

Authority is set on what can be established about the moment the action lands, not on what was true when the evidence was collected.

This week.

The Forecast Starts at Zero (September 14). A governor that anticipates is spending a second grant, and almost nothing in a typical build states what that second grant is. The visible grant is the one the action carries, set against an envelope declared before the run. Underneath it sits another, held by the forecaster rather than by the governed system, covering how far the forward look is permitted to lower the first one. What goes unstated defaults to full, so a forward look with no gate on it moves the number across its whole designed range from the first decision of the run, which is the decision at which it knows least. A forecaster carries a running account of how often it has been right, and an average over nothing has no defined value, so the code picks one. Full confidence is the natural pick, being the identity element and keeping the arithmetic simple, and it is the one value certainly false. Empty and perfect land on the same number. The constraint that follows is entirely real and its basis is entirely a claim the forecaster made about itself. The action is genuinely narrowed and the headroom in the envelope is genuinely spent. The failsafe default is sound as a rule about the governed system, because uncertainty should round toward restriction when an action that should not have run costs more than one that had to wait. It does not transfer to the machinery doing the assessing. An unverified forecaster is an unverified instrument rather than an uncertain reading of the world, and one that pulls authority back is asserting knowledge it does not have in the direction hardest to argue with. The damage lands on the operator, because a governor that restricts clean runs on an unearned forecast teaches the people around it to read restriction as noise, and safety machinery that fires without a basis gets its margins widened, then its bounds relaxed, and eventually gets switched off. A prediction earns nothing at the moment it is made. It earns when it closes, once the span runs out and realized behavior is compared against what was projected. Until the first horizon closes, the anticipatory term holds no authority over the grant.

A Reading Has an Age (September 16). The reading in front of the governor describes the system at the moment it was measured, which is always earlier than the moment the grant is set, and how much earlier is an input most pipelines discard before the governor ever sees the value. The delay stops being small without announcing it. A collector restarts, a queue backs up, a source hangs, and the layers in between keep answering, because telemetry infrastructure is built to keep displays whole. Last-known-good substitution. Sample-and-hold. A cache serving the newest value it has. Each hands a control a number that looks current and is not, and the value sits inside the declared envelope because the last time anyone measured, it did. An absent reading is a known state with a declared failsafe grant behind it. A frozen reading is a present state that happens to be wrong, and it passes every check an absent one fails. A repeated value does not move, so every assessment that reads movement reads a system sitting exactly on its assured trajectory. Trust computed on it climbs and stays up. The forward look projects a flat line and finds nothing coming. The two parts of a governor that would lower authority are disarmed by the same fault, and the grant settles at the widest the envelope admits for exactly the interval in which nobody knows what the system is doing. The remedy is to carry the age with the value from the moment of measurement, as a source timestamp with declared tolerated skew or a sequence counter that marks a repeat when it fails to advance. A value with no age is treated as old. The forward look has to cover the age at arrival, plus the time to decide, plus the duration of the action, and the first term is the only one that grows without limit when a feed freezes.

Quickly Enough(September 18). Spain's data protection authority, the AEPD, published the first breach notification it has received for an attack executed by an AI agent. A person chose the target and started the tool. The agent searched generic files for weaknesses and logged in, explored the application until it found a flaw, then modified personal data and opened invoices. The agency reads no trend into a single case and asked for human supervision supported by detection, containment and response mechanisms capable of operating quickly enough. Quickly enough has a reference point, and against an agent it is not a shift, a queue or a page. It is the next action. Detection measured against a clock is racing a loop that never stops to read. A control in the path of the action is measured against something else entirely, because the next action cannot start until the control has set what it may do. The login succeeded, so the check that answers who had already said yes. A session that logs in and then probes the application has left the trajectory its account was provisioned for before it writes anything, and a governor sets authority per action on that divergence. Read by an identity check the session is trusted. A governor with a forward look can grant it less authority on the write anyway, because it caught the divergence before the write landed.

What changed.

Friday's piece is the anchor, and the part that extends it is the guidance the AEPD had already published before the incident arrived. On February 18, 2026 the agency issued its guidance on agentic artificial intelligence from a data protection perspective, and the rule at its center is a counting rule. An agent should not combine processing uncontrolled input, accessing sensitive information, and taking autonomous action. No more than two of the three. The breach notified on September 14 carried all three at once, so the agency's threat model held before it had a case to test it on.

That rule is a real constraint and it operates at a particular time. It is checked when a deployment is configured, and it answers a question about the shape of the system. It does not answer what the agent may do on step four thousand of a run whose configuration was correct on the day it shipped.

The reason that matters is that the three conditions are not all fixed at deployment. Access to sensitive data is provisioned and reviewable. Autonomous action is a design choice and inspectable. Uncontrolled input arrives during the run, as a retrieved document, a fetched page, a tool response, a message from another agent. An agent that starts the run holding two of the three can be holding all three by the fourth step without any change to its configuration, and nothing in a design-time check fires when it does. The count moves per action, which is the cadence a runtime control works at and not the cadence a configuration review works at.

The rest of the calendar is compressed. Colorado's revised rulemaking draft on automated decision-making technology is due on or before September 23, with the written window running to the October 26 hearing and the statute effective January 1, 2027. The NAIC's AI Risk Evaluation Supplement version 5.0, exposed August 31, closes comments September 29. California SB 947 remains unsigned with the Governor's window closing September 30 and an operative date of July 1, 2027. SR 26-2 has been in force since April 17, generative and agentic AI are outside its scope, and the interagency request for information it promised has not issued five months on. The EU moved the AI Act high-risk obligations to December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744.

What we are tracking.

Three windows close inside ten days. The Colorado draft on September 23, the insurance supplement on September 29, the California signature on September 30. Each one asks a deploying organization to describe a capability it has, and each one is answered from a document. None of them asks what held at the instant between an output and its effect, which is the only interval in which anything can still be prevented.

The standards track, and what it is built to serve. The IETF effort on auditing autonomous agents lists its deliverables as data models for interaction records, agent identity, delegation context and authorization state, along with protocol extensions to carry that information between domains. Those are the right objects, and the charter is explicit that the group will not define policy. A record format standardizes what somebody reads afterward. Nothing in the deliverable list sets the authority of the next action, so what is being made interoperable is the description of agent behavior rather than a limit on it. Both are needed and they are not substitutes, and the distinction is easiest to hold while the data model is still in draft.

The field on the public dockets is crowded, and that is the honest read. The NIST agent docket and the NHTSA comment backlogs now carry several independent submissions converging on authority boundaries, delegation state, and the observation that a well-governed system and an ungoverned one look identical from the outside when nothing records what authority was in force. Several of those arrived within weeks of each other from parties with no connection. Convergence at that density is easy to misread as borrowing, and checked against dated artifacts it is usually a field reaching the same observation at the same time, which is what happens when the observation is available to anyone building the same thing. The argument is becoming common property. What separates a position is a measurement somebody else can rerun, because an argument can be reused without citing anyone and a measurement cannot.

All three pieces this week land on the same requirement. The governor decides one thing, whether the next action carries authority, and it decides it in advance of the action on evidence that is already old. It can grant less authority on a decision whose trust reads higher, because its forward look caught a divergence coming before the outcome landed. That grant is only worth what the governor can establish at the instant it writes it, which is why the age of the reading, the track record of the forecast, and the pace of the loop are all one question.