Field notes, week of September 27, 2026

A governor sets how much authority the next action carries. It computes that number at runtime, and everything the number means was fixed earlier, outside the run, by parties who are not the agent. This week took three of those declarations.

A bound discovered at the moment of the decision is a setting. A bound named before the run is a reference the grant can cite.

This week.

The Envelope Changed Mid-Run(September 21). The bound a governor modulates against lives in a document somebody maintains, on a change schedule that has nothing to do with the run, and runs are not always short. An agent working a claims queue runs for a shift. A remediation job runs until it finishes or is stopped. An autonomous system operates across a deployment window measured in days. Over any of those intervals the envelope becomes a file with a history, and edits are ordinary: a bound corrected after an incident review, an action class added because the integration grew, a ceiling raised after a quarter with no exceptions. Direction decides what the edit costs. A bound that tightens mid-run moves the grant toward restriction, the run may not finish, and that is the cost the failsafe default exists to pay. A bound that widens mid-run is an authority-raising event, and since authority inside a run falls on divergence and does not climb back on the agent's own signal, the envelope edit is the one path by which authority rises while the run is open. Two ordinary implementations differ invisibly in the code that computes the grant. Read the envelope once at run start and hold it for the duration, or read it per action from a store another process is free to write. That choice decides whether an edit saved at one moment governs the action taken a second later, and it belongs with the envelope rather than in the implementation. When the governor cannot establish which version covers the action, it grants the failsafe declared for that action class rather than the wider of the two candidates, because uncertainty about the reference rounds the same direction as uncertainty about the measurement. An envelope the operator can widen while their own run is being restricted is a setting, so the party that declares the bound and the party that owns the run finishing have to be different parties.

The Band Is Not the Decision (September 23). A governor answers two questions about the next action and they are different kinds of question. Whether the action is granted at all, which is binary and always defined. How much reach it carries if it is, which is continuous and governs behavior only when the decision granted. Most enforcement layers publish both as a single ladder of severity labels, and four rungs imply three boundaries that carry consequence when one of them does. Two labels above the cut produce identical behavior at the boundary where it matters, since an action labeled approve and an action labeled constrain at the same magnitude reach the actuator the same way. Below the cut every withheld action has the same effect, and how far below it fell describes the assessment rather than the outcome. There is a third answer and no point on the continuum can express it, which is the governor withholding the action and handing it to a person, because the class of action is one a person is required to authorize. The tell is that this answer can be issued at high authority on a system reading clean in every respect, so the authority the governor computed and the decision it returned point in opposite directions. A ladder that files that answer between restrict and block turns escalations into near-blocks, and a queue that needs to be staffed reads on a dashboard as a system trending toward failure. Band edges move when a report is hard to read, the edit is treated as presentation, and every consumer that branched on the name then behaves differently at a magnitude the governor is handling exactly as it did yesterday.

Who the Governor Hands It To(September 25). On September 23 the Colorado Department of Law posted its revised proposed rules under the Automated Decision-Making Technology Act, and the rules specify the human reviewer in more detail than they specify the system being reviewed. The rules are 4 CCR 904-6, filed August 11, 2026, implementing SB 26-189 and the Conversational Artificial Intelligence Services Act, HB 26-1263, with a formal hearing October 26 in Denver and by videoconference, comments on the revisions due October 5, and the statute taking effect January 1, 2027 whether or not the rulemaking has closed. Rule 7.7 governs meaningful human review of an adverse outcome and describes the reviewer as a set of properties. Independent of the original decision. Competent commensurate with the consequences. Trained on what the system considered and on the output's intended use and material limitations. Shielded from steering and from retaliation. Holding authority to overturn. Barred from using any covered automated system in conducting the review. Every one of those properties is checkable before any particular decision arrives and none is checkable from inside the request, because independence is a fact about an organizational chart and training is a fact about a record somebody maintains. So the party who receives a decision the system was not allowed to make has to be named before the run, in the same place and with the same standing as the bound the system is governed against. And before any adverse outcome exists, something already decided that this particular decision would be made by the system rather than by a person. That selection is itself an automated decision, it materially influences a consequential decision, it runs earlier than every obligation the rule names, and it is the only step in the sequence no part of the rule reaches.

What changed.

Friday's piece is the anchor and the week extended it twice, in two other jurisdictions, with the same structure. California SB 947 passed the legislature on August 31, 2026 and sits unsigned with the Governor's window closing September 30. Where an employer relies primarily on an automated decision system for discipline or termination, the bill requires a human reviewer to corroborate the decision using relevant supporting information and a post-use notice to the affected employee, operative July 1, 2027. EU AI Act Article 14 asks that high-risk systems be designed so the persons assigned oversight can decide not to use the system, disregard, override or reverse its output, and intervene or interrupt operation, with those obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744.

Three instruments, three jurisdictions, one shape. Each specifies the person on the far side of a decision the system should not have made on its own. Colorado specifies that person's independence, competence, training and protection from steering. California specifies that the person corroborate rather than approve on sight, and that the subject be told afterward. The EU specifies the capabilities the design has to leave that person. None of the three specifies the control that decides which decisions reach the person at all.

That gap follows from when each instrument operates. A reviewer's properties are facts about an organization, checkable on a schedule measured in quarters. Colorado's clock for the reviewer is measured in days because it describes a consumer appeal, ten to acknowledge and forty-five to complete. The selection is made in the interval between one action and the next. An obligation written at the cadence of an appeal cannot reach a decision made at the cadence of a loop, and every one of these instruments is answered from a document describing a capability the deployer has.

The rest of the calendar is compressed. The NAIC's AI Risk Evaluation Supplement version 5.0, exposed August 31 and the first version published under that name, closes comments September 29, with twelve state insurance departments piloting it in market conduct examinations, financial examinations and as a standalone questionnaire. SR 26-2 has been in force since April 17, generative and agentic AI are placed outside its scope, and the interagency request for information it promised on those systems has not issued five months on. The one instrument written to reach agentic systems is the one that does not yet exist.

What we are tracking.

Two windows close inside four days. The insurance supplement on September 29 and the California signature on September 30, with the Colorado revision comments following on October 5 and the hearing on October 26. Each of them asks a deploying organization to describe a capability, and a description is answered once. The selection of which decisions a system makes on its own is answered on every action, so none of these windows closing changes what holds in the interval where anything can still be prevented.

The convergence on the human reviewer is now four instruments deep and it reads as a signal about where the obligation is heading. Regulators have concluded that the answer to an automated adverse outcome is a person with standing. That conclusion is sound and it creates a load nobody has sized, because a rule that routes decisions to people without bounding how many decisions get routed produces either a queue that cannot be staffed or a reviewer who approves at volume. A governor that returns three answers rather than two is the thing that sizes that load, since the reduced-authority pass between granting in full and withholding is the case where the action proceeds inside a narrower bound and no person is needed.

An enforcement point in the path of the action is a bound only while it is running, and that is a property to establish rather than assume. A control that sits before the actuator has to be shown to hold by what gets refused when it is present, and it has to be shown to leave no restored route when it is absent. Those are two separate measurements and the second is the one commonly skipped, because a system that passes every test while the control is up says nothing about the path that opens when the control goes down. Interposition that survives only the presence of the interposer is an availability dependency. A safety case needs the other measurement, and it is the kind of claim a certification reader will ask to see executed rather than argued.

All three pieces this week land on the same requirement. The governor computes one number at runtime and that number is worth exactly what the declarations behind it can establish. The governor grants less authority on an action whose envelope just got wider, because it could not establish that the wider bound was in force when the action was committed. The version of the bound, the threshold the magnitude was cut against, and the party a withheld action goes to are all declared before the run by parties who are not the agent, and a grant that cannot name them is a number with no referent.