Field notes, week of October 25, 2026

A governor sets how much authority the next action carries, and this week took the question one layer down, to where that authority comes from. Three pieces asked what, in the path of an action, actually bounds how much an autonomous agent is allowed to do, and set three familiar answers against the control that does the bounding. The authority is set at the actuator, on the effect the action would have, against a bound declared before the run, and none of the three stand-ins sits there.

Authority is set at the actuator, on the action's own effect, against a bound declared before the run. A grant passed down a chain, a model opened for inspection, and a practice written into a document each sit somewhere else. The governor sits in the path.

This week.

Authority Does Not Delegate (October 19). An autonomous agent seldom acts alone. It calls a tool, hands a step to a sub-agent, and that one calls another, until an action reaches an actuator several hops from the agent that began the run. The authority that action carries is not a grant handed down the chain. A runtime governor sets it at the actuator, on what the action would do and where the run is heading, no matter who proposed it. A chain of ten agents and one actuator is still one actuator, and the depth of the chain is a fact about how the work was organized rather than a fact about the effect, which is the same size whether one agent reached it or six handed it along. The familiar way to bound a delegated action is a scoped grant drawn up front and passed from a holder to whatever it calls, which says the holder may touch a class of resource and never says how much this action, the one about to land, is allowed to do given where the run has gone. A sub-agent holding a scope inherited from its caller has inherited a permission, and permitted is not granted. A long chain, with more places the run could have turned, is read as more uncertain rather than more trustworthy, and when the forward look is uncertain the grant falls rather than rises.

The Governor Never Opens the Model(October 21). A runtime governor bounds how much authority an AI action carries without opening the model that proposed it. It reads two things, and neither is inside the model. What the action would do at the actuator, in the units the actuator acts on. How far the run's realized behavior has drifted from the trajectory the system was assured to follow. The weights, the architecture, and the training data are not inputs to the grant, so the governor grades the action rather than the mind that chose it. This matters now because the model is increasingly not the deployer's to open. A frontier model reached through an interface exposes no weights, a third-party agent ships as a service, and a model retrained on a provider's own cadence is a different model each quarter. A control that has to read the model cannot govern any of these. A control that reads the action governs all of them, because the actuator does not move when the provider swaps the model, and the governor grades the new version the same way it graded the old one, having never read either. Opening the model fully would explain the action and would not bound it, because interpretability is evidence about a decision and not authority over one.

Good Practice Is Not a Control(October 23). On October 19 the United Kingdom's Financial Conduct Authority published AI in financial services: good practice and areas for improvement, a document built from its supervisory work and its own testing, with around twenty short case studies, no new rules, and no single governance model prescribed. What satisfies an accountability control for an autonomous agent is a runtime governor, a control that sits in the path every action takes to the actuator and sets how much authority that action is granted before it runs, against a bound declared before the run by someone who is not the agent. A practice is a statement about how a firm intends to behave. A control is a thing in the path that acts. A described practice is tested once, when it is written, and a control in the path is tested on every action, by what it refuses when it is present and what gets through when it is absent. The regulator named delegated authority and execution as the open questions for agentic finance, and the authority an action carries is not a grant handed down the chain but one set fresh at the actuator on the action's own effect.

What changed.

Friday's piece is the anchor and the Financial Conduct Authority is the event. On October 19 the regulator published its review of AI in financial services, a set of good and poor practice examples drawn from its supervisory work and its own testing and organized around three areas: consumer outcomes and vulnerable customers, governance and accountability, and operational resilience. The examples create no new requirements, prescribe no single governance model, and leave each firm responsible for what is appropriate and proportionate to its own use, risk, and potential impact. The regulator was explicit that the material is not static and will be updated as the technology moves.

The diagnosis is sound and the form is the limit. A good practice example is a description of a governance a firm intends to run, and a description is tested once, when it is written. It cannot speak to the action that ran four hops into a chain nobody watched, because it was written before that action existed and names no bound the action had to clear. A runtime governor speaks to exactly that action. It reads what the action would do at the actuator and how far the run has diverged from the trajectory it was assured to follow, and it sets the authority the action carries before the step lands. This is the control Wayfinder Systems Group builds. It sits above control and below intelligence. It observes, assesses, modulates, enforces, and signs the record. The regulator itself named delegated authority and execution as the open questions for agentic finance, which is the question the governor was built to answer. What, in the path of the action, actually bounds how much the agent is allowed to do.

The regulator sits beside the instruments the week already carried. EU AI Act Article 14 asks that a high-risk system be designed so the people assigned oversight can monitor, override, or interrupt it, with high-risk obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744. SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope and the interagency request for information it promised still not issued. Each asks a firm to describe the governance it runs. None asks whether that governance is a practice a document describes or a control in the path of the action.

What we are tracking.

Two dates fall inside the coming weeks. Colorado holds its public hearing on the revised rules under the Automated Decision-Making Technology Act, 4 CCR 904-6, on October 26 in Denver and by videoconference, with written comments open through the hearing and the statute effective January 1, 2027. An interim redline posted October 6 changed several provisions from the August draft, so a plan built on the earlier text has to be rechecked. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement, with a dozen state insurance departments piloting it and a later version targeted for the Fall National Meeting in November.

A third window closes next month. The United Kingdom's data protection authority opened a call for evidence on the data-protection risks of agentic AI on October 8, and it runs until November 20, its scrutiny now reaching agents that act on their own. The pattern across all of them holds. Each instrument names a person on the far side of a decision the system should not make alone, or a governance a firm must describe. The thing none of them names is the control that decides, before the action, how much authority the system carries into the decision at all.

The three pieces land on the same split. A delegation chain, a model, and a practice document are all places governance is imagined to live. The authority an action carries is set in only one place, at the actuator, on the effect, against a bound declared before the run, and from that position the governor can grant less authority on an action whose present trust reads higher, because its forward look caught the run turning before the step landed.