Half the Operations

On August 9, 2026 the United Arab Emirates opened the strategic phase of its National Agentic AI Project. The stated target is to convert fifty percent of federal government operations, services and tasks to agentic AI models within two years. Seven areas are named, among them policy development, governance, and government performance. The guiding principle is stated as human leads, AI enables.

More than a hundred federal officials attended the launch workshop, which covered implementation timelines, a classification of tasks, and coordination across federal entities.

Nearly every agentic-AI governance event of the past year attached a duty to agents someone had already decided to run. This one decides to run them. At sovereign scale, on a clock.

A deployment target is a different instrument.

A rule creates an obligation on a system that already exists. A target creates the systems.

That difference decides what has to be built and by when. A disclosure rule is answered with a change to an interface. A registration regime is answered with a filing. A conversion target covering half of federal operations, services and tasks inside two years is answered by agents taking the actions of a state. A permit issued. A benefit adjudicated. A procurement routed. A case assigned. A record amended.

The target is precise about how many. It is silent about how far each action may reach. That second quantity is the governance question, and no percentage fixes it.

Half of operations, counted in actions.

Operations is a category. An action is a particular that falls inside it.

A share of operations converted resolves into a rate of individual acts per day taken by a system rather than by a person. Each one lands somewhere specific. A resident's file. A supplier's payment. An input a later decision rests on. Aggregate targets are set in percentages and discharged one act at a time.

Policy development and decision support sit inside the named areas, and they are the harder case. An agent assembling a fact base for a policy is not producing a keystroke. It is producing the material a human decision will stand on, which means the authority question reaches the agent's action even where a person signs at the end.

Human leads, at agent density.

Human leads, AI enables is the right principle, and it is stated at the right altitude. The two-year clock forces the second question. What leading means when the led system acts thousands of times inside a single run.

Leading is an authority relation, not an attendance requirement. A supervisor leads a workforce without observing every act. What makes it leadership rather than a title is that the limits the supervisor sets hold while the supervisor is elsewhere, and that exceeding them is not something the workforce can simply elect to do.

Review does not scale to this. A person who approves every agent action becomes the throughput ceiling of the government, which defeats the conversion the target exists to produce. A person who approves none holds a principle with no mechanism under it. What scales is not the review. It is the bound. A human sets how much authority a class of action may carry. A control in the path of every action holds that grant when no one is watching.

The control that carries the principle into the action.

Once an operation is converted, an act of a public body is taken by a system. The thing that carries human leads into that act is a control sitting between the agent's decision and the effect, setting how much authority the action may carry against an envelope the accountable body declared before the run.

That control reads one quantity. How far realized behavior is diverging from the trajectory the agent was assured to hold. It sets the grant on where the action is heading rather than only on how clean the present step looks. It can grant less authority on an action whose present trust reads higher, because its forward look caught a divergence before the outcome landed. When the forward look has not resolved before the action's own deadline, the grant gets smaller, not larger.

The grant has to be a construction rather than a request. If the agent can reach the effect by a route the control does not sit on, the bound is advisory, and advisory bounds fail in precisely the cases that needed them. Put the control on the only path to the effect and the agent's latitude is exactly what was granted, because there is no path to more.

The declaring party and the deploying party.

A sovereign program puts the party that declares the envelope and the party that runs the agents under one roof. That is workable, and it is workable only if the declaration is separated from the run.

An envelope the acting system can move is not an envelope. It has to be declared before the run, held outside the acting process, and not rewritable by the agent or by the operator under delivery pressure. The public body that owns the outcome sets what its agents may do. The vendor supplying the agent does not set it. Neither does the agent.

Two years is the number to watch. It is long enough to build the control into the conversion and short enough that a program which defers it will convert first and govern second. A control installed after the fleet is running has to be retrofitted into paths that were designed without it, which is the expensive order. Installed with the conversion, the same control gives the government a plain answer for any action a resident or an auditor asks about. What the agent proposed, what it was granted, and why the grant was what it was.

What we are building.

Velma is a runtime governor. It sits in the execution path, ahead of the actuator, and sets how much authority each action carries against a declared safety envelope. It narrows that grant as the run proceeds, when realized behavior diverges from the assured trajectory, and it enforces the grant in the path, so the system acts only inside what was granted and cannot reach the effect another way. It governs the learning event as well as the decision, admitting or refusing a change against the declared bound. Every action it governs is sealed to a tamper-evident record as it happens, which is the evidence a public body will be asked for. The governor is the product. The record is what it emits.