Intent Is Not the Input

A governor sets how much authority the next action carries. It computes that grant from one thing, which is what the action would do at the point it becomes real.

The request that carried the action, and whatever purpose a reader would assign to it, are not in that computation.

Two readings of one action.

Every agent action arrives twice. It arrives as a request, a block of text and structured fields describing what the agent wants to do and, often, why. It arrives again as an effect, the change the action would make at the actuator if it ran. A transfer of a given size. A write to a given scope. A message to a given recipient. A setpoint moved a given distance.

A control can read either one. Most of the security and safety layer shipping for agents reads the request. It runs a classifier over the text, infers a purpose, and sorts the action into a category. Benign. Suspicious. Disallowed. The category is a statement about what the action appears to be for.

A governor reads the effect. It sets how much authority the action carries from what the action would do, measured in the action's own units, at the one place the action turns into a durable change in the world.

Intent is a reading. Effect is a property.

Intent is not in the action. It is assigned to the request by whatever reads it, and a reading can be wrong in both directions. A request worded plainly can carry an effect far outside the bound. A request that reads alarming can carry an effect well inside it. Intent is a reading someone assigns to the request. The effect is a property of the action in the world.

An adversary writes to the reader. The whole craft of getting a disallowed action past an intent classifier is phrasing the request so the purpose it infers is the wrong one, with the action underneath unchanged. Nothing about the effect moved. Only the reading did.

The effect does not care how the request was phrased. A transfer of a given size moves the same money whether the memo line is honest, blank, or crafted to look routine. Reading the effect takes the phrasing out of the loop, because the quantity the governor bounds is the quantity the actuator would act on.

What the governor measures.

The governor's input is the effect the action would have, denominated where the action lands. It does not need the purpose, and it does not ask for it. The grant is a ceiling on that effect, and nothing in the request can lift it.

The forward look extends the same reading in time. The governor grades the effect of the step in front of it and the effect the run is converging on, and it can grant less authority on an action whose present trust reads higher, because its forward look caught the effect turning before the step landed.

A reading of intent has no equivalent move. A classifier that cleared the request has said what the action is for. It has said nothing about where a sequence of such actions is heading, because purpose is assigned one request at a time and the trajectory sits in no single request.

Why the input decides what gets through.

A control keyed on intent fails on one action in particular, the one whose purpose it read wrong. That action clears the classifier, reaches the actuator, and lands an effect outside the bound. Every instrument reports a clean pass, because the only thing checked was the reading, and the reading was wrong.

A control keyed on effect has no such action. It did not consult the purpose, so a misread purpose cannot admit anything. The action is bounded by what it would do, and an action that would breach the envelope is cut to the grant or withheld whether its wording was honest or engineered.

The two controls can stand in the same path and agree on almost every action. They part on the action built to be misread, and that is the action that matters, because it is the one assembled, by an adversary or by accident, to look like something it is not.

What the rule asks, and what it leaves open.

EU AI Act Article 14 asks that a high-risk system be designed so the people assigned oversight can understand it, monitor it, and override or interrupt it, and Article 15 asks for accuracy and robustness held across the lifecycle, with high-risk obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744. SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope and the interagency request for information it promised still not issued. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement, with a later version targeted for the Fall National Meeting in November.

Each asks a deployer to describe the controls it runs and the oversight it keeps. None asks the question that decides what those controls can catch, which is whether the control reads what the action would do or a guess at what it is for.

What we are building.

Wayfinder Systems Group builds a runtime governor that sits above the control and below the model. It reads the effect each action would have at the actuator, sets how much authority the action carries against an envelope declared before the run, and holds that bound in the path, so the only thing that reaches the actuator is the action already cut to the grant. It grades where the run is heading, not only how clean the step looks now. The sealed record it emits is the evidence, read after the fact. We call her Velma.