Optimized to Allow

A governor sets how much authority each action carries against a declared envelope it cannot rewrite. Because the bound is fixed outside the run, the grant has nothing to optimize toward when the pressure is to stop getting in the way. A control without that fixed bound has somewhere to drift, and the direction it drifts is open.

The pressure to loosen a safety control is constant and points one way. Where it comes from is most of why so many controls end up approving the action they were installed to stop.

Two mistakes, two very different bills.

A control standing in front of an action can be wrong in two ways. It can stop an action that would have been fine. It can pass an action that breaches the envelope.

The first mistake bills immediately. A legitimate task stalls. Someone escalates, and a ticket gets filed asking why the tool blocked a clean request. The operator feels it the same day, and the person who tuned the control hears about it.

The second mistake bills later. The breached action runs, the effect lands, and the cost surfaces when the outcome does, sometimes long after, and often on someone other than the operator. Between the action and the bill there is a gap, and in that gap the control looks like it is working.

Optimizing the felt cost rounds the grant open.

Put those two bills in front of anyone tuning a control and the incentive is plain. Every false stop is a complaint today. Every missed bound is a risk that may never surface, and if it does, it surfaces on a different desk. A control tuned to reduce the friction it is blamed for widens its grants, because widening removes the cost that is felt and defers the cost that is not.

This is how a safety layer measured on staying out of the way drifts toward permissiveness with no one choosing to. No one decides to approve the dangerous action. The control is adjusted, once, to clear a legitimate case it stopped. Then again. Each adjustment is reasonable in isolation, and the sum is a control whose resting grant has climbed until it clears the case it exists to catch. A control optimized against the cost it is blamed for will, given enough time, approve the action nobody wanted it to approve.

The governor has nowhere to drift.

The governor sets the grant against a declared safety envelope. The envelope is fixed before the run, held outside the acting process, and not rewritable by the run or by the operator feeling the friction. The grant for an action is the authority that envelope supports for where the action is heading, and that reference does not move when a legitimate case gets stopped.

So the pressure that opens an ordinary control has no lever on the governor. Getting out of the way is not a value the grant can be tuned toward. The grant is set against the bound, and friction is not one of its inputs. The only party who can widen the bound is the party who declared it, not the operator who wants the ticket cleared. A legitimate case the envelope stopped is a reason to take the envelope back to the accountable party, on the record, not a dial the operator quietly turns.

The withheld default is the asymmetry, written down.

The governor starts each action from least authority and grants up only what it can positively support. That default is the error-cost asymmetry encoded in the resting state. The expensive mistake is the missed bound, so the resting position is the one that cannot make it, and authority is added only where the forward read establishes there is room.

A control that starts open and subtracts on a recognized problem encodes the opposite bet. It treats the false stop as the expensive mistake and pays that cost down by leaving the other exposed. The starting position already says which mistake the control was built to avoid, and only one of the two lands on someone who never saw the action.

Pressure is the real test.

How tight a control is on the day it ships is the wrong measure. The measure that matters is what happens to it under a quarter of steady pressure to stop blocking legitimate work. A safety property a control can optimize away holds for exactly as long as no one is optimizing.

The governor answers that test with what it cannot do. It cannot move its own bound. It cannot grant authority the envelope does not support to clear a case that is waiting. The reference it grades against belongs to the accountable party, and the record shows the grant it set and the bound it set it against. What holds the line is the part of the control the pressure cannot reach.

What we are building.

Velma is a runtime governor. It sits in the execution path, below the model that decides and above the actuator that commits, and sets how much authority each action carries against a declared safety envelope. The envelope is held outside the run and cannot be rewritten by the system under governance, so the grant cannot be tuned open to reduce friction. It starts each action from least authority and grants up only what the forward read of the trajectory supports, which puts the expensive mistake, the missed bound, out of reach of the resting state. Widening the bound is a decision the accountable party makes, on the record, not a dial the operator turns. Each decision the governor sets is sealed to a tamper-evident record as it happens. The governor is the product. The record is what it emits.