Subtraction Does Not Reopen the Case

A governor sets how much authority the next action carries, and it can only set that number at or below the authority the system already held. A control that can only take authority away removes outcomes and introduces none.

Adding it to a certified system reopens nothing, because it permits nothing the system was not already cleared to do.

Why the path runs empty.

A certified system is one someone argued was acceptably safe, in a stated context, and then fielded. The argument was checked once, against the behavior the system could produce, and it holds as long as that behavior holds. Insert a new component anywhere on the path an action takes to the actuator and the behavior is no longer the behavior that was checked. The component can change what the system does, so the argument that covered the old system does not cover the new one, and the assessor has to look again.

Looking again costs a schedule and a budget. A reopened case is evidence regathered, a submission reworked, a sign-off that has to come back around before the system can ship. The rational response, for a team under cost and schedule, is to add nothing. So the model runs straight through to the actuator with no control between them, not because no one wanted a control, but because the control would have cost more than the exposure it removed. The empty path is a decision about recertification, not about safety.

EU AI Act Article 9 asks for a risk management system that is a continuous iterative process run across the lifecycle of a high-risk system and kept current, which means the reference is expected to change and every material change reopens the argument. Those obligations apply from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744, and the embedded date is the one that lands on functional safety practice. The FDA's Predetermined Change Control Plan is the closest any current instrument comes to easing the tax, because it lets a manufacturer describe modifications in advance and a protocol authorize them, so a change accepted once does not demand a submission from scratch each time it runs.

What makes an assessor look again.

The question an assessor asks about anything added to a fielded system is narrow. Can the thing you added produce an outcome the case did not already account for. A component that can raise a limit, enable an action the system could not take before, or widen the set of things that reach the actuator has to be argued, because the hazards it opens were never in the original analysis. The burden is real and it is correct. A new behavior is a new thing to be safe about.

That burden attaches to additions. It does not attach to removals in the same way. A control that can only narrow what the system does produces no outcome that was not already possible before it was installed. There is no new behavior to analyze, because every behavior that survives the control is one the case already examined.

The grant lands inside what was already allowed.

A governor sets, for each action, how much authority that action carries. It starts from withheld and grants upward only as far as it can assure, and the ceiling it grants against is the authority the system already held for that action. It can land anywhere from nothing up to that ceiling. It cannot land above it. The grant is bounded above by what was already permitted, by construction, on every action.

So the set of actions a governed system can take is a subset of the set it could take before the governor was there. Every action the governor lets through is an action the certified system was already cleared to take. The actions it stops are the only difference, and a stopped action reaches the actuator the way every withheld action does, which is not at all. The governor moves the system strictly inward from the boundary the case drew. It never moves the boundary.

A subset does not break the argument.

An argument that a system is acceptably safe is an argument about everything the system can do. If it held for the full set of behaviors, it holds for any part of that set, because removing a behavior cannot introduce a hazard the argument did not already cover. The governed system does less than the certified system. Doing less is not a change the argument has to absorb.

That is the whole claim. A control that can only take authority away is the one thing you can add to a certified system without arguing it again. It can be placed in the action path of a system signed off without it, and the signed case stays valid as written, because the system now does a subset of what the case already permitted. The periodic review examines the governor as a control, the way it examines any control in the path. The fielded argument does not have to be reopened to install it.

SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope, and the interagency request for information it promised on those systems has still not issued. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement with comments closed September 29, 2026, a further exposure in October, and a later version targeted for the Fall National Meeting in November. Each of these asks a deployer to describe the governance it runs. None asks whether a control added to a fielded system reopens the case, which is the question that decides whether the control gets added at all.

The caveat that keeps the claim honest.

The property depends entirely on the control staying subtractive. A governor configured so that it can grant more than the system already held, raise a ceiling or enable an action the system could not take, is no longer only removing behavior. It has added an outcome, and the moment it can add an outcome the argument has to be made again against whatever it now permits. The no-reopening claim is a claim about the default, where the governor can only take away.

State it that way and it survives contact with an assessor. A control that strictly narrows is additive and reopens nothing. A control that can also widen is a new component in the hazard argument and has to be treated as one. The line between the two is not a matter of degree. It is whether the grant can ever exceed the authority that was already there.

The strongest thing the governor does is still a subtraction. It can grant less authority on an action whose present trust reads higher, because its forward look caught a divergence coming before the outcome landed. Higher trust, less authority, because it anticipated. That is the governor's sharpest intervention, pulling authority back on a run that looks clean right now because of where the next step is heading, and even that move lands inside the boundary the case already drew. Anticipation narrows. It does not widen. The governor's most counterintuitive act costs the certification nothing, because like every other grant it is bounded above by what was already allowed.

What we are building.

Wayfinder Systems Group is building one answer to the substrate question. A runtime governance layer that modulates how much authority a system is granted on every action against a declared envelope, and enforces that grant in the path to the actuator, so the system acts only inside what the governor allows and through a path it cannot step around. The grant is bounded above by the authority the system already held, which is what lets the layer sit in front of a certified system without reopening the case. It signs what it decided as it goes, and that record is the evidence, read after the fact by whoever has to read it. We call her Velma.