The Burden of Assurance

A governor sets how much authority the next action carries. It does not hand the action full authority and pull some back when a signal trips. It starts from withheld and grants only what its forward look can positively assure against the declared envelope.

The direction of that default is the whole safety property. A control that grants by default and subtracts on a recognized problem is bounded only against the problems it already recognizes. A control that withholds by default and grants on assurance is bounded against the case no one named.

Two directions for one default.

Every control that governs an action has a resting state. It is the authority the action carries before the control has read anything specific about it. There are two ways to set that resting state, and they are not close together.

One is to permit by default and take authority away when the action matches something the control was built to catch. The other is to withhold by default and add authority only when the action clears a positive check. The first is a deny-list on authority. The second is an allow-list.

On a normal action the two look identical. The difference shows up on the action the control was never taught about, and that is the action governance exists for.

A signal you did not get is not a signal you passed.

Most agent controls shipping today are classifiers. A prompt-injection detector. A tool-poisoning scanner. A content filter on the output. Each reads the action, checks it against the patterns it already knows, and lets it through when nothing matches. Silence from the classifier gets read as clearance.

The action that matters is the one outside the classifier's training. The novel tool call. The injected goal pursued with valid credentials. The input the certification never saw. On that action the classifier is not reporting that the action is safe. It is reporting that it has nothing to say. A default that reads that silence as a grant has widened authority at the exact moment it had the least basis to.

Absence of a bad signal is not assurance. It is absence of information, and a governor treats the two as opposites.

The burden sits on the assurance.

Under a governor, an action does not carry authority because nothing objected. It carries the authority the governor granted, and the governor grants against a positive read of where the action is heading relative to the declared envelope. When that read is thin, the grant is small. Not because the action is suspect, but because nothing yet establishes that it is safe.

This inverts where the burden lands. A deny-list puts the burden on the control to establish that an action is bad before it constrains it, and every action it has not yet convicted runs at full latitude. A governor puts the burden on the action to earn its authority, and an action that cannot yet be assured runs at reduced latitude until it can. The unproven action is the common case, so the direction of that burden sets the posture of the whole system.

Uncertainty rounds down.

Assurance can be thin for reasons that have nothing to do with an attack. A telemetry stream drops. The situation is one the envelope never anticipated. The forward look has not resolved before the action's deadline arrives. In each of these the governor is not reading evidence of divergence. It is reading an absence of evidence either way.

The rule in that case is a single direction. The governor grants less, not more. A clean present does not change it. The governor can withhold authority a step has not earned, because looking clean right now is not the same as being assured where the step is heading. Least authority is the resting state the action returns to whenever the basis for more has gone missing.

Least authority is a default, not an exception.

Security engineering settled this argument for access a long time ago. Least privilege and fail-safe defaults say a component gets the minimum it needs, and that a control which cannot decide fails toward denial rather than toward access. The agent version moves the same principle from access to authority, and from a setting fixed at provisioning to a value re-set on every action.

A permission set is the opposite arrangement. It is a standing grant, drawn once, that persists through every uncertainty that follows until someone revokes it. The agent keeps its full permitted latitude through the dropped signal, the novel situation, the unresolved forward look. Authority under a governor is re-earned each step and returns to withheld the moment the basis for more thins out. One is a grant you have to lose before it stops applying. The other is a grant that has to be made before it applies at all.

What we are building.

Velma is a runtime governor. It sits in the execution path, before the actuator, and sets how much authority each action carries against a declared safety envelope. It defaults that authority to withheld and grants only what it can positively assure, modulating the grant as the run proceeds and narrowing it when realized behavior diverges from the assured trajectory. It enforces the grant in the path, so the system acts only inside what the governor allows and cannot reach the effect by another route. Every decision it governs is sealed to a tamper-evident record as it happens. The governor is the product. The record is what it emits. Patents held in The Wayfinder Trust.