The Envelope Changed Mid-Run

A governor sets how much authority the next action carries, against a bound it did not write. That bound lives in a document somebody maintains, on a change schedule that has nothing to do with the run. An edit landing between one action and the next moves the reference the governor is modulating against, and nothing in the agent's behavior announces that it moved.

The reference has a maintainer.

The envelope is declared before the run and outside the governed system. That is what makes it a reference rather than a preference. The governor reads it, compares realized behavior against it, and sets a grant. Its correctness is read off the construction rather than measured on a corpus, and the construction assumes the bound in front of it is the one the declaring party intended for this action.

Runs are not always short. An agent working a claims queue runs for a shift. A remediation job runs until it finishes or is stopped. An autonomous system operates across a deployment window measured in days. Over any of those intervals the envelope stops being a fixed object and becomes a file with a history.

Edits are ordinary. A bound gets corrected after an incident review. A new action class is added because the integration grew. A ceiling is raised after a quarter with no exceptions. A unit is fixed because somebody finally read it closely. None of these is misconduct, and every one of them changes what the governor is comparing against.

Tightening and widening are different events.

Direction decides what the edit costs. A bound that tightens mid-run moves the grant toward restriction. Actions after the edit carry less authority, and the run may not finish. That is a real cost, and it is the cost the failsafe default exists to pay, because an action that should not have run costs more than one that had to wait.

A bound that widens mid-run is an authority-raising event. Inside a single run, authority falls when behavior diverges and does not climb back on the agent's own signal. The envelope edit is the one path by which authority rises while the run is open, and the raise arrives from outside the agent, from a person, in the middle of the interval being governed.

The asymmetry is the whole of it. A tightening edit narrows what the system may do, and the governor can apply it immediately with no further question. A widening edit hands the system capability it did not have a moment ago, on the authority of whoever saved the file.

A grant that does not name its reference cannot be checked.

The grant leaves the governor as a number. The bound it was evaluated against is a separate object with its own identity and its own version. When the grant does not carry that identity, nobody downstream can establish which bound was in force, and neither can the governor when it is asked later.

There are two ordinary implementations, and the difference between them is invisible in the code that computes the grant. Read the envelope once at run start and hold it for the duration. Or read it per action from a store another process is free to write. Both are defensible. They are different systems, and the choice decides whether an edit saved at one moment governs the action taken a second later.

A grant carries a number and the identity of the bound it was set against, or it carries an assertion nobody can check. Which of the two implementations is in use has to be declared with the envelope, in the same place and with the same weight as the bounds themselves, because a reader who assumes the wrong one misreads every grant in the run.

The action already in flight.

Three moments sit close together. The governor sets a grant against the version it read. An edit commits a new version. The action reaches the actuator. Nothing forces those three into the order the design assumed.

If the edit tightened the bound, the action in flight was granted more authority than the current document allows. If the edit widened it, the action was granted less than the current document allows, and an operator reading the envelope on their screen sees a restriction with no basis in the text in front of them. Both readings are correct about different versions, and the argument that follows is unwinnable without a version stamped on the grant.

The rule that holds is the one already used for an uncertain reading. When the governor cannot establish which version covers the action, it grants the failsafe declared for that action class rather than the wider of the two candidates. It can grant less authority on an action whose envelope just got wider, because it could not establish that the wider bound was in force when the action was committed. Uncertainty about the reference rounds the same direction as uncertainty about the measurement, and for the same reason.

Who may edit, and when the edit takes effect.

An envelope the operator can widen while their own run is being restricted is not a reference. It is a setting, and a control the governed party can loosen under pressure returns nothing on the run where it mattered. The party that declares the bound and the party that owns the run finishing have to be different parties, and that separation is worth more during an edit than at any other moment.

The effective boundary is the second half of it. An edit taking hold the instant a file changes on disk gives the run a discontinuity nobody scheduled. An edit that takes effect at a declared cut-point, the next run boundary or the first action after the change is acknowledged, gives the governor a version it can name. The edit is itself an event with a time, an author, and a version, and a governed action names the version it ran under.

EU AI Act Article 9 asks for a risk management system that is a continuous iterative process planned and run throughout the lifecycle of a high-risk system, subject to regular systematic review and updating. The regulation expects the reference to change. It does not say what governs the action that was in flight when it did. Those obligations apply from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component, under Regulation (EU) 2026/1744.

The rest of the instruments are quieter on it. SR 26-2 took effect April 17, 2026 and placed generative and agentic AI outside its scope, with the interagency request for information it promised still not issued five months on. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement on August 31, 2026, with comments closing September 29. Colorado's revised rulemaking draft on automated decision-making technology is due on or before September 23, ahead of an October 26 hearing and a statute effective January 1, 2027. Each of these asks a deployer to describe the governance it has in place. None asks which version of it was in force at the moment an action ran.

What we are building.

Wayfinder Systems Group builds a runtime governor. It sits in the path of the action, reads how far realized behavior has diverged from the trajectory the system was assured to hold, and sets how much authority the next action carries against a declared envelope it does not own. The grant names the version it was set against, and the record it emits carries that version out to whoever has to read it. We call her Velma.