The Governor Never Opens the Model

A runtime governor bounds how much authority an AI action carries without opening the model that proposed it. It reads the action at the actuator and how far the run has drifted from what the system was assured to do, not the weights, the architecture, or the training behind the choice, so an agent built on a closed or third-party model is governed exactly like one built in-house. Wayfinder Systems Group builds that governor. It sits above the control and below the model, and below does not mean inside.

A growing share of agent deployments now rests on a model the deployer did not build and cannot open. The model at the center arrives through an interface, ships as a bought service, or is retrained and replaced on a schedule the deployer does not set. Any control that has to look inside that model to do its job is already beaten.

What does a runtime governor read to bound an action?

A runtime governor is a control in the path of every action that sets how much authority the action may carry, against a bound declared before the run, before the action reaches the actuator. To set that grant it reads two things. What the action would do at the actuator, in the units the actuator acts on. How far the run's realized behavior has drifted from the trajectory the system was assured to follow.

Neither of those is inside the model. The effect is a property of the action, legible at the point the action becomes a write, a transfer, a message, or a command. The divergence is a property of the behavior the system has already produced, legible from the outside. The weights that produced the action, the architecture that holds them, and the data they were trained on are not inputs to the grant.

So the governor grades the action, not the mind that chose it. A model it has never seen, proposing an action it has never seen, is graded by the same reading as any other. What the action would do, and where the run is going.

Does governing an AI system require opening the model?

Two disciplines answer whether an AI system can be trusted, and they look at different objects. One reads the model. It inspects weights, probes activations, and reconstructs the reasoning behind a decision, so a person can understand why the system did what it did. The other reads the action. It takes the action the model already chose and decides how much authority that action may carry before it lands.

Understanding why an action was chosen and bounding what the action can do are different jobs. A full account of the model's reasoning does not, by itself, stop the action, and a bound on the action does not require the account. The governor does the second job. It leaves the first to whoever owns the model, and it does not wait on them to finish.

The reason this split matters now is that the model is increasingly not the deployer's to open. A frontier model reached through an interface exposes no weights. A third-party agent ships as a service. A model updated on a provider's release schedule is a different model each quarter. A control that has to read the model cannot govern any of these. A control that reads the action governs all of them.

What happens when the model is one you did not build?

Take the three cases a deployer actually faces. A closed model behind an interface. A bought agent running as a service. A model the provider retrains and ships on its own cadence. In each, the deployer cannot see the thing choosing the action, and in each, the action still has to reach an actuator to become a durable effect.

That actuator does not move when the provider swaps the model. The governor sits there, on the path the action has to take, and grades the action that arrives against the envelope declared for that class of action. A new model version, shipped overnight, reaches the same point and is graded the same way. The grant does not need to be told the model changed, because it never read the model to begin with.

This is also the gap the public instruments leave open. EU AI Act Article 14 asks that a high-risk system be designed so the people assigned oversight can monitor, override, or interrupt it, with high-risk obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744. SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope and the interagency request for information it promised still not issued. Both assume the deployer can reach the system they are asked to oversee. Neither says what discharges the obligation when the model at the center was built by someone else and cannot be opened.

How can the forward look work without seeing inside the model?

The hardest part of this to accept is the forward look, because anticipating where a run is heading sounds like it needs a theory of the model. It does not. The forward look reads the system's own realized behavior, the actions it has actually taken and the effects they actually had, and measures how fast that behavior is diverging from the trajectory the system was assured to follow. Realized behavior is observable from outside the model. The divergence is a quantity, not an interpretation.

So the governor can grant less authority on an action whose present trust reads higher, because its forward look caught the run turning before the step landed, and it caught it without once reading the model that was turning. The signal it acts on is the system's behavior, which a model cannot hide by being opaque.

When that forward look is uncertain, the grant falls rather than rises. Opacity of the model does not buy the system a larger grant, because the governor was never resting the grant on what it could see inside. It rests the grant on what the action would do and where the behavior is going, and an unreadable model changes neither.

What opening the model would not buy you.

Suppose the model could be opened fully, with every weight and every activation on the table. The reading would explain the action. It would not bound it. The account of why the system chose a transfer does not cap the size of the transfer, and the cap is the thing that keeps the effect inside what was assured. Interpretability is evidence about a decision. It is not authority over one.

Model-blindness is not assumption-free. The governor still needs the one thing no amount of model access would supply on its own. A bound, declared before the run, in the units the actuator acts on, by someone who is not the agent and is not trying to finish the run. The governor holds that bound exactly. It does not write it, and a wrong bound is held as faithfully as a right one.

What the governor removes is the requirement to see inside the model. What it does not remove is the requirement to say, in advance, how far an action of this class is allowed to reach.

What we are building.

Wayfinder Systems Group builds a runtime governor that sits above the control and below the model. It observes the run, assesses each action by what it would do at the actuator, modulates how much authority that action carries against an envelope declared before the run, enforces the grant in the path so the only thing that reaches the actuator is the action already cut to it, and signs the record of what it decided. None of those five stages reaches into the model. The system the governor bounds can be one the deployer built, one it licensed, or one that changed this morning, and the grant is set the same way on all three. We call her Velma.