What Reaches the Actuator

The governor sets how much authority the next action carries. Then it makes that grant real by handing the actuator the action already cut to the grant. Most controls only take the first step. They read the action, return a verdict, and let the action itself pass through as written.

Setting the authority and enforcing it are two jobs. A verdict is a label placed beside the action. A grant is a change to the action that runs.

Most controls stop at the verdict.

An agent proposes an action. The control reads it and answers one question. May this run. The answer comes back as allow, block, or send it to a person, and whatever the answer, the action that moves forward is the action the agent proposed.

That is a gate. It decides whether the action passes, and it has nothing to say about the action once it does. The transfer that clears is the transfer the agent asked for. The query that clears runs as written. The gate held the door. It did not touch what walked through.

A grant has a magnitude.

Authority is a quantity. How far this action may reach. A gate collapses that quantity to one bit at the threshold, and one bit cannot carry it. An action can be too far-reaching to allow as proposed and too useful to block outright, and a gate has nothing to return between the two.

The governor keeps the quantity. It grants an amount, and an amount has to land somewhere. It lands on the action. The grant sets how large the action is allowed to be before it runs.

The reduction is built into the action.

This is the step the gate skips. When the governor grants less than the action asked for, the enforcement point does not forward the original with a warning attached. It constructs the bounded action and hands the actuator that. A write is confined to a narrower scope. A transfer is capped below the amount proposed. A tool call goes out with its parameters tightened to the grant.

The actuator never sees the action the agent proposed. It sees the action the governor allowed. Reduced authority is a property of what executed. The agent asked for one action, and a smaller one reached the world.

The direction can run against the surface reading. The governor can hand the actuator a smaller action on a step whose present trust reads higher, because its forward look caught a divergence before the outcome landed. The action looked clean. The grant was cut anyway, and the cut is what ran.

A different preset is still the whole action.

Some controls offer a middle setting. Allow, modify, block. The modify looks like modulation, but it substitutes. The action is replaced with a different preset the control was configured to swap in, and the substitute runs whole. The control still picked from a short menu. It just had three items instead of two.

Modulation is a continuous cut on this specific action, set to this specific grant, and it takes a different value every time because the grant is computed fresh every time. A preset was written before the run and knows nothing about where this action sits relative to the assured trajectory. No menu is long enough to hold every value the cut can take, so no menu can stand in for it.

Where the bound lands.

For the cut to be real, the actuator has to be reachable only through the governor. If the agent can hand its action to the effect by a second route, the bound is a suggestion, and what lands is the action the agent wrote. The cut has to sit on the only path to the effect, applied to the action in flight, before the effect is durable.

That is the line between a governor and a reviewer of one. A reviewer reads the action and comments. A governor stands in the path and changes what proceeds. What proceeds is the action reduced to the grant, and by the time anything downstream can read it, the reduction has already happened.

What we are building.

Velma is a runtime governor. It sits in the execution path, below the model that decides and before the actuator that commits, and sets how much authority each action carries against a declared safety envelope. It does not stop at a verdict on the action. It reads how far realized behavior is diverging from the assured trajectory, modulates the authority of the next action to match, and enforces that grant by handing the actuator the action already cut to it, so the system acts only inside what the governor allows and cannot reach the effect by another route. Each decision it governs is sealed to a tamper-evident record as it happens. The governor is the product. The record is what it emits.