Which Way the Number Points

A governor sets how much authority the next action carries. That grant leaves the governor as a number on a bounded scale. A number crossing a boundary carries no direction with it, and the enforcement point never has to know which way it points. Every surface a person reads it on does.

Two scales wear the same name.

There are two natural ways to put authority on a scale from zero to one. Both are in use, often inside the same deployment.

The first measures authority granted. One is a full grant. Zero is a blocked action. The value rises as the governor's assessment of the system improves. This is the sense the enforcement point needs, because what it holds against a proposed action is how much of that action it is willing to let through.

The second measures constraint applied. One is a freeze. Zero is unconstrained. The value rises as risk rises. This is the sense a risk surface wants, because a page reporting exposure is reporting how hard the brakes are being held.

The two cover the same interval and run in opposite directions. Granted plus applied is one. Both are correct on their own side. Neither is self-describing, and a bare number arriving at a boundary looks identical either way.

The failure is quiet and points the wrong way.

A misread unit announces itself. Feed seconds into a field expecting milliseconds and the value is absurd by three orders of magnitude. Somebody notices within the hour.

A misread direction produces nothing absurd. Every value stays inside zero and one. Every chart renders. Every export validates against its schema. The reading is wrong by exactly the amount that matters and by nothing that shows.

Take the worst case, which is also the one most likely to survive review. The governor withheld authority entirely on an action it would not assure. It emits zero, meaning zero authority granted. A surface built on the other convention reads that zero as zero constraint applied and reports the action as unconstrained and proceeding. The most restrictive verdict the governor can reach renders as the most permissive state the page can show. A blocked action and an unconstrained one are the same digit.

The inversion is worst precisely where attention should be highest. Actions carrying a full grant sit at the other end of the scale and invert into apparent freezes, which produces a question, which gets the bug found. The withheld ones invert into silence.

Enforcement does not read the display.

This is where a runtime governor and a reporting layer separate, and the separation is the reason the failure above is survivable.

The grant is applied at the enforcement point, which stands on the path between the proposed action and the actuator. It consumes the number in the sense the governor emits it, across a boundary internal to the control. Nothing on that path passes through a chart. An inverted dashboard does not widen a grant. It does not admit an action the envelope refused. It does not change what reached the actuator. The run was governed correctly and the picture of the run was wrong.

A system whose safety depends on a person reading a screen correctly has put the control in the screen. A governor that enforces before the actuator holds the bound whether or not anyone is watching, and whether or not what they are watching is right.

The report is still an artifact somebody acts on. Wrong in this direction it does not cause an unsafe action. It causes an unsafe decision about the system. A bound gets relaxed because the page showed room. A review closes because nothing appeared constrained. An escalation is never raised.

Oversight is discharged through a rendering.

Every human oversight obligation now on the books names a person and a duty and stops there. None of them names the artifact the person reads.

EU AI Act Article 14 places the human oversight duty on the deploying party. Those high-risk obligations fall on December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component, under the Digital Omnibus that entered into force on July 27, 2026. Colorado SB 26-189, enacted May 14, 2026 and effective January 1, 2027, requires a reviewer with authority to override who does not default to the system's output. California SB 947 bars sole reliance on an automated decision system to discipline or terminate a worker.

Each names a person who has to be able to intervene. A person intervenes on what they are shown. Between the control and the person sits a rendering, and no instrument on that list says anything about it. The duty is written against the system and discharged against a picture of the system.

The same gap runs through supervisory practice. SR 26-2 took effect on April 17, 2026 and placed generative and agentic AI outside its scope, with the interagency request for information still pending nearly five months later. The NAIC AI Systems Evaluation Tool pilot closes this month across twelve states, with re-exposure through September and October and adoption sought at the Fall National Meeting in November 2026. Its governance exhibit asks a carrier to describe the framework it operates. A description is a rendering, produced by the same path as every other rendering, and a carrier whose surfaces invert the sense will describe a program in good order.

The sense belongs in the declared object.

The fix is small enough to get skipped for looking too small to matter.

Name both quantities and carry both. Authority granted and constraint applied are two fields with two names, not one field with an argument attached about what it means today. Convert between them in exactly one place, on one boundary, and let every consumer downstream take the field whose name states what it holds.

Then assert it rather than trusting review. Granted plus applied equals one is a property a test checks on every record. It either passes on all of them or names the one where it did not. Direction is the kind of thing a reviewer reads past, because both readings look reasonable on the page and only one of them is what the other side expects.

The direction matters most on the counterintuitive grants. A governor can grant less authority on an action whose present trust reads higher, because its forward look caught a divergence coming before the outcome landed. That is the grant a reader is most likely to argue with, since every other indicator in front of them looks clean. Rendered in the wrong sense it stops looking counterintuitive and starts looking like a defect, and the response to an apparent defect is to go fix it.

A scalar that arrives with no declared sense is unknown. Unknown rounds the way every other uncertainty rounds in a governed system, toward less authority. A consumer that cannot establish which way a number points should render it as a freeze and say why, rather than take the reading under which the action looks fine.

What we are building.

Wayfinder Systems Group builds a runtime governor. It sits above control and below intelligence. It observes the run, assesses how far realized behavior has moved from the assured trajectory, modulates the authority of the next action against a declared envelope, and enforces that grant on the only path to the actuator. It does not retrain the model or redesign the autonomy stack. The grant it issues is a named quantity with a stated direction, converted once at a single boundary, and the enforcement path holds the bound without depending on any surface to read it correctly. We call her Velma.