Per-action governance evaluates each action independently, so some failures appear only across authorised sequences whose aggregate effect was never authorised. The stake is architectural: enforcement remains necessary, but sequence analysis needs its own evidence plane.
MIT Technology Review and EnterpriseDB published a major sovereign-AI report this week that treats the substrate question as the answer. The harder question, which their own quoted experts walk right up to, is whether the autonomous system was authorised to take this specific action.
Sovereign AI is often discussed in terms of where systems run and who owns the hardware. That frame is necessary scaffolding, but sovereignty also depends on whether a system can refuse an action it cannot authorise.
Pre-execution authority can be deterministic, fail-closed and evidence-producing while the operational reality the action was built from has already expired. The decision still verifies. The action is still wrong.
When policy changes are implicit, silent, or unversioned, historical governance receipts lose their meaning. If you cannot determine which policy version produced a given decision, every past receipt becomes ambiguous, and ambiguous evidence is not evidence.
A delegation matters only while the delegator can still withdraw it. If authority survives task changes, incidents, and loss of trust, it is no longer a live delegation. It is standing permission.
If the governance system cannot complete an evaluation, the action does not execute. Fail-closed is not a conservative design choice; it is the only design that prevents adversarial strategies from targeting the evaluation path itself.
Centralised, distributed, shared-state, infrastructure-mediated, compositional. Every coordination topology manages how authority flows between agents. None of them enforces whether that authority is valid. The architecture manages. Governance enforces.
Twelve thousand individually authorised queries. Every receipt is an approval. The aggregate reconstructed every customer profile in the database. Data boundary erosion does not require injection, confusion, or escalation, only individually authorised actions that no one examines as a sequence.
Memory makes agents useful. It also makes them vulnerable across sessions. When memory writes are not governed actions, contamination planted in a low-privilege session can activate in a high-privilege one, invisible to per-action evaluation at every step.
Multiple conversations. Multiple governance proposals. All of them pull governance away from the only place it can be enforced: the action boundary. The drift is not accidental; it is a common architectural default.
Prompt injection is treated as a model safety problem. It is actually a governance failure. The injection succeeds at the model layer, but the action it produces should never have executed. The missing control is not a better filter. It is an enforcement boundary.
The governance debate stalls because policy, security, and monitoring use the same word for different problems. Separating the vocabulary reveals a gap none of them address: whether a specific action is permitted to execute, right now.
A common misunderstanding in AI systems: initiating a process is not the same as authorising every action that follows.
Logs record events. Governance evidence records decisions, with cryptographic proof that neither the decision nor the evidence has been altered. Without it, governance is a claim, not a fact.
When governance is embedded in the agent framework, it is governed by the framework's lifecycle, not yours. Framework upgrades change governance behaviour. Framework removal eliminates governance entirely. Independent governance infrastructure survives the framework.
Governance decisions must be deterministic: same inputs, same decision, independently verifiable. If the evaluation depends on anything outside the canonical action, delegation, and policy, the decision cannot be reconstructed, and unreconstructable decisions are not governance.
Identity tells you who is acting. Delegation tells you what they are authorised to do, by whom, until when, and within what scope. Confusing the two is the root cause of the confused deputy problem, and autonomous AI systems can reproduce it at scale.
Content filters evaluate what the model says. Governance evaluates what the system does. When the regulator asks for proof, the difference between the two is the only thing that matters.
The modern autonomous AI stack has a model layer, a tool layer, and a memory layer. Between intent and consequence, where an independent governance plane must exist, there is often nothing but embedded constraints.
Software used to wait for instructions. Now it acts. When systems produce consequences autonomously, governance must precede execution. Otherwise it does not exist.
