Writing on governance of autonomous AI action: authority, enforcement, evidence, and the boundary between intent and consequence.
Grant Thornton found 78 per cent of executives doubt their organisation could pass an independent AI governance audit within 90 days. The reason is not missing policy: a policy proves governance was designed, an audit asks for proof it operated, and only one of those artefacts is being built.
Behavioural detection produces evidence; per-action enforcement produces verdicts. Letting detection convict directly breaks the replay property both planes exist to protect. Detection learns; policy decides; the evaluator enforces.
A governance layer for autonomous AI action invites an obvious objection: if it decides what an autonomous system may do, what decides what the layer may do? The answer is not another controller on top but a governor built to be reconstructed, answerable for its own rule-changes, and anchored to a human root, because an authority no one can check is only where the regress hides.
When the auditor arrives, they will not ask whether your governance system was running. They will ask for the receipt: the tamper-evident record that proves a specific decision was made, under a specific policy, before a specific action executed.
A sealed receipt proves that a governance decision was rendered over a recorded action representation. It does not prove that the original framework call was translated into that representation correctly, which is why translation has to be treated as part of the governance boundary.
If governance semantics change when the vendor changes, then governance is a vendor feature, not an organisational property. Provider neutrality is the test: same policy, same delegation, same evidence, regardless of which vendor's infrastructure runs underneath.
At a HashiCorp and IBM round-table in Sydney, a room of security professionals was polled live. Of the five questions put to them, the one they could least lean on their own tools to answer was who authorised the action an autonomous system had just taken: the layer that sits next to identity, not inside it.
A safety check that runs before each step an AI agent takes works from a memory of fixed size. The more the agent has in flight at once (its width), the more that memory must hold, until it cannot, and the only honest answer is to stop and ask. How often that happens is set by how much authority was handed out, not by a dial an operator turns; and a system that never stops on wide work is not safe, it is guessing.
Per-action governance evaluates each action independently, so some failures appear only across authorised sequences whose aggregate effect was never authorised. The stake is architectural: enforcement remains necessary, but sequence analysis needs its own evidence plane.
MIT Technology Review and EnterpriseDB published a major sovereign-AI report this week that treats the substrate question as the answer. The harder question, which their own quoted experts walk right up to, is whether the autonomous system was authorised to take this specific action.
