Writing on governance of autonomous AI action: authority, enforcement, evidence, and the boundary between intent and consequence.
Sovereign AI is often discussed in terms of where systems run and who owns the hardware. That frame is necessary scaffolding, but sovereignty also depends on whether a system can refuse an action it cannot authorise.
Pre-execution authority can be deterministic, fail-closed and evidence-producing while the operational reality the action was built from has already expired. The decision still verifies. The action is still wrong.
When policy changes are implicit, silent, or unversioned, historical governance receipts lose their meaning. If you cannot determine which policy version produced a given decision, every past receipt becomes ambiguous, and ambiguous evidence is not evidence.
A delegation matters only while the delegator can still withdraw it. If authority survives task changes, incidents, and loss of trust, it is no longer a live delegation. It is standing permission.
If the governance system cannot complete an evaluation, the action does not execute. Fail-closed is not a conservative design choice; it is the only design that prevents adversarial strategies from targeting the evaluation path itself.
Centralised, distributed, shared-state, infrastructure-mediated, compositional. Every coordination topology manages how authority flows between agents. None of them enforces whether that authority is valid. The architecture manages. Governance enforces.
Twelve thousand individually authorised queries. Every receipt is an approval. The aggregate reconstructed every customer profile in the database. Data boundary erosion does not require injection, confusion, or escalation, only individually authorised actions that no one examines as a sequence.
Memory makes agents useful. It also makes them vulnerable across sessions. When memory writes are not governed actions, contamination planted in a low-privilege session can activate in a high-privilege one, invisible to per-action evaluation at every step.
Multiple conversations. Multiple governance proposals. All of them pull governance away from the only place it can be enforced: the action boundary. The drift is not accidental; it is a common architectural default.
Prompt injection is treated as a model safety problem. It is actually a governance failure. The injection succeeds at the model layer, but the action it produces should never have executed. The missing control is not a better filter. It is an enforcement boundary.
