Governance Under Scale on Andrew Hunter — Systems Architect & Builder

Governance Under Scale — Part IV: Model Selection, NAIC, and the Crosswalk

Mon, 24 Aug 2026 00:00:00 +0000

Every framework that now governs enterprise AI asks the same question, and none of them ask it of the model. NAIC, NIST, ISO, the EU, and the bank regulators want to know whether the system is under control: what it can touch, what it can do, who is accountable, and how you would stop it. The model sits inside that system as a component whose behavior you can shape but never guarantee.

This is the argument the first three parts made from first principles, now arriving from five directions at once: a governed system built around a model you cannot govern directly.

Governance Under Scale — Part III: Revocation and the Reachable Decision Surface

Fri, 24 Apr 2026 00:00:00 +0000

Part II separated visibility from control. A system can observe its own drift, make its behavior legible, and surface deviation across time and risk class, and still not be governed, because it cannot change its authority in response. It is instrumented, not controlled.

That leaves one place for governance to live: the capacity to change what the system is permitted to do.

Most current AI governance aims somewhere else. It treats control as a behavior problem: make the model produce safer outputs, fold policy into training, reinforce acceptable responses, condition the system toward the posture the institution wants. Better behavior is worth having, but it is not governance. Training, monitoring, and reinforcement change how a system behaves. None of them change what it is permitted to do next, and at scale that is the distinction that matters.

Governance Under Scale — Part II: Monitoring Is Not Control

Thu, 19 Mar 2026 00:00:00 +0000

Part I established that human override is not an external safeguard. It operates inside the system, as a delegation surface through which authority expands when it is not explicitly constrained. Correction at the level of the instance becomes, over time, a mechanism by which authority grows.

The institution that discovers this reaches for the obvious fix: make the system legible. Instrument decisions, surface deviations, trace patterns across time and risk class. Monitoring frameworks, evaluation pipelines, audit trails, and reporting layers go in, and they quietly take on a second role. They stop being instruments of visibility and start standing in for governance.

They cannot. Visibility does not constrain authority. A system can be fully observable, legible at every layer, and still operate within the same set of permitted actions. Observed that thoroughly, monitoring does not constrain the system. It describes it.

Governance Under Scale — Part I: Human Override Is Not Governance

Mon, 02 Mar 2026 00:00:00 +0000

In most enterprise AI deployments, “human in the loop” is treated as a safety guarantee. Put a reviewer in front of a probabilistic system and its output is assumed to become accountable: the model may err, but the human will catch it.

A human reviewer is not an independent control plane sitting outside the system. Reviewers operate inside the same delegation structure, under the same throughput pressure, incentives, partial information, and local optimization. At scale, human override is not a check on authority. It is another authority surface, one that expands scope, normalizes exceptions, and quietly redefines what the institution permits.

Override is not governance. Mistaking it for governance is how authority expands while everyone believes it is being contained.