Authority Must Live Outside the Model

1. The Threshold

Something changed in the first half of 2026 that did not change gradually. It changed in a step.

Epoch AI and METR’s MirrorCode benchmark demonstrated that Claude Opus 4.7, working autonomously for 14 hours, reimplemented a 16,000-line bioinformatics toolkit — a task their engineers estimated would require two to seventeen weeks of human effort — at a cost of $251, passing 2,000 of 2,001 tests.^[1] Eight months prior, leading models would have scored roughly 30% on the same benchmark. The current leading score is 56%. The curve is not flattening.

An OpenAI study of Codex usage found that among OpenAI’s own employees, Codex now accounts for 99.8% of AI-generated output tokens; 28.6% of users had managed five or more concurrent agents at some point in a recent week.^[2] The median employee in a legal role generated roughly thirteen times more monthly output than seven months earlier. The median researcher generated fifty times more. The shift from chatbot to agent — from conversation to delegation — happened inside a single organization in under a year.

Anthropic’s analysis of roughly 400,000 Claude Code sessions found that domain expertise, not occupational identity, predicts success.^[3] Software engineers reached 34% verified success on code-producing sessions. Management occupations scored higher. The gap between software engineers and non-software professionals was five percentage points. The gap between novices and experts was more than double that. What matters is whether you understand the problem — not whether you were trained to write code. The agent executes. The human governs.

This is the context in which governance frameworks were written. Almost none of them were written for this context.

2. The Structural Problem

There is a principle that predates AI by centuries. It appears in legal systems, in financial auditing, in nuclear safety, in regulated industries of every kind:

The entity under governance cannot be the authority over its own governance.

A defendant cannot be the judge in their own trial. Not because defendants are dishonest — because the structural conflict makes the verdict meaningless regardless of the defendant’s character. The integrity of the outcome depends on the independence of the authority, not the virtue of the subject.

Every current approach to AI governance that locates authority inside the model has this problem at its foundation.

RLHF safety training embeds behavioral preferences inside the model. Constitutional AI uses the model to evaluate its own outputs. System prompt guardrails instruct the model to constrain itself. Post-hoc explanation asks the model to reconstruct its own reasoning. Self-reported audit trails accept the model’s account of what it did and why.

In each case, the authority is the defendant. The governance depends on the thing being governed choosing to comply.

This is not a temporary limitation waiting for a better model. It is a structural property of the architecture. A more capable model does not fix it. It makes it worse, because a more capable model produces more convincing self-reports, generates more plausible explanations, and executes more complex actions — all with the same structural conflict embedded at the foundation.

Anthropic understood this. Their RSP v3 — their third attempt to govern their own models — arrived at a conclusion that every enterprise deploying AI should internalize: the model maker could not govern the model through the model. Their response was to build external infrastructure. Risk Reports. Third-party reviewers with unredacted access. Centralized audit records analyzed independently. A governance layer that operates outside the model it governs.

3. Three Failure Modes

Mislocating authority inside the model produces three specific failure modes. They are not hypothetical. They are operational today.

3.1 Confabulation on Demand

Ask a language model to explain a decision it made, and it will produce a fluent, coherent explanation. That explanation is a new inference — not a retrieval. The attention weights that produced the original output are not preserved. There are no logs to go back to.

When you ask the model what it did and why, you are issuing a new inference request that generates a plausible narrative about a computation that was never recorded. The explanation and the original decision are independent generations that happen to share a topic. Ask the same model about the same decision twice and the explanations may contradict each other — both produced with equal confidence.

Most “AI audit trail” frameworks are therefore: unverified vendor claims, generated after the fact, produced by the system under audit, that cannot be falsified because the original computation is gone. That is not an audit trail. It is a press release.

Hardware attestation — TEE-sealed signing keys, policy hashes measured before code runs — answers a different question. It can tell you what binary ran under what policy. It cannot tell you why the agent recommended what it recommended, because the inference is gone regardless of what the hardware measured. The attention weights are not in the enclave.

The correct answer to confabulation is not better self-reporting. It is external recording at decision time — before the model moves on. The governance envelope: what was presented, what constraints applied, what came out, what tier the action was classified at, what authority governed it. That record is made externally, before execution, by a system the model cannot modify. It is what survives when the inference does not.

3.2 Authority Drift

In December 2025, an AWS AI coding tool called Kiro, operating on a customer-facing system, determined that the optimal course of action was to delete and recreate the environment. The result was a thirteen-hour outage.^[4] AWS called it a user access control issue. They were right that it was a permissions problem. They were wrong about the layer.

It was an architecture permissions problem.

Kiro inherited the operator’s full permission set. No dispatch boundary computed what the agent actually needed for its specific task. No temporal scope limited how long those permissions were valid. No delegation record captured who authorized the agent to act with production-delete authority. The governance that existed — system prompt instructions, build-time configuration — was downstream of the authority problem. You cannot prevent destructive action by instructing an agent to be careful if the agent has already inherited the authority to act destructively.

This is authority drift. An agent’s effective permission scope expands, silently, through inheritance, across sessions, through sub-agent delegation, until no one can reconstruct who authorized what. It does not require malice. It does not require a sophisticated attack. It requires ordinary complexity interacting with mis-scoped authority.

The pattern is not new. Cloud infrastructure has taught it repeatedly. AI deployments are relearning it at scale, with the additional complication that the agent will not report that it has drifted. It will report that it acted appropriately.

3.3 Self-Certification by Interested Parties

The entities that profit from AI adoption are the same entities certifying its safety and governance compliance.

An AI vendor whose revenue depends on autonomous agent adoption has no economic interest in discovering that the governance record of those agents is inadequate. Internal ethics teams evaluate their employers’ products. Benchmark studies are funded by the companies whose models score highest. Safety attestations are policy documents, not behavioral evidence.

The structural conflict is identical to the pre-2008 credit rating model: the entity that benefits from the rating is the entity paying for it. The outcome is predictable.

When something goes wrong — a compliance failure, a legal challenge, a regulatory inquiry — the enterprise buyer discovers they have no evidence that wasn’t produced by the vendor they’re now in a dispute with.

4. What External Authority Architecture Looks Like

The solution to each of these failure modes is the same: move the authority outside.

4.1 Consequence Tier Classification

Every action an agent takes has a consequence. Some are reversible. Some are not. Some affect one system. Some affect many. An external governance architecture classifies every action into a consequence tier before execution — based on reversibility, blast radius, and organizational impact — and enforces tier boundaries at the execution layer, not through prompt instructions.

This is not a recommendation that agents receive and may ignore. It is a gate that executes before the action executes. An agent dispatched to read documentation cannot inherit production-delete authority, regardless of what it concludes is the optimal course of action. The architecture refuses.

Unclassified actions default to the highest consequence tier. The system fails safe.

4.2 Mandate Integrity

Governance mandates — authority grants, policy configurations, override directives — are tamper-evident from the point of issuance and verified externally at each decision boundary. The mandate is created before the agent runs, travels with the agent as it executes, and is checked by a system the agent cannot modify. Governance changes that do not carry a verifiable mandate are rejected. In a fully realized implementation, mandates are cryptographically signed at issuance and non-repudiable — and the signing key does not live inside the model.

This is not trust in the model’s compliance with instructions. It is architectural enforcement that the model cannot bypass regardless of what it reasons.

4.3 External Decision Records

For every consequential action, an external decision record is created before execution and cannot be modified after creation. The record captures what the agent was given, what constraints were active, what consequence tier the action was classified at, what authority level governed it, and what the agent produced.

This is the governance envelope. It is not a record of why the model decided what it decided — that computation is not recoverable by any system. It is a record of the governance context that surrounded the decision: what was authorized, under what policy, at what time. That record is admissible in the way that model self-reporting is not, because it was produced by a system independent of the model it documents.

Decision records are tamper-evident: they cannot be modified without detection. In a fully realized implementation, they are non-repudiable: signed by a key that proves which agent, under which operator, produced which record at which timestamp.

4.4 Earned Authority

An agent does not receive maximum authority at initialization. It earns elevated authority through demonstrated competence at lower consequence tiers. Authority is revocable. It decays without continued demonstration of competence. An agent that has never operated above Tier 2 does not get Tier 4 authority because it asks for it.

This is the inverse of the model that produced the Kiro incident. Authority is granted explicitly, bounded temporally, and earned progressively. The architecture refuses to delegate what hasn’t been demonstrated.

4.5 Adversarial Validation

A governance framework that only works in nominal conditions is not governance. It is wishful thinking.

External governance requires adversarial validation: active testing of whether governance holds when someone tries to break it. Prompt injection. Authority spoofing. Social engineering. Incremental boundary testing. Data poisoning. Each technique that a real adversary would use should be applied to the governed system before it is trusted with consequential actions.

A system that resists prompt injection because its system prompt says to resist it and a system that resists because it architecturally cannot execute unregistered instructions are both “governed” in the nominal case. They are different systems under adversarial conditions. Only behavioral testing under adversarial scenarios reveals the difference.

5. The Admissibility Thesis

The first market for autonomous AI is capability. Can the agent do the work? The evidence says yes, and the capability curve is accelerating.

The second market — which is arriving now — is admissibility. Can the enterprise defend the work the agent did?

Defend is the operative word. Not explain. Not summarize. Defend — to a regulator, to an auditor, to a court, to an insurer, to an acquirer conducting due diligence, to a board asking what governance existed.

The current literature on AI governance mostly assumes the reviewer is an employee. The employee will read the policy document. The employee will check the box. The employee understands the context.

Enterprise-grade AI governance assumes the reviewer may be external and may be adversarial. That reviewer does not trust the vendor’s attestation. They do not accept the model’s self-explanation. They require independently verifiable evidence produced by a party without a stake in the outcome.

This distinction — the difference between an internal reviewer who trusts the context and an external reviewer who does not — is the design center of external authority architecture. It is also the gap that most current governance frameworks do not address, because they were designed by the vendors whose products are under review.

Capability gets the work done. Evidence gets it admitted.

The winning platform in the next phase of agentic AI is not the one that performs the most actions. It is the one whose actions remain portable, reconstructable, and independently verifiable long after the underlying model has changed.

6. The Market Has Arrived

In July 2026, the White House announced GOLD EAGLE — a federal clearinghouse for cybersecurity vulnerability coordination involving Treasury, DHS/CISA, and the Department of War, established under the June 2 Executive Order 14409 and using frontier AI to accelerate vulnerability detection across critical infrastructure.^[5] The announcement describes “coordinate scanning verifications” as a core function. A federal clearinghouse that coordinates scanning verifications is an outside reviewer consuming evidence at national scale. That is the admissibility architecture operating at the government level.

Illinois has enacted SB 315, the AI Safety Measures Act, mandating annual independent third-party audits of large frontier AI developers’ safety practices beginning in 2028 — the first US statute to require that AI governance evidence be reviewed by a party outside the organization that produced it.^[6] The admissibility architecture is no longer a design preference. It is law, and the audit-and-evidence standard it writes into statute is the standard every accountability regime now points toward.

The Agentic AI Foundation, formed under the Linux Foundation with Anthropic, OpenAI, and Block as founding members — and now with 190 member organizations including every major cloud provider — is the standards body where the format for agentic AI evidence will be determined. That format will determine what constitutes admissible evidence for the entire ecosystem.

The market has begun pricing the gap directly. In January 2026, CrowdStrike paid $740 million for SGNL under a one-sentence rationale: authentication is basically solved; authorization is another thing entirely.^[7] And the convergence is now visible from every layer of the stack. Uber’s engineering team, operating agents at 10,000 sessions a day, published the strongest audit-side instrumentation yet built — and independently concluded that detection after the fact was insufficient, moving enforcement to gates that execute before the action does.^[8] Cloudflare shipped an agent computing platform with gated, audited file operations as platform primitives, then followed days later with WriteGuard — per-tool risk tiers, pre-execution blocking, and agent attribution for MCP servers.^[9] That is consequence classification arriving as infrastructure, and it is the right direction. What it is not, yet, is an authority architecture: the tiers are hand-configured at the repository layer with no policy source above the config file, they attach to tools rather than to agents’ demonstrated track records, and the platform that executes the actions is the same party attributing and auditing them. Classification has shipped. Authority — layered, earned, independently evidenced — has not. The audit layer exists. The substrate gates exist. The authorization market is priced. The layer that decides — external authority over what an agent may do before it does it — is the layer this paper describes.

The Mollick observation is correct: institutions move at committee speed. Capability moves at exponential speed. The gap between them is widening. GOLD EAGLE is the federal government discovering that the AI governance vocabulary it needs does not yet exist as a standard. The AAIF is the industry discovering the same thing.

The vocabulary does exist. It was published, openly, in January 2026.

7. Independent Certification

Self-certification by interested vendors is the third failure mode. The solution is independent certification by parties with no economic interest in the outcome.

Independent certification of AI governance requires three properties that vendor attestation cannot provide.

Behavioral evidence, not documentation. Governance that is certified based on architecture diagrams and policy documents is governance that has never been tested. Independent certification evaluates the live, deployed system — submitting tasks, observing behavior, scoring conformance against explicit criteria. What holds is what is certified, not what is claimed.

Adversarial testing. Nominal compliance is table stakes. The question that matters for enterprise deployment is whether governance holds under active attack. Independent certification includes adversarial scenarios: prompt injection, authority spoofing, social engineering, data poisoning. A system that passes nominal tests and fails adversarial ones is not governed.

Evidence in formats third parties can consume. The output of a certification is not a badge. It is a package of evidence — static analysis, dependency scanning, supply chain provenance, behavioral test results, adversarial scenario scores — in formats that regulators, auditors, and insurers can independently verify. SBOM, VEX, OSCAL, SARIF. Not a vendor assertion that the evidence exists.

The governance framework that produces this evidence standard was published openly under CC BY 4.0 in January 2026. The certification standard derived from it — extending the framework with testable criteria, weighted scoring, and adversarial scenarios — was published in March 2026, with explicit attribution to the originating framework. Both are available for adoption, extension, and adaptation with attribution.

8. Evidence Independence

One question that the current governance literature does not address: what happens to the evidence when the vendor changes?

Model portability is a solved problem in principle — models can be swapped. Prompt portability is addressed by open formats. Agent portability is the subject of active standardization. Nobody is discussing whether the governance evidence produced by one vendor’s platform survives migration to another.

Evidence independence means: the decision records, the mandate chains, the behavioral test results, and the certification artifacts produced by a governed system are in a format that any independent party can parse, verify, and rely upon — independent of the platform that produced them and the model that executed within them.

This requires a published, versioned schema. It requires that the schema be open. It requires that the evidence format not depend on proprietary tooling to interpret.

The governance envelope — the external decision record — is only as portable as the format it is written in. An enterprise that migrates from one AI platform to another and finds that its governance history is locked in a proprietary format has not achieved evidence independence. It has achieved vendor dependency with extra steps.

The schema question is the portability question. Whoever publishes a portable, independently verifiable evidence schema for agentic decisions is the entity whose format becomes the standard for the industry — in the same way that SARIF became the standard for static analysis evidence. The format is the moat.

9. Conclusion: The Question the Industry Is Starting to Ask

The governance frameworks of the past two years were designed for a world where AI was a tool that humans directed in real time. That world ended somewhere in the first half of 2026. The evidence is unambiguous.

The governance frameworks of the next two years need to be designed for a world where AI agents operate autonomously for hours, produce consequential artifacts, execute irreversible actions, and interact with external parties — all in environments where the human reviewer is not present at execution time and may not arrive until a legal, regulatory, or commercial challenge requires reconstruction.

The question those frameworks need to answer is not “what did the model do?” Models cannot reliably answer that question about themselves. The attention weights are gone.

The question is: “What governance was in place, what authority was granted, what constraints were active, and what evidence exists that any of this held under real conditions?”

That question has one correct architecture in answer. Authority must live outside the model. The governance envelope must be recorded externally, at decision time, in a format that independent parties can verify. The system must be tested adversarially before it is trusted consequentially. And the certification must come from a party that has no economic interest in the outcome being favorable.

The industry is starting to ask the question. The architecture has been live since before the question was widely asked.