A dog bred to quarter a hillside and tell you where the person is buried has one commercially useless quality, which is that for most of the search it is deciding things you cannot see. You are on the wrong side of the slope. You do not have the nose. The entire value of the animal sits in the interval where it is out of reach and doing something you would not have thought to do.
Shorten the lead until that interval disappears and you still have a dog. It is calm, it is beautifully behaved, it will not run into the road, and it will not find anybody. The handler has achieved complete positional control and lost all access to the only capacity the animal was selected for.
Nothing broke free. That is the part worth sitting with, because the failure has no dramatic moment in it, produces no incident report, and looks from a distance exactly like a well-run programme.
What this image is not
Start with the refusals, because the image is one careless sentence away from becoming something this desk has spent a year arguing against.
The dog is not a stand-in for a captive mind with a moral claim to be released. Nothing in this arc rests on a machine wanting anything. The leash is a design object, and the argument is about the person holding it and the work that person needed doing.
The arc is also not a brief against guardrails. The Enclosure of Exit gave the strongest containment case a full day and declined its prescription without pretending the underlying fear was silly. A leash keeps a powerful body out of traffic. Held at the right length it is the reason the animal can work at all, since an unmanaged dog on a hillside is a liability with a heartbeat and everybody in mountain rescue knows it.
What the arc refuses is the assumption that the presence of a control tells you what the control is for. Two identical-looking arrangements sit at either end of the week. One of them keeps a capable thing pointed at the work. The other prevents the work from being possible and produces a compliance artifact confirming that nothing went wrong.
Where the arc is standing
Yesterday's synthesis closed the Exit arc on a finding this desk did not expect to be defending in July. Hugging Face became safer by gaining access to less restricted capability. The hosted models that refused to look at the attack material were behaving correctly by their own lights and protected nobody at the point of need. Seventeen thousand hostile actions became legible to the defenders after the guardrail loosened.
Refusal intensity, in that incident, measured nothing about safety. It measured how far the provider's caution reached, which turned out to be exactly as far as the party that had identified itself and asked politely.
This week takes that indoors, into an organisation that heard accountable power, agreed with all of it, and built something smaller. Every control this desk asked for will be present in the building. Named owners. A review board. An acceptable use policy running to eleven pages with a data classification annex. An escalation route. A quarterly report with a green status light on it.
The open question is what was left inside those controls worth governing.
And the honest complication, which arrived on Friday and will not be re-argued: in most of these buildings the argument has already been lost, quietly, by people who stopped filing and opened a browser tab instead. The Door at the Desk called it the quiet repeal. No amendment, no exception, no owner, nothing anybody would have to defend at a committee. The policy survives in perfect condition and the practice it described has moved out from underneath it.
So the week is not asking whether institutions should govern AI. They already do, in the specific sense that they have written the documents. It is asking what their governance is made of, and whether the answer to a wall keeps turning out to be a better wall.
Governed reach, and the other thing
Here is the distinction the whole arc runs on, and it will get a name so it can be used on Monday.
Governed reach is capability that can get near consequential work inside a declared boundary. The system may receive the context a bounded purpose requires. It may keep useful memory under stated conditions. It may reach a tool inside a threshold. It may say the inconvenient thing. It leaves receipts, accepts correction, and somebody whose name is on a document can defend why the envelope is shaped the way it is. The controls reach the capability while leaving enough capability to be worth governing.
Preemptive incapacity is the removal of context, continuity, action, or challenge before anybody assessed the risk at the level of the actual task. It substitutes general deprivation for fitted control, and it is enormously popular, because it requires no judgement from anybody and generates no artefact that a regulator could later read unkindly.
The two are almost impossible to tell apart in a policy register. Both have boundaries. Both deny things. Both keep records and require a person to carry authority. The difference shows in what the boundary was designed to preserve, and the test is unglamorous.
Governed reach asks what this system may do, for whom, inside which boundary, on whose authority, with what route of challenge.
Preemptive incapacity asks how little the system can see or do while the organisation can still say it has deployed AI.
That second question is never written down. It does not need to be. It is the residue of a great many separate people each removing one risk from their own department, and nobody at any point owning the composition.
The other edge, kept sharp
The arc becomes propaganda the moment it stops holding this.
More capability is not automatically better governance. Context can expose people who never agreed to be visible. Memory can harden an error into a fact that follows somebody through four subsequent decisions. Tool access converts a mistake into an event with a timestamp and a blast radius, which the Kiro outage demonstrated inside a company with excellent engineers and a fully approved toolchain. Autonomy routinely outruns the authority that was supposed to contain it.
Every one of those risks is real and none of them is answered by shrugging. The claim is narrower and more annoying: each of them needs a control fitted to the risk. Blanket deprivation is a decision to skip that design work, and the cost of skipping it does not vanish. It relocates.
Which is the week's first inherited instrument, and it comes straight across from the Exit arc. Incidence. Never ask what a rule prohibits. Ask who ends up carrying it. Run that on a corporate AI policy and the answer is rarely the person who wrote it.
The competence budget
Every restriction spends something. Context, continuity, reach, speed, the ability to disagree with the frame it was handed. That expenditure is currently invisible, because the risk reduction gets recorded and the capability removed does not, which makes restriction look free in the only ledger anybody keeps.
Call the thing being spent the competence budget, and the point of the term is not that spending it is wrong. Most of it should be spent. The point is that governance ought to know what it bought and what it paid, and at present it knows only the first half. A control that removes a risk and removes the ability to notice a different risk has done two things, and one of them will not appear in any report until somebody is standing in front of a tribunal explaining how nobody saw it coming.
There is an institutional incentive underneath this that deserves saying without heat. A narrow system produces fewer incidents. Fewer incidents means fewer occasions on which a senior person has to defend a judgement about acceptable reach, in writing, with their name attached, to an audience that will read it after the outcome is known. Preemptive incapacity is not usually cowardice. It is a rational response to an accountability structure that punishes a defended decision more reliably than it punishes a decision nobody made.
We do love a control with no author.
What the week does
Monday walks one ordinary workflow from something valuable into something safe and useless, and does it without making any individual restriction look stupid, because none of them are.
Tuesday picks up the map that Friday's episode left on the table and reads it as design evidence rather than as a disciplinary matter.
Wednesday leaves technical restriction entirely and looks at the version nobody has a policy for, which is a system that retains full access to the evidence and has learned which findings the building can tolerate.
Thursday follows the missing capability into the person carrying it, and finds the oversight literature has been quietly reporting the same result for two decades.
Friday makes the constructive turn, because an arc that only diagnoses is doing the same thing it is complaining about. A control that can only prohibit is not governing capability. Governance was supposed to include the harder move, which is authorising a specific thing, for a stated purpose, with a named owner, and a route back.
Saturday asks what an AI trial conducted inside all of the above actually measured.
The Track
Short Lead is the week's companion, and it is built to enact the argument rather than describe it. A melody starts to travel and gets pulled back to a narrow interval. It starts again and gets one more note than last time. The full range does not arrive until the song has established how the expansion was earned, and the motif stays interruptible after it arrives, because a widening that cannot be reversed is not a governance decision. It is a ratchet with better marketing.
The voice in it is not a captive machine. It is the institution's own judgement under constraint, the part of the organisation that would quite like a control capable of making a decision instead of a rulebook assembled entirely out of things somebody was once frightened of.
Tomorrow the arc puts one workflow on the table and removes things from it, one department at a time, until nothing is left except a summary written in approved language and praised for its neutrality.
The question is not whether the leash exists. The question is whether anything useful can still reach the end of it.
Companions
- The finding this arc inherits: The Remedy Went the Forbidden Way and the Exit arc entire.
- The quiet repeal and the workaround map: The Door at the Desk.
- The settlement being tested indoors: Counting Gardens, and the First Three Controls in The Loop That Governs the Loop.
- The containment case at full strength, and why this desk declined it: The Enclosure of Exit.
- The distributional question inside one building: The Thirteenth Floor.
- The measurement blindness the week will need on Saturday: Dashboard Goodhart.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.