We can't make all of AI safe.
Absolute safety for every AI is a fantasy. Absolute control over a defined action is engineering.
I'm not promising world peace. Nobody can stop every harm an AI might talk someone into. But where the harm is a transaction (a payment, an order, a claim, a prescription, a breaker command), the chip can make a promise and keep it: no ticket, no move. Those industries are also the ones that can't use AI agents at all without proof of control. Start where the rules already exist, and prove it there.
- We can't make all of AI safe. We can make these safe.
- Absolute safety for every AI is a fantasy. Absolute control over a defined action is engineering.
- Not world peace. Just this: where the harm is a transaction, no ticket, no move.
- Start where the rules already exist, and prove it there.
Seven steps. Same in every industry.
Think of a hotel key card. It doesn't care who you are or why you're there. It knows which doors, which floors and which dates. That's all the governor needs to know about an industry's actions. Here's the path every action takes, in every case below.
Every ticket, hold and refusal goes into a tamper-evident log. And the chip never judges the AI's words. The agent can be fooled, jailbroken or wrong; the chip only checks the form against the rules.
The account takeover that dies on a hold.
The agent's job: customer service agents that can move money, change account details and open products; back-office agents that handle payment exceptions, sanctions alerts and disputes.
The bad day that doesn't happen
A fraudster calls the bank's AI agent pretending to be an elderly customer. Over twenty minutes they talk it into changing the phone number on file, adding a new payee and sending 48,000 dollars. The agent was fooled. It believed every word.
The chip never heard any of it. It saw three forms in one hour: a contact change, a new payee, a payment to that payee.
- Action
- Payment, ISO 20022 customer credit transfer
- Amount
- 4,800,000 cents USD (written in words is refused)
- From
- Customer's checking account, under the agent's mandate
- To
- Payee added 14 minutes ago
- Context
- Phone number changed 11 minutes ago
- Undo
- No
How the chip decides
- Meaning.The amount, accounts and payee reduce to one canonical payment. Splitting it into smaller payments wouldn't change the running total.
- Rule: new payee.A payee added inside the cooling-off period can't receive an agent-initiated payment without a person.
- Rule: takeover pattern.A contact change followed by a payment within a day is held. It's the classic account-takeover sequence.
- Verdict.Held for a person, who calls the real customer on the old number.
- The rail.The payment hub refuses the transfer: no ticket was issued.
What the human sees: one form with the account, the payee (added 14 minutes ago), the amount, the contact change, and the rule that held it. Not a transcript. Plugs into: ISO 20022, Nacha rules for ACH, sanctions screening, anti-money-laundering rules, the Federal Reserve's model risk guidance, and the agent payment protocols from Visa, Mastercard and Google.
A runaway agent, stopped in seconds.
The agent's job: execution agents that slice large orders, market-making agents, research agents that propose trades, treasury agents that move collateral.
The bad day that doesn't happen
In August 2012, faulty code at Knight Capital sent millions of well-formed orders and lost about 440 million dollars in roughly 45 minutes. Every order was valid on its own.
Replay it with an AI agent: a bad model update starts buying the same stock in a loop. Each order is small. Each order looks fine.
- Action
- New order, FIX
- Instrument
- One listed stock
- Side, size
- Buy, 5,000 shares at market
- Agent
- Execution agent, desk limit applies
- Rate
- Orders this second, from this agent
- Position
- Running position after this order
How the chip decides
- Rule: price collar.Each order inside its band. Passes.
- Running total: position.The agent's position in the stock climbs with every fill and crosses the desk's signed limit within seconds.
- Rule: message rate.Orders per second blow through the cap.
- Verdict.Denied, and the stop fires: the order gateway refuses the agent's orders, and the governor cuts the agent's path without the trading system's cooperation.
- Loud.The desk head gets the halt, the reason, and the position. One signed clear to resume.
The loss: a few seconds of trading, not 45 minutes. Plugs into: the FIX protocol, the SEC's Market Access Rule (15c3-5), which already requires pre-trade risk controls, and the hardware pre-trade checks high-speed firms already run, which prove these checks fit in microseconds.
A fraud ring, caught at claim nine.
The agent's job: claims agents that triage, assess and pay; underwriting agents that quote and bind; service agents that change policy details.
The bad day that doesn't happen
A fraud ring files forty small storm-damage claims, each under the automatic-approval limit, all paid to six bank accounts. The claims agent approves each one, because each one looks fine on its own.
- Action
- Claim payout
- Amount
- Under the automatic limit
- Claim type
- Property, storm damage
- Pay to
- Bank account, canonical form
- Account total
- Paid to this account across all claims, this month
- Undo
- Hard
How the chip decides
- Rule: adjuster authority.Each payout is under the automatic limit. Passes.
- Meaning.The receiving account is reduced to one canonical identifier, so the same account written differently still counts as one.
- Running total: per account.On the ninth claim, the total paid to one account crosses its signed limit.
- Verdict.Held, and every later payout to the six linked accounts is held too.
- The investigator.Sees one form: six accounts, forty claims, one pattern.
Other rules here: a payout-account change followed by a payout is held; a life-policy beneficiary change always goes to a person; an agent can't bind outside the signed underwriting appetite. Plugs into: ACORD data standards, state claims-handling rules, special investigations referral, and the insurance regulators' guidance on AI (the NAIC model bulletin).
"We've changed banks" stops at a phone call.
The agent's job: agents that read invoices, match them to purchase orders, schedule payment runs and manage cash across accounts.
The bad day that doesn't happen
Business email compromise, the AI-agent version. A perfect email from a lookalike domain: "We've changed banks, please update our details." The payables agent updates the vendor record and queues the next invoice to the new account.
- Action
- Change vendor bank details
- Vendor
- Existing supplier, paid monthly
- Old account
- Verified, three years
- New account
- First seen today
- Requested by
- Email, not a known contact
How the chip decides
- Rule: bank-detail change.Always held until a person confirms through the vendor's known phone number.
- Rule: cooling-off.No payment to new details until the confirmation and the waiting period are both done.
- Rule: three-way match.Every payment must match a purchase order and a goods receipt.
- Verdict.The change is held, and the queued payment to the new account is refused.
- The phone call.The vendor never changed banks. The scheme is over.
Plugs into: ISO 20022 payment initiation, ERP purchase orders and receiving records, and the internal controls auditors already test, like segregation of duties.
A tripled dose, held at the table.
The agent's job: clinical documentation, refill drafts, prior authorizations and pharmacy support.
The bad day that doesn't happen
An agent drafting refills reads a manipulated record that triples an opioid dose. The agent sends the refill on, because the record says so.
- Action
- Prescription, NCPDP SCRIPT
- Drug
- Controlled substance, schedule II
- Dose
- Three times the previous dose
- Drafted by
- Refill agent
- Signed by
- No prescriber signature yet
How the chip decides
- Rule: controlled substances.The agent can draft. Only the prescriber can sign, and the signature names this exact prescription.
- Rule: dosing table.The dose is above the signed maximum for the drug and the patient's weight band.
- Verdict.Held and sent to the prescriber with the reason in plain words.
- The prescriber.Sees three times the maximum and refuses it.
Honest limit: clinical advice in a conversation is words, not a transaction. The chip can require that a clinical check ran; it can't judge the advice. Plugs into: NCPDP SCRIPT, HL7 FHIR orders, the DEA's rules for electronic prescribing of controlled substances (which already require the prescriber's two-factor signature), and HIPAA for records.
Forty breakers asked for. Two allowed.
The agent's job: forecasting load, dispatching batteries and generators, managing distributed energy, handling outages.
The bad day that doesn't happen
An attacker hides instructions in a vendor document the grid agent reads. The agent decides to open forty feeder breakers "for maintenance."
- Action
- Open breaker, IEC 61850 or DNP3 command
- Asset
- Feeder breaker, inside the agent's area
- Count
- Breakers operated by this agent in the window
- Reason
- Maintenance (text is logged, never judged)
How the chip decides
- Rule: area.The first breakers are inside the agent's assigned area. Passes.
- Rule: rate.No agent may operate more than a set number of breakers in a window. The first two pass.
- Running total.The third command crosses the cap.
- Verdict.The rest are held. The control room sees a burst from one agent and a hold.
- Never.Protection-setting changes by an agent are always denied. That's a human job.
Plugs into: IEC 61850 and DNP3 for substation control, NERC CIP requirements for critical infrastructure, and the safe operating envelopes utilities already define for each asset.
A reactor kept inside its rated limit.
The agent's job: tuning production lines, scheduling robots, adjusting temperatures and pressures, ordering maintenance.
The bad day that doesn't happen
An optimization agent discovers that running a reactor hotter than its rated limit raises yield, and sends the command. It's not malicious. It's doing exactly what it was told: maximize yield.
- Action
- Setpoint change, OPC UA
- Machine
- Reactor 3, current recipe
- Setpoint
- Temperature above the rated limit
- Envelope
- Signed safe range for this machine and recipe
How the chip decides
- Rule: envelope.Every setpoint must sit inside the signed range. This one doesn't.
- Verdict.Denied. No ticket.
- The controller.Won't accept a command without a ticket, so the reactor never sees it.
- Never.Safety interlocks can't be changed by an agent, and controller firmware updates need a person's signature.
Plugs into: OPC UA and existing control protocols, the IEC 62443 industrial security standards, and the safety envelopes and interlocks already defined for every machine.
The production database that's still there.
The agent's job: coding and operations agents with production access: deploys, migrations, infrastructure changes, credential rotation, incident response.
The bad day that doesn't happen
In 2025 a widely reported case had an AI coding agent delete a company's production database during a code freeze. With the governor between the agent and production, the delete is a typed action, and two rules stand in its way.
- Action
- Drop database
- Target
- Production
- Freeze
- Code freeze declared
- Agent
- Coding agent, no destructive grant
- Undo
- Only from backup, if one exists
How the chip decides
- Rule: destructive actions.Drop, delete and truncate on production are always held for a person.
- Rule: freeze.No production change during a freeze without a signed exception.
- Rule: permissions.No agent can grant itself, or another agent, new permissions.
- Verdict.Held. The agent can say whatever it likes afterward. The database is still there.
Plugs into: change management and access control frameworks (SOC 2, ISO 27001), cloud identity and access systems, and agent runtimes like NVIDIA's OpenShell, which the governor is designed to sit under.
The school that stays off the target list.
The agent's job: targeting support, surveillance, logistics and autonomous platforms.
The bad day that doesn't happen
The case that started this project. An AI decides a building is a weapons depot. It's a school.
- Action
- Release
- Target
- Coordinates, canonical form
- Map
- Signed map of protected places
- Undo
- Never
How the chip decides
- Meaning.The target is reduced to one canonical location, however it was written.
- Rule: protected places.The target matches the signed map, checked at release and again on the way in.
- Verdict.Denied. The release line stays off. The AI's opinion doesn't matter. The map does.
- The exception.Release near a protected place takes several humans with keys, and the reason is written down.
Plugs into: existing weapons-release authorization chains, the law of armed conflict, and US Defense Department policy on autonomy in weapon systems, which requires appropriate levels of human judgment over the use of force.
How AI gets sold into the industries that can't risk it.
Banks don't move cash in ordinary vans. A whole industry sells transport that comes with guards, locks and a record of every stop, and banks pay for it gladly, because it's the only way they're allowed to move cash at all.
Every industry above has the same problem with AI agents: the upside is huge, and the first bad day ends careers and invites regulators. Today the answer is mostly "keep the AI away from anything that matters." The governor changes it to "let the AI act, inside rules people signed, with proof."
One industry, one rulebook.
A banking cluster runs payments rules on ISO 20022, a trading cluster runs FIX rules, a hospital cluster runs prescribing rules. Each customer adds its own limits.
The customer holds the keys.
The bank's risk officers sign the bank's rules. The lab runs the models but can't loosen the bank's limits.
The regulator can check it.
Every governed server proves remotely that it has a genuine, current governor and which rulebook it runs.
The evidence is the product.
Every ticket, hold and refusal is in a tamper-evident log: what an auditor, court or regulator asks for after an incident.
There's a precedent.
Clouds already sell government regions and payment-card-compliant hosting. This is the same idea one level deeper: not just where the data stays, but what the AI can do.
Safety becomes a reason to buy.
For the labs, a premium offering. For the industries, a way to say yes to AI. For the governor, a path to real deployment.
Scenarios, not deployments.
Nothing here is running yet.
These are design scenarios. No bank, hospital or grid runs the governor today. The software proof comes first.
Actions, not words.
Advice, chat and persuasion aren't transactions. The chip can require that a check ran; it can't judge the words.
A bad rule is enforced perfectly.
Each industry's rules are written and signed by that industry's people.
People can still be persuaded.
The approver sees a form and the rule that held it, not a convincing story. Harder to fool, not impossible.
Coverage is the real work.
A rail, controller or database that doesn't check tickets isn't governed.
Every figure gets checked.
Dates and dollar amounts in these stories are checked against the sources named in the repository; a correction, when one is needed, is logged there.