What gets installed when no one is choosing.
AI, defaults, and who owns the decision. Once a week I take something real, a lawsuit, a product rollout, a line of fine print, and trace it back to the decision no one owned.
Free. One edition a week. Unsubscribe anytime.
When a powerful technology arrives faster than the institutions built to govern it, choices get installed by default rather than by anyone deciding.
One edition a week, short enough to read in a sitting and fully sourced, because the receipts are the point. Every claim is checked against a primary source before it goes out.
If you build, run, or answer for AI inside an organization, it is written for you. So is anyone who suspects the important decisions are being made by absence.
Something is deciding. No one has put their name to the decision. The distance between those two facts is where the cost collects.
Not choosing is a choice. When a tool ships with a default and no one stops to ask whether that default is right, the default becomes the decision. The cost rarely lands on whoever set it. It lands downstream, on the student, the patient, the worker, the citizen, whoever inherits a system no one chose on purpose.
The lag between what a technology can do and what our institutions are ready to govern is as old as governance. What this newsletter argues is that the lag has a structure, that the structure repeats across every domain AI is entering, and that the structure is what produces the costs the domain-level arguments keep failing to name. Once you can name it, you see it everywhere, and you notice the people absorbing its cost were never in the room.
NIST published a mathematical proof that no fixed set of AI guardrails can ever be complete. Read as governance, it ends the static policy binder as a matter of fact, not opinion.
NIST just did something rare. It published a mathematical proof. Apostol Vassilev, a senior scientist at NIST, took Kurt Godel's incompleteness theorems, the 1931 result that ended the dream of a complete and consistent system of mathematics, and applied the same logic to AI guardrails. The conclusion, peer-reviewed in IEEE Security and Privacy: there is no finite set of guardrails that is universally robust against adversarial prompts. For any fixed set of rules, a prompt that defeats them exists. It is only a matter of finding it.
Read that as a security finding and it tells you to keep red-teaming. Read it as a governance finding and it is bigger. It means a rule set you approve once cannot, even in principle, be complete. The static policy, written, signed, and filed in a binder, is not incomplete because someone was lazy. It is incomplete by proof. You cannot finish it. You can only keep working it.
That is the quiet end of one-and-done governance. Not a best practice anymore, a mathematical fact. A control that can never be complete cannot be approved and forgotten. It has to be owned, continuously, by someone whose job is the loop that never closes.
NIST's framing is Sisyphean, and it means that as a warning. I would read it as a job description. The rock does not stay at the top. The only question the proof leaves you is who is assigned to keep pushing it.
First shared on LinkedIn.
The body of work this newsletter grows out of. Field notes on governance, ownership, and staying in control, gathered from where they first ran.
Running a decision through an AI does not make it the AI's decision. Two regulators have proven it, with a bill attached.
The fastest-growing governance risk is AI-written code no human read, shipping inside what you buy, into your regulated environment.
A large share of what is sold as AI is performance, backstopped by people. The buyer inherits the gap.
Every layer of AI security limits or watches the agent. None governs whether the action was right. That gap is a missing owner.
A 2,000-word case for AI governance that never used the word. Its four fixes are inputs to a system, not the system.
If the firm's learning loop is its new IP, governance is the precondition for owning it, not just harm reduction.
Ownership is a function with three requirements: revision authority, exception visibility, and standing. Most have assigned none.
The market can certify who can use AI. It cannot certify who is accountable for the outcome.
If your board asked for a list of every place AI is used, who owns each by name, does that list exist?
Your AI systems are logged. Your AI decisions are not. Only a decision trail tells you who owned the call.
When a model goes dark, redundancy lets you switch providers. It does not restore the judgment you outsourced.
Your AI vendors are counterparties, not just products. Their financial durability is a risk most frameworks assign to no one.
If the system decides what escalates, the human checkpoint is a feed with a nicer font.
Vendor-side agents ship as a feature and switch on with a click. The scope you clicked becomes your de facto policy.
The US leads on capability and ranks 21st in the capacity to use it. The countries ahead built governance infrastructure first.
A reassuring data promise on the screen everyone sees, and a very different one on the screen almost no one opens.
Features ship faster than the docs that describe them. The control has to live in the decision, not the documentation.
Business-critical tech used to arrive through procurement, legal, and a named owner. AI bypasses all three.
AI does not just help your organization work. It teaches it how to work, and it can reinforce the familiar over the accurate.
Installing governance is not maintaining it. What governance drift is, and what a maintenance architecture requires.
Most organizations govern AI at the tool level. The risk lives at the decision level. The architecture that governs the space between.
Most organizations believe they are still figuring out AI. The system already shaping their decisions is either defined or running on its own.
A registry tells you what AI exists. It does not tell you who owns the decisions it is already making.
Two manuscripts, one argument pointed in two directions. Both are complete and moving toward agent and publisher conversations, published under Always Questioning.
How absence becomes a decision, and who pays the cost.
For the parent, the teacher, the leader. How the wrong defaults get installed when powerful technology arrives faster than the systems meant to govern it, and who absorbs the cost when no one is actually deciding.
A mother walking her newborn looked up at the end of her block and saw a camera with a solar panel on top of it.
Read the opening About the bookKeeping your judgment and your accountability as AI moves into the work.
For the operator and the professional who can feel the crosshairs. What it takes to keep your judgment, hold the context a working life builds, and stay in the decision instead of letting it get made by absence.
A consequential judgment was delegated to a system with no accountable human owner, and by then there was no room and no one in it.
Read the opening About the book