The human is certified. The judgement isn't.

Governance vendors have discovered the human – specifically, the human's click. This week three of them converged on the same answer to AI risk: ServiceNow's AI Passport, AURÄI's platform built around a "certified human sign-off", and Boomi's pickup of Elementary Data for AI data quality. Three press releases, one theology. The machine decides, the human blesses, the log records. I have spent twenty years in automotive and aerospace plants making signatures mean something under AS9100, IATF 16949 and VDA 6.3, and I can read a stamp the way a jeweller reads a hallmark. Most of what these platforms are selling is a rubber one.

What a signature actually means in a quality system

In an audited quality system a signature is never ink. It is a claim, traceable to two artefacts: objective evidence that the work was done, and a competence record proving the signer was qualified to judge it. An auditor worth the badge chases the stamp backwards. Initials on a final-release record lead to the training matrix, the matrix to the qualification standard, the standard to the vision test, the calibration record on the gauge in the signer's hand. Dead-end anywhere on that trail and the signature is decoration; the nonconformity lands on the system, not the person.

Here is the version every plant manager recognises. Night shift, Tier-1 stamping plant, an inspector expected to sign off 400 parts an hour. Nine seconds a part, including walking, measuring and the record itself. He cannot verify what he signs. He verifies that the line is moving. What does the auditor do with that stamp? He treats it as evidence – not that the parts were checked, but that the control does not exist. The signature was never the control. The competence, the information and the time behind it were. Remove those and you have produced a liability with a name attached, which is precisely what now ships as enterprise AI governance.

The sign-off as a purchased control

PFMEA taught me the rule before any vendor did: a control must be validated, not merely present. If your detection rating assumes "operator verification" and the operator has nine seconds, your risk priority number is fiction. The same logic applies to a purchased approval node. The vendor certifies the workflow – encryption, immutability, timestamps, audit trail. All real. All beside the point. Nobody certifies the signer's data parity – whether the human sees what the model saw, or a dashboard with a green tick. Nobody certifies the time budget, or the stop authority – what a refusal actually triggers. The governance tier costs €60,000 a year; the recall it underwrites runs to seven figures. What is being purchased is the conversion of machine output into "human-approved" for legal purposes while nothing about the decision changes.

A signature transfers consequences, not competence. The model keeps its reasoning; you inherit its mistakes.

As an ethical hacker I was trained to look for the escape mechanism in any control. Here it is: diffuse responsibility at approval cadence. Forty approvals an hour means nobody decided anything and everyone signed. The launderette never asks where the washing came from. While the industry debates what autonomous models might do – self-replication warnings and the rest – the quieter risk is the approval chain that blesses it. Vendors now advertise inspection models with validated accuracy above 95 percent. Good. Validate the machine. Then show me the study validating the human beneath it.

Building sign-offs that can say no

A human authority node earns its place in a workflow the way a gauge earns its place on a line. Three conditions. Data parity first: the signer sees the inputs the model saw, its confidence, and where the models in the ensemble disagree – not a curated summary. Then a veto that is real: refusal is an exit from the pipeline, not an exception code that quietly re-routes to a friendlier signer. And a time budget maintained like gauge calibration, with an alarm when the approval rate approaches the click-through threshold.

The control itself gets revalidated at intervals. Run an attribute agreement analysis on approval decisions: three signers, thirty borderline cases, blind and independent. If signers agree with each other and with the final disposition below roughly 80 percent, your control has a repeatability problem no model has.

I build these nodes, not just critique them. My multi-agent orchestration platform runs consensus synthesis across sixty-plus models, and the human veto points are wired so a "no" halts the pipeline and opens a different path – re-ask, re-route, escalate – instead of retrying until someone else approves. The instinct is older than the platform. At SNOP, QRQC discipline put the right person at the right altitude with genuine stop authority, and that is what delivered zero critical customer escalations in a quarter, not a signature block. Most of the 70% defect-cost reduction came from fixing controls that existed on paper and failed at rate. Approval nodes decay the way gauges do, and for the same reason: use.

The certified signature is the new diploma on the wall – it photographs well in an audit deck and tells you nothing about the judgement behind it. Audit it like any other control: chase the competence record, test the data parity, time the refusal path, revalidate at intervals. Certifying the workflow while never auditing the judgement does not spread responsibility; it launders liability at machine cadence, and the laundered item is the signer. If the human cannot refuse, you don't have governance. You have a screenshot of governance.