The model has a policy. The decision has no plan.

Here is an uncomfortable observation: the CIO press is right. AI governance has become an unmanageable chore — because it was built as one. This week one outlet said so outright, the security writers moved the interesting controls to "the moment before execution", and two consultancies packaged governance as enterprise architecture, which is what consultancies do when a problem survives its first framework. The failure mode underneath all three stories is decision volume. Manufacturing paid for that lesson on plant floors in the 1980s. You cannot inspect quality into a stamping at final inspection. You cannot inspect governance into a model at the committee. Same error, different decade.

The committee was built for twelve decisions a year

A model review board is a decent instrument for slow, few, consequential decisions. Three approvals a quarter, each with its dossier and its hour of debate, is twelve decisions a year — and a committee can just about govern twelve decisions a year. An agent system approving purchases, price changes, credit claims and engineering changes runs at thousands of decisions an hour. The mechanism did not get slower. The volume outran it by three orders of magnitude. End-of-line inspection fails at rate, whether the product is a stamping or an approved invoice.

I once watched a customer try to contain escaping weld nuts with final inspection: six inspectors across three shifts. At 900 parts an hour, 98 per cent detection still ships eighteen bad parts an hour, and perfect detection does not exist on a night shift. The fix was not more eyes at the end. It was a sensor on the press and an automatic stop. The defect went to zero because the process stopped producing it.

A flagship phone reportedly hitting production problems this week is the same story in a different uniform: end-of-line discovery, no upstream control, the reaction plan improvised in public.

Port the control plan, don't invent the framework

Nobody in quality engineering answers a rate problem by inventing a new philosophy. We open the PFMEA and port the logic. Identify what can escape — which agent decision classes touch customers, money, regulators or safety. Rank them by severity, occurrence and detection, and accept that most classes score low and need nothing but logging. For the ones that score high, predefine the reaction plan: trigger, owner, clock, containment, escalation tier. Then give a named human being the authority to stop the line.

This week's security writing presents the moment before execution as a discovery. It is not. That is a poka-yoke with a forty-year pedigree; Shingo built the reasoning before the job title CISO existed. We called the gate a reaction plan and the thing it guarded a significant characteristic. Build the table before deployment, or you will improvise it during an incident — and improvisation at machine rate is not governance.

A model can recite a policy. Only a system can execute a plan.

When I built the quality organisation for a 900-plus employee greenfield plant, we did not start with a governance manual. We started with escalation tiers: what triggers a QRQC, who is in the room within the hour, which severities reach the plant manager, which reach the customer proactively. A3 and 8D came after, as structure for the fix rather than permission for the failure. We ran a quarter with zero critical customer escalations and cut defect costs by 70 per cent — not because anyone reviewed harder, but because the reaction was designed before the event. Heroic review is what you buy when you declined to plan.

What running 63 models taught me about runtime gates

I also run a private-beta platform, MultiPS, that orchestrates 63-plus models in parallel with consensus synthesis. It is my living laboratory for this argument. Every output is cross-examined by independent models before anything ships, and the design rule that matters is this: disagreement escalates, it does not average out. Divergence on a characteristic that matters is the signal. Averaging it is how you manufacture confident nonsense with a decimal place attached.

Runtime gates cost real money, so tier them. Full consensus on every output multiplies inference spend by an order of magnitude and adds latency nobody will pay for. The control-plan answer is hard gates on high-severity decision classes, logging and sampling on the rest. Be equally honest about when consensus is theatre: five models asked the same question in the same words, majority-voted, is a committee with no chairman. Structure the cross-examination — different prompts, adversarial roles — or you are buying comfort, not control.

From the ethical-hacking side of my life: I hold a CEH, and I do not trust a gate I have not attacked. Prompt-inject your own agents. Feed them poisoned context. Race the reaction clock. If the escalation fires late, or fires at nobody, you do not have a control — you have an alibi. An IndustryWeek piece argued this week that supply-chain visibility needs leadership, not tools; swap the noun and the sentence survives.

The pattern is old, which is the good news. Know what can escape. Plan the reaction before the event. Give someone the authority to stop the line, and mean it. Every quality organisation I have built or rescued reduced its governance to those three sentences eventually; the operations that argued longest were the ones with the thickest binders. AI agents do not need a new philosophy. They need the discipline that already works at rate. The model has a policy. Until the decision has a plan — a trigger, a name, a clock and a stop — the governance around it is a newsletter, and everyone on the distribution list knows how the story ends.