We Are Arguing About AI Governance Without a Single Number
How many of the consequential actions your agents took last week were backed by an authorization decision that was actually evaluated at the moment of the action?
There is a question I have started asking people who tell me their AI agents are governed. Not “which platform,” not “what’s your policy framework,” not “are you zero trust.” Just this:
How many of the consequential actions your agents took last week were backed by an authorization decision that was actually evaluated at the moment of the action?
Nobody has the number. Not because they are careless. Because the number is not produced anywhere, by anyone, as a matter of course. It is not on a dashboard. It is not in a vendor report. It cannot be pulled from a log without a genuinely difficult reconstruction across systems that were never designed to be joined.
Sit with that for a second. We are two years into a technology that acts on our behalf, at machine speed, with delegated authority, against systems that hold money and records and other people’s data. And the most basic empirical question about whether the guardrails are load-bearing has no answer, because the measurement does not exist.
That is not a security problem. That is a data science problem wearing a security costume.
The debate has been definitional, and definitional debates never end
Look at how the governance conversation actually runs. A vendor says their platform provides “continuous, agentic, per-action authorization.” A competitor says theirs is “identity-native with fine-grained runtime control.” A buyer nods, or doesn’t, on the basis of a slide.
Every one of those phrases is a label. Labels are argued, not tested. And an argument that cannot be tested does not converge. It just persists, at conferences, in procurement cycles, in comment threads, until everyone is exhausted and the loudest brand wins by default.
This is the failure mode. Not that we lack good frameworks, we have plenty. Not that we lack standards, the relevant ones are published and stable. The failure is that we have accepted a conversation in which claims are made and never scored.
Data science is, at bottom, one discipline enforcing one rule: if you cannot state the measurement that would show you are wrong, you are not making a claim, you are expressing a preference.
That sentence does a lot of work, so let me slow down and unpack it, because it is the load-bearing idea in everything that follows.
The difference between a claim and a preference
Two people are talking about the same system. Listen closely to what they are each actually doing.
Person one: “Our agent governance is strong.”
Person two: “Ninety percent of our agents’ state-changing actions are backed by an authorization decision evaluated within the same second as the action. I expect that to hold above eighty percent as we scale. If it drops below fifty, our governance model is session-shaped and I am wrong about it.”
Person one has told you how they feel. Person two has handed you a loaded weapon and pointed it at their own argument.
Here is the test that separates them, and you can run it on any statement in about ten seconds:
Can you describe, concretely, an observation that would force the speaker to abandon the claim?
For person two, trivially. Go count. If the number comes back at thirty percent, they said in advance they would concede, and they either concede or reveal themselves as dishonest. Either way, you learn something.
For person one, try it. What would “strong governance” have to look like, in data, to be false? Any evidence you produce can be absorbed. Show them an incident: that was an edge case, and our controls caught it downstream. Show them a broad token scope: that’s intentional, we tier by risk. Show them nothing at all: see, no incidents. Every possible world is compatible with the statement. Nothing can dislodge it.
A statement that is compatible with every possible outcome tells you nothing about the world. It tells you about the speaker. It is a preference, dressed as an assessment.
Why this matters more than it sounds like it does
The instinct is to hear this as a plea for precision, or worse, as pedantry. It is neither. It is about what an argument can do.
A claim can be settled. A preference can only be won.
When two falsifiable claims conflict, there is a procedure: identify the observation on which they differ, go make it, and one side updates. The argument has a terminus. It costs money and effort to run, but it ends, and it ends in knowledge.
When two preferences conflict, there is no procedure. There is only persuasion. And persuasion is decided by things that have nothing to do with whether either party is right: who has the bigger platform, the better slide, the more senior title, the louder voice, the larger marketing budget. The argument does not terminate. It just gets won, by whoever was going to win any argument.
This is why unfalsifiable claims are not merely useless. They are convenient. They shift the outcome from a domain where evidence decides to a domain where power decides. Nobody has to intend this for it to happen. It happens by default, every time we let a claim into a serious conversation without asking what would refute it.
Notice, too, that the falsifiability test says nothing about whether a claim is true. Person two might be wrong. Their number might come back terrible. That is fine. That is the point. A false falsifiable claim is worth more than a true unfalsifiable one, because the false claim can be corrected and the unfalsifiable one cannot be examined at all. Being wrong out loud, in a way that can be checked, is the most useful thing a professional can do.
The three moves that turn a preference into a claim
You do not need a statistics background to run this. You need three habits.
1. Name the unit. Not “governance,” but what, counted, over what. Decisions per action. Actions per grant. Percentage of actions with an attributable decision. The instant you are forced to name a unit, vague virtues resolve into specific quantities, and half of them turn out to be uncountable, which is itself the discovery.
2. State the number that hurts. Before you look. Say out loud: “if it comes back below X, I was wrong.” Pre-registering the threshold is what stops you from moving the goalposts after the data lands, and every one of us moves the goalposts when we are allowed to. I have done it in this very thread of work and been caught doing it.
3. Name the observation you cannot make, and ask why. Sometimes you name the unit, you set the threshold, and then you discover the measurement is impossible with the data that exists. Do not treat that as a dead end. It is the most interesting result available, and I will come back to it, because in this domain it is the result.
Apply this rule to AI governance and most of what we say out loud collapses immediately. That collapse is not a crisis. It is a starting point, and it is the most productive thing that could happen to this field.
What changes when you replace a label with a ratio
I have been working through one such measurement: the ratio of freshly evaluated authorization decisions to consequential agent actions. Call it whatever you like. The name does not matter and I am not selling it.
What matters is what happens the moment you take it seriously.
Your definitions become load-bearing. What counts as “consequential”? Does a cached policy decision, replayed, count as a decision? Does a re-login count as an authorization? These sound pedantic until you realize that each one is a place where a comfortable story hides. You cannot compute a number without answering them, and you cannot answer them without discovering what you actually believe.
Your data pipeline exposes your architecture. The moment you try to join an authorization decision to the specific action it licensed, you discover the join key does not exist. Authorization systems record who was allowed; action systems record what happened; nothing records that this decision permitted that action. You went looking for a statistic and you found a structural gap in how the entire industry instruments itself.
Your shortcuts become visible as shortcuts. The tempting fix is temporal correlation: attribute each action to the nearest preceding decision. It produces a clean join and a plausible number. It is also worthless, because if one grant licensed a thousand actions, that method happily reports a tidy result while erasing exactly the failure you were hunting. Any data scientist recognizes this immediately. It is the method manufacturing the finding. And the fact that it is the obvious thing to do is precisely why the measurement has to be built with care rather than convenience.
Your biases acquire a direction. When an agent acts under a delegated human identity and no acting-agent claim is emitted, that action is booked to a person and disappears from your agent population. Which means your measured governance quality is systematically better than reality. Not noisier. Better. The error flatters you. A number that flatters you in a known direction is still enormously useful, as long as you say so, because now you can report it as an upper bound and know the truth is at least as bad.
None of that is a security insight. Every line of it is standard empirical hygiene, and it is transformative here purely because nobody has applied it.
Why the specific solution does not matter, and the posture does
I want to be careful about what I am arguing.
I have a proposed mechanism. Others have better ones, and the underlying standards have existed for years. The remedies are real and they are not the point.
The point is the posture. The willingness to say: here is the number that would prove me wrong, here is how I would compute it, here is the bias in my method, and here is what I will accept as disconfirmation.
Take that posture to any contested technology claim and watch what happens. It does not settle the argument in your favor. It does something more valuable. It converts an argument that could run forever into one that terminates in evidence. The claim either survives contact with the logs or it does not.
And notice who this disadvantages. A measurement-first posture is worst for whoever currently benefits from the claim being unfalsifiable. In this case, that is any platform selling governance grain it has never been asked to demonstrate. Not through malice. Through the ordinary reason that nobody builds an instrument that can only embarrass them, and no customer has yet required one.
That last sentence is the whole essay, so let me say it plainly: the measurements that do not exist are not randomly distributed. They are missing precisely where someone benefits from the absence. Which means the discipline of asking “what would I measure, and why can’t I?” is not a technical hobby. It is a way of finding out who the current information asymmetry is serving.
Why this should interest you even if you never touch an agent
Strip out the AI and the pattern is everywhere.
We debate whether remote work hurts productivity without agreeing on what productivity means. We debate whether a policy is working without pre-registering what failure would look like. We debate the impact of a reorg, a platform migration, a strategy, and in each case the debate is definitional, unbounded, and ultimately settled by seniority or volume rather than evidence.
The data science instinct is not “use more data.” Most organizations are drowning in data and starving for measurement. The instinct is narrower and harder:
State the claim so precisely that it could be false.
Name the observation that would falsify it.
Build the measurement, honestly, including the parts that hurt.
Report the bias direction.
Accept the result.
Step five is where almost everyone fails, and it is the only one that makes the other four worth doing. Any framework that reinterprets every possible outcome as confirmation is not a framework. It is a horoscope with a dashboard. I have written versions of that and had them taken apart, correctly, by people who noticed I had rigged both branches to agree with me.
The ask
You do not need my ratio. You do not need my pattern. Pick the claim that matters most in your organization, the one everyone repeats and nobody has ever tested, and ask the two questions.
What number would tell me this is false?
Why does that number not exist?
The second question is usually the interesting one. It is where the architecture is, and the incentives, and the reason the argument has lasted this long.
In agent governance, the answer to the second question turns out to be: because the systems were never asked to produce it, and the standards to produce it have been sitting there, published, unused, waiting for a buyer to require them.
That is not a technology gap. It is a demand gap. And demand gaps close the moment enough people start asking for the number.
The vendor names the grain. Your logs keep the score. Go get the logs.