A VCDesign-specific extension
AI extension
AI supports judgment but never holds responsibility. Capability does not imply authority.
AI governance is a VCDesign-specific extension kept outside the six core parts (Δ, responsibility, boundary, decision, declaration, metrics). The norms are in policies.yaml (ai_extension, haltability), metrics.yaml (ai_extension) and axioms.yaml (A3, A4). This page follows the explanatory frame in docs/ai-extension.md.
1. Premise: adopting AI is a boundary design problem
When discontinuous inference (AI) is connected to real systems that run continuously, explainability, haltability and responsibility must not be lost. That is the central question of AI governance.
AI may analyze, detect patterns, recommend, detect anomalies and collect evidence of spread signals; it may classify automatically and prioritize subject to review. It never makes final decisions, assigns responsibility, or executes Reframe, Retire or Expand.
2. Four loops and time scales
| Loop | Role | Time scale | Main risk |
|---|---|---|---|
| Physical | Execution, stability, continuous dynamics | Milliseconds to hours | Destabilizing reality, irreversible damage |
| Semantic | Interpretation, giving meaning to Δ, discontinuous inference | Seconds to days | Reading noise as Δ, missing meaningful change |
| Value | Objectives, constraints, direction of optimization | Days to quarters | Hidden rewriting of objectives |
| Responsibility | Final decision, halt, accountability | Immediate to the whole lifecycle | Operations that cannot be stopped, disappearing responsibility |
- The loops are not collapsed onto one clock. Fast loops do not rewrite constraints set by slow loops (axiom A4). Semantic updates do not bypass value review.
- The slow governing loop can always stop the fast executing loops.
- The components allowed and forbidden in each loop are in
policies.yaml ai_extension.loops.
3. Where LLMs belong
LLMs belong mainly in the Semantic loop. They may interpret and recommend, but they do not control the physical world, set objectives or hold final authority. An explicit gate is required before an LLM output has any real-world effect (ai_extension.llm_placement).
4. Models, agents and the execution gate
| Aspect | Model | Agent |
|---|---|---|
| Reach | Output text, classification, inference | Tool execution, writes to external systems, chained operations |
| Time | A single inference | Multiple steps, long-running |
| Boundaries | Two faces: input and output | A boundary at every operation |
| Responsibility path | The final decider is one layer up | Deciders are scattered across steps |
| Difficulty of halting | Low | High (needs safe interruption mid-execution) |
A plan being reasonable is not the same as execution being authorized. An agent passes a gate that checks the following before it acts (ai_extension.agent_execution_gate):
- The action is within declared authority (responsibility boundary B17 Impact ↔ Accountability)
- The responsible actor is identified
- Reversibility is declared; if irreversible, the max loss is declared
- A halt owner is named before start
Three things are avoided: a direct path from an LLM to an actuator, silent rewriting of goals, and treating an agent's plan as approval to execute. The supervisor is the final convergence point of responsibility and never delegates the final decision to AI.
5. Haltability
Haltability is a precondition of responsibility governance (policies.yaml haltability).
- Every operational path has a named halt owner
- Emergency stop bypasses non-essential automation
- Human override works under degraded conditions
- A rollback or safe state is defined
- After a halt, the reason and responsibility are reviewed and recorded
6. Five layers for external explanation
The four loops rearranged into five layers for explaining to others. The norms stay with the four loops.
| Layer | Content | Corresponds to |
|---|---|---|
| 5. Human Sovereignty | Humans can ultimately intervene, halt and explain | Responsibility loop, haltability |
| 4. Time | Separation of time scales and protection of slow loops | temporal_separation |
| 3. Responsibility | Who holds and explains what | Responsibility, handover records |
| 2. Agent | Execution boundaries, tool control, multi-agent coordination | Boundary pattern, agent_execution_gate |
| 1. Model | Inference, interpretation, proposal (output only, no execution) | Semantic loop |
The capabilities of a lower layer are not widened without the governance of the layers above.
7. Twelve principles for governable AI agents
- Capability is not authority — the ability to infer or act is separate from the authority to approve.
- Actions need boundaries — define in advance how far an agent may act on the outside world.
- Every action has a responsible owner — autonomy without an owner cannot be adopted by an organization.
- Leave the final decision to humans — AI goes as far as proposing, analyzing and prioritizing.
- Logs are structural memory — carry forward why a judgment was made.
- Value continuity over local optimum — AI that can be reused, maintained and handed over, and that accumulates trust, is worth more.
- Do not hide uncertainty — when unsure, say that it cannot be determined (guard verdict: unknown).
- Time is a first-class constraint — the best answer changes between now, this week, next month and next year.
- Escalation is a feature — returning to humans is a designed safety mechanism, not a lack of ability.
- Multiple agents need a constitution — priorities, conflict resolution, separation of authority, common prohibitions.
- Replaceability protects sovereignty — avoid excessive dependence on one vendor or model (the concentration metric).
- Explanation and responsibility — internal reasoning may be opaque; the reason for adoption, execution history, responsibility path and halt conditions must be explainable.
8. Responsibility boundaries involved
| B# | Boundary | Where it matters for agents |
|---|---|---|
| B1 | Human ↔ AI Judgment | An agent closes decisions autonomously |
| B5 | Decision ↔ Action | The gate between decision and execution disappears |
| B6 | Responsibility Assignment | Responsibility diffuses across multiple agents |
| B10 | Temporal | A "decision for now" persists through long-running operation |
| B16 | Model ↔ Reality | An agent's actions contaminate its training data |
| B17 | Impact ↔ Accountability | Impact exceeds authority |
Definitions are in taxonomy.md and the list in registry.md.
9. What growth means
The growth of AI is measured not as increased model capability but as improved operational fit under responsibility constraints (metrics.yaml ai_extension).
For an application in manufacturing, see Examples: a factory AI agent.