Governance You Inherit
The sequel to Everything Implicit Becomes Infrastructure. I built the whole table — and the seven things break identically for every operation, so the floor is reusable, and reusable governance is the
Last week I published a table. Seven rows — context, trust, review, enforcement, attribution, incentives, memory — and one law running through all of them: everything that’s free when you work alone must be built when you don’t. I ended with a line I’ve been chewing on since: every organization adopting AI will need some version of that table, built, bought, or bled for.
This essay is what I learned by finishing it — and why finishing it once should mean nobody I work with has to.
Because a table is a claim, and claims are cheap. So I made it real — and here I should be honest about how, because the speed is part of the point. I did not build seven systems from nothing in a week. Most of the parts were already there, built one at a time over the past year, each in its own corner solving its own problem: a lockfile that records what the AI actually knew on each job; a ladder an action climbs by keeping a clean record and slides down the day it doesn’t; review priced by risk; rules compiled into gates instead of written into prompts; an accountability record for every consequential action; evidence that buys lighter review, clawed back when it proves wrong; a memory ledger that outlives the session.
What I did was unify them. One law, one vocabulary, one screen you can open. Seven capabilities that had grown up apart — each shipped dark first, present and measured but switched off, then turned on only where it earned its place — stopped being seven features and became a single floor. The coherence was the work. It went fast because I wasn’t pouring concrete; the concrete was already down, in seven separate slabs, and the job was setting them level.
I’m not going to re-walk the rows. The last essay did that. What I want to report is what unifying all seven taught me that building them one at a time never did.
The floor is the same for everyone
When you build one governance layer for one operation, it looks bespoke. You’re solving this firm’s problem, and it feels particular to them.
When you build all seven, for the range of operations I run them for — a patent firm, a managed-IT shop, a wealth advisor — you notice something you can’t un-see. The seven things break identically. Same failures. Same order. The AI doesn’t know the thing that lived in someone’s head; it acts somewhere it shouldn’t; the review queue outruns the reviewer; the rule that was only ever a wish gets skipped; nobody can say who was answerable; polish starts passing for correct; the hard-won lesson evaporates. That sequence is not a property of law, or of IT, or of wealth management. It’s a property of handing work to a machine that starts from zero.
The only thing that differs between a law firm and an MSP is the one action at the top that is genuinely dangerous. For the patent firm it’s a filing deadline you cannot miss. For the managed-IT shop it’s a change pushed to a client’s production system. For the wealth advisor it’s money moving, or advice that a regulator will read. One dangerous surface each — and underneath it, the identical floor: the same reversibility gate holding the same line, asking the same question about whether this particular action has earned the right to happen unattended. Swap the top action and the machinery beneath is unchanged.
That’s the discovery. Governance is not seven features per customer. It’s one floor, and a thin layer on top shaped to that operation’s high-stakes surface. Ninety percent of it is shared. Which means the expensive part — the part every company is currently told to build for itself — is reusable.
Inherited, not commissioned
Right now the industry sells this as a project. Hire the platform engineer. Stand up the audit pipeline. Write the policies. Build the review queue. Every company builds its own floor, from scratch, usually badly, and usually right after the incident that proved they needed one. The cost of the floor gets paid over and over, by everyone, in parallel, for the same seven boards.
But a floor that’s identical for everyone should not be a project. It should be a utility. You don’t commission electricity — you don’t hire an electrician to invent the grid before you can turn on a light. You inherit the grid and pay for what you draw. The operations I run don’t build the seven rows. They inherit them on the first day, instantiated for their surface: the gate already knows a filing deadline is irreversible, the audit trail is already recording, the review queue already priced. The particular part — their dangerous action — is configured. The floor is not.
That is the entire difference between governance-as-project and governance-as-utility. And it is the only version of this that has software economics, because the costly work was done once and is drawn on by many, instead of rebuilt by each. Reusable governance isn’t a feature of the product. It is the product.
I’m standing on the floor I hand over
I can say the floor is reusable because I’m customer zero, and I don’t get a different one.
The system that builds all of this is itself run by AI agents, and those agents work under the same seven rows — the same context locks, the same earned autonomy, the same gates that will not let a commit through without proof the checks ran. I did not build a governed product using an ungoverned process. The floor I ship is the floor I stand on.
And the seventh row is the tell. Those agents keep a memory file so each session doesn’t pay again for what the last one already learned. That file kept lying to me in the most ordinary way: a note that was true in one month and confidently wrong the next, trusted the whole way down. So out of self-defense I’d given every volatile note an expiry date and a way to re-check it — trust until this date; here’s how to re-verify — and a lapsed date never meant delete. It meant verify before you rely.
When I built the memory row for the people I work with, I did not invent anything. I generalized the discipline I’d been using to keep my own memory honest: every lesson carries a re-verify horizon, the ones that go stale fastest flagged first, a lesson that keeps recurring after it was supposedly learned marked as failing. A remembered lesson that’s now wrong is worse than no memory, because confident and incorrect are the two ingredients of every expensive mistake. My own floor caught me before I shipped my own stale notes. Then I shipped the catch.
The last twenty percent, closed once
I called this series The Last 20% because the last twenty percent of an AI initiative — the part that isn’t the demo, the part that never closes — is exactly these seven rows. It’s the boring, load-bearing floor under the impressive thing, and it never closes because every company is asked to pour it themselves.
The anchor essay said everything implicit becomes infrastructure. The part I didn’t know when I wrote it is what happens after. Infrastructure, built once and correctly, stops being something each company builds and becomes something they inherit. I closed the last twenty percent once. The whole point of closing it once is that nobody I work with has to close it again.
You don’t commission the governance floor. You inherit it — and you spend your time building the business that stands on it.