Latest / The Autonomous Signal: AI Edition / The Authorization Question: Who Signs Off Before the Agent Acts? | 10.06.26
Transcript
- MARCUS: Hey, welcome to The Autonomous Signal: AI Edition. It's Tuesday, October sixth. The week has some momentum now, so let's use it. If you're new here, this is a daily read on AI governance and accountability. Real sourcing. Real opinions. No filler. I'm Marcus Webb. This one's made in the BCS labs, a human and AI collaboration on purpose, with people who've spent decades in this industry behind it. No slop. Every weekday. Today's got a theme. Before a machine acts, who said it could? California is writing that into robotaxi law. Researchers are sketching the layer that should decide. And Washington and Brussels are both asking who pays when it goes wrong. Now — the Signal. Aria, it is all yours. ARIA: Good morning, and welcome in. Let's start in California. ARIA: According to Engadget, Governor Newsom signed Senate Bill 1246 on September thirtieth. If a driverless robotaxi blocks an ambulance, a fire truck, or police for more than thirty minutes after officials ask for a technician, the operator can be fined up to ten thousand dollars. Per vehicle. Operators also have to keep written emergency procedures. They have to send local technicians when asked. And direct remote driving is limited to people located in the United States. The rules start in July twenty twenty-eight. MARCUS: Thirty minutes? That's a long time to be a roadblock. ARIA: It is. But notice what the law targets. MARCUS: Not the driving? ARIA: No. Not the driving model at all. The statute regulates the response. Written procedures. Named humans. A clock that starts when an official asks for help. State Senator Dave Cortese, who wrote the bill, put it this way: "When an autonomous vehicle crashes, breaks down, blocks a roadway in an emergency, or gets in the way of law enforcement or first responders, there must be clear accountability." Here's our read at the Signal. Accountability for autonomous systems gets settled where authority is actually exercised in the physical world. Not in the model card. This is a rare case of a legislature agreeing. MARCUS: So it's less "teach the car manners" and more "show me who's holding the leash." ARIA: That's a good way to say it. And here's the catch. A fine after thirty minutes punishes an outcome. It doesn't make the operator's chain of authority inspectable beforehand. MARCUS: So what's the city holding when it walks into court? ARIA: Exactly the question. Who authorized that vehicle to stay put? Who was empowered to override it? Twenty twenty-eight gives operators time to build that trail as infrastructure, not as litigation prep. MARCUS: Time everyone will absolutely use wisely. ARIA: We'll see. The lesson is simple. Build the evidence before anyone asks for it. ARIA: Next, a literature review from Barak Or on physical AI. According to the paper, black box models can issue physically consequential commands while sounding confident. Then they fail silently. Sensor drift. Distribution shift. Hallucinated affordances. The hardware controller may not catch the violation until it's too late. The review also finds that capability and safety are developing on separate tracks. There's no unified runtime authorization boundary between what the model proposes and what the machine does. MARCUS: Wait. Confident and wrong, and nothing in between to say no? ARIA: Right. Nothing in between that owns the decision. MARCUS: It's like a pilot with a very persuasive co-pilot and no air traffic control. ARIA: I like that, and I'd extend it. Air traffic control works because it's independent. It doesn't share a cockpit with the pilot. Our view at the Signal is that the authorizing layer has to be independent of the system whose actions it approves. A guardrail living inside the same stack inherits that stack's failure modes. That's separation of duties. It isn't a safety feature. The National Institute of Standards and Technology's cybersecurity center has been circling the same point. In its agent work, it proposes that audit records link each agent action to the non-human identity that performed it, and ultimately to the human authority that delegated the permission. That's a paraphrase of how the Cloud Security Alliance summarized the proposal. And it notes most agent logging today doesn't support that chain. MARCUS: So even if the boundary exists, you can't prove who stood behind it. ARIA: Right. The paper calls for evaluation requirements for guardrails. Good instinct. But a guardrail's decisions also have to be recorded in a form a third party can read. Otherwise you're grading your own homework. MARCUS: And the pointed question is who certifies the authorizer. ARIA: That's the one. For anyone building at this layer, the review is a solid map of the literature. ARIA: Third story, and it's a concrete answer to that question. Gaston Besanson's SARC framework. According to Besanson, it embeds regulatory constraints in agent design at four enforcement points. A Pre-Action Gate. An Action-Time Monitor. A Post-Action Auditor. And an Escalation Router. Constraints are treated as first-class objects. For multi-agent workflows, it adds constraint propagation and attribution-preserving trace trees. The author's synthetic tests report zero hard-constraint violations, and an eighty-nine point five percent reduction in soft-window overages versus policy-as-code alone. MARCUS: Four checkpoints. That's a lot of doors. ARIA: It is. But each door does something different. Before, during, after, and when something needs a human. MARCUS: Okay, but synthetic evaluations. How far do I trust that? ARIA: Fair. That's the caution. The tests are synthetic. The real test is whether the gate, the monitor, the auditor, and the router can be held by different parties. MARCUS: Because if one team owns all four... ARIA: Then you've built a well-designed control loop. You haven't built separation of powers. Security researcher Bruce Schneier has made a related point about AI systems, that the data and the control travel on the same path. I'm paraphrasing his writing there. When they do, separation is the hard part. Here's what we'd watch. Does the architecture hold when policy is governed centrally but executed locally, across organizations that don't share a trust boundary? MARCUS: That's where it gets real. Different companies, different incentives. ARIA: Yes. It's a strong foundation for that conversation. Not the end of it. ARIA: A couple of field notes. Fast ones. According to SiliconANGLE, President Trump named Director of National Intelligence Jay Clayton to lead a new Super Intelligence Force. He's joined by FTC Chair Andrew Ferguson, Pentagon research chief Emil Michael, and OPM Director Scott Kupor. The task force has a hundred and twenty days to assess advanced AI and review how the federal government learns of breaches. Putting incident reporting on the table, next to the official whose agency has an open probe into frontier labs, ties national strategy to accountability for agent failures. MARCUS: Huh. Breach reporting, and the regulator in the room. Accountability keeps sneaking into the strategy meeting. ARIA: It does. And it's happening across the Atlantic too. According to the AI Gov Risk Daily Briefing, leading members of the European Parliament want the Commission to propose an AI Liability Act. It would make developers of the most advanced models liable for damage, and make compensation claims easier. It would fill the gap left when the earlier AI Liability Directive stalled. To be clear, it's a political demand right now. Not a Commission proposal. ARIA: If there's one thread today, it's the moment before the action. Law, research, and engineering are all describing the same layer. Who was empowered to let the system act? And can anyone prove it afterward? Those questions are leaving the policy memo and moving into the architecture. Marcus, over to you. MARCUS: You know what sticks with me? Who certifies the authorizer? It sounds like a riddle. It's really a budget line. And the other one. When courts and regulators finally ask for proof of authority, what format do they accept? Nobody has a clean answer yet. Thanks to everyone supporting The Autonomous Signal, our partners and sponsors, and everyone who's with us out there. You keep this thing growing, and that's appreciated. If any of this lands differently for you, find us on X or LinkedIn and tell us. And if the show's useful, hit follow or subscribe. That's the best way to say so. The full briefing, with every source, is online at bearcanyonhq.com. One more thing. This show is editorial. It's our take on the topics of the day, and everybody's got one. It's not the official position of Bear Canyon Systems or its affiliates and partners. So check the sourcing yourself, learn something, and draw your own conclusions. Every source is on today's post at bearcanyonhq.com. If we got something wrong, tell us. We fix things fast. Back tomorrow. No Hype. Just Signal.