The service
Every decision can be compliant while the whole quietly drifts. This is the service that governs the aggregate.
A deployed, subscription-operated governance layer over an AI decision stream, measuring the window, not the item, and leaving a record a board or regulator can check.
The check you already run
Your per-output checks are correct. They are also the reason the drift is invisible.
Every decision in the stream is tested against limits, and passes. That check is doing its job exactly right, each item is within mandate when it clears. But a control that asks "is this one decision within limits?" cannot ask "is the whole, over this window, drifting somewhere no one chose?" The failure isn't a broken check. It's a question the per-output check was never shaped to ask.
Why the aggregate breaks
A stream can pass every check and still be wrong.
A per-output control asks one question of one output: is this decision within limits? Run it across a stream and every answer can come back “yes” while the set as a whole slides toward concentration, correlation, or a margin so thin a single shock moves all of it at once. You cannot reach aggregate risk by tightening a per-output threshold, the danger lives in the relationship between decisions, not in any one of them.
It has happened before, the shape of the loss is familiar
Diversified per book, correlated in aggregate
Crowded, similar positions deleveraged at once. No single position broke a limit. The aggregate did.
No mandate breached, multi-sigma losses in days
Reported ~1.8% over four days while indices set records, on crowding into correlated AI-linked names. Reported figures, a structural parallel.
These are structural parallels, the documented shape of the loss, not proof of AI causation. Each shows what an aggregate failure looks like when every individual decision is, on its own, within the rules.
Not all movement is drift
Some aggregate movement is dangerous drift; some is legitimate, in-appetite novelty a healthy business is supposed to do. The service’s job is to separate the two, gating drift out of appetite while routing safe-but-novel states to human review. Routing legitimate novelty to review is explicitly not a false alarm.
The operational facts
What it needs, what you get, how long it takes.
The mechanism, at service level
We track two things over a rolling time window.
This axis gates
Distance from appetite
Drift out of stated appetite withholds the compliance token, no token, no action.
This axis never gates
Distance from the known book
Unfamiliar-but-in-appetite states route to governed human review, not a block.
Routing legitimate novelty to review is explicitly not a false alarm.
The five objects
What configuration looks like.
Window definition
Aggregate-state vector
Appetite reference bands
Known-book corpus
Disposition table
Vertical template packs speed authoring, the insurance pack ships with worked appetite statistics: concentration, correlation-load, buffer-erosion.
Every appetite edit and corpus promotion is a signed, attested, logged change, never a config-file edit.
Evidence
A per-period record your board can check for itself.
Each window's disposition carries a tamper-evident attestation, usable both as pre-deal diligence evidence and post-completion monitoring, CPS 230 evidencing framed exactly as Solutions frames it.
Grounding
The windowed lifecycle is the pinpole-proven engine; the statistics are established (per /status). The semantic-divergence signal feeding richer state vectors is validating, and this page flags which vector components depend on it.
The honest boundary
- It flags and routes; it does not price or underwrite.
- Set-level detection improves no single-output verdict.
- Appetite references express your stated appetite, the service holds behaviour to the reference; it does not certify the reference is wise.
- Software-tier attestation is tamper-evident, not non-bypassable; the hardware-attested tier is the upgrade.
Rules 2, 4 and 5 at this rung; 3 and 7 in full at the hardware tier. The eight rules →