Building on Nate B Jones's work on AI world-model boundaries — this post pushes the framing into the specific language the new regulatory regimes are going to use.
Every AI governance framework I've read — NIST AI RMF, ISO 42001, the EU AI Act, the newer CCPA ADM rules — describes roughly the same control set: inventory, risk classification, documentation, testing, monitoring, human oversight.
These are all correct. None of them are the actual control.
The actual control is one design decision, made once, per system:
Does this output get acted on, or does it get interpreted first?
That's it. That's the boundary. And it has to exist as a design artifact, not a policy document.
This matters specifically now because CCPA ADM, effective January 2027, draws a legal line around "significant decisions" — outputs that materially affect someone's access, opportunity, or price. A system that cannot distinguish, at design time, which of its outputs cross that line will fail the audit. Not because the audit is clever. Because the system can't answer the question.
Why every other control fails without it
"Human oversight" without a boundary means a human watching a feed of outputs indistinguishable from one another — routine facts, novel judgments, high-confidence flags, low-confidence guesses — all presented with identical formatting and identical tone. The human rubber-stamps because rubber-stamping is the only scalable response. The oversight is theatrical.
"Risk classification" without a boundary means classifying the system as high or low risk. But almost every real AI system produces a mix of high-risk and low-risk outputs. A system that surfaces a dashboard metric (low-risk) and, in the same interface, recommends denying a loan (very high-risk) cannot be usefully classified as one thing. The classification is at the wrong altitude.
"Monitoring" without a boundary means logging everything and flagging nothing — or flagging everything and surfacing nothing. You cannot monitor for drift in a category you haven't named.
What the boundary actually looks like
Two labels. Every output from an AI system carries one of them.
- Act. Factual, verified, low-stakes, precedent-clear. A status rollup. A metric crossing a threshold with historical context for what that threshold means. Information logistics.
- Interpret. Involves a judgment call the system isn't equipped to make reliably. A trend that might be noise. A correlation that might not be causal. A prioritization that might reflect the model's biases rather than your strategy.
The label is part of the output. It ships with the data. It is visible to every downstream consumer, human or machine.
That's the control.
Why this is hard
The boundary is uncomfortable because it requires the team building the system to admit, in writing, where the system can't be trusted. Nobody wants to ship that as a feature. Marketing wants "AI-powered insights." Engineering wants high-confidence scores. The boundary says this specific output is a judgment call, route it to a human.
That admission is the control. Everything else is downstream.
A minimum viable implementation
If you do nothing else this quarter, do this:
- Pick your three highest-traffic AI surfaces. For each output type, classify as
actorinterpret. - Put the label in the UI. Literally visible to the person reading the output.
- Route
interpretoutputs through a reviewer before they reach external customers or irreversible actions. - Log the labels. You now have the only metric in AI governance that matters: what percentage of our automated decisions were actually decisions the system was equipped to make.
You will find that number is lower than your executive team thinks. That's the point of measuring it.
Corollary for security leaders: your agent threat model is incomplete if it stops at prompt injection and data exfil. The bigger threat is the unlabeled interpretive output routed to an action path. That's not a security bug. It's a design failure that your security program is inheriting — and it will be your job to explain after the incident, regardless of who designed it.
Draw the boundary first. Everything else follows.
