Policy time: years
The EU AI Act took four years from proposal to entry into force; its obligations phase in over several more. Thorough, legitimate — and slow by construction.
When AI moves exponentially, governance must become executable
Frontier-lab leaders now say it plainly: AI capability is compounding faster than any policy process can respond. A regulation takes years; a model generation takes months; an agent acts in milliseconds. KYE Protocol™ moves governance to the one layer that operates at that speed — the execution boundary, where every agent action is authority-checked before it becomes a consequence.
The speed mismatch, stated honestly
The same three clocks are running against you.
Model time: months
Capability generations now arrive faster than annual audit cycles. The system you assessed at procurement is not the system running today.
Action time: milliseconds
An agent executes a wire transfer, signs a contract, or changes a record in less time than any committee can convene.
Policy cannot move at model speed. Authority checks can.
The policy gap and the execution gap are different gaps
The frontier-risk debate — model evaluations, red-teaming, the power to block dangerous systems — is about which models may exist. That is the policy gap, and it belongs to governments and labs. KYE Protocol™ addresses the execution gap: whether a given agent, running whatever model, may take this consequential action, right now, on whose authority, with what evidence. The two are complementary; conflating them serves neither.
| Frontier-policy concern | Execution-layer answer |
|---|---|
| Policy process too slow for exponential capability | Runtime governance at the execution boundary — the check travels with the action |
| Mandatory testing and stronger pre-deployment review | Action Admissibility™ decided per action, plus an Evidence Pack™ sealed per decision |
| Power to suspend or block dangerous systems | Authority suspension and revocation at runtime — finality is enforceable, not aspirational |
| Cyber and biosecurity misuse | High-risk authority rails: tighter scopes, two-person sign-off, kill-switches |
| Labour and economic disruption | Provenance of AI-driven decisions — who or what acted, on whose authority, traceable per action |
What "executable governance" means concretely
For a security or compliance team, the test of governance is what happens at the moment of action — the NIST AI RMF calls this the Manage function operating continuously, not annually.
- Who or what is acting — every principal (human, service, or agent) carries a verifiable identity your auditors can resolve.
- On whose authority — a delegation chain you can walk end to end, satisfying the EU AI Act Article 14 human-oversight duty per action.
- Within what scope — purpose-bound per ISO/IEC 42001 clause 6 planning, so yesterday's grant does not authorise today's different act.
- With what evidence — every decision sealed and replay-verifiable from published keys alone, the EU AI Act Article 12 record-keeping duty discharged by default.
- Suspendable — your team can revoke authority mid-flight, and the revocation is itself evidenced.
Boundary: KYE Protocol™ does not evaluate frontier models, write policy, or replace the regulator — it makes whatever policy you adopt executable at the moment an agent acts. The lab's safety case and the EU AI Act's logging and human-oversight duties both land here: at runtime, as PEP-checked, evidenced actions.
Read it as a roadmap, not a slogan
The exponential argument is the strongest case yet made for runtime authority — here is the path from reading it to running it.
- Map where your agents already act consequentially — payments, records, contracts, infrastructure — against the NIST AI RMF Map function.
- Put the authority check at that boundary — see how it works end to end in the KYE™ Agentic Governance Lifecycle™.
- Make your evidence regulator-ready by default: every action emits a sealed, citable trail mapped to NIST AI RMF Measure and Manage.