Bill Gates Is Right That AI Needs Governance. Governance Needs an Enforcement Layer.

This week, Bill Gates published “A turbulent AI era – and critical choices to make” on Gates Notes and sat for an unusually candid interview with The New York Times. Together, they amount to an unusually broad discussion of the way that AI is impacting jobs, inequality, cyberattacks, bioterrorism, education, human relationships, taxation, and the design of national and international institutions. He is blunt about where humanity stands: the transition, he writes, will be one of the most turbulent times in human history and, as yet, there is no coordinated plan for navigating it. On our current course, he predicts “a very high chance of a net negative outcome.” This is influential-public-figure-speak for what amounts to a prediction of a huge amount of global pain.

Gates offers three starting proposals: new institutions which include national bodies that can coordinate across agencies and an international organization modeled on nuclear weapons inspection and aviation management; a category of work reserved for humans; and tax policies designed to slow the substitution of machines for people while also financing the transition. Underneath all of it is a claim about legitimacy. AI companies, he believes, cannot be safely relied upon to manage this transition on their own. Looked at through a different frame, markets alone won’t do the trick. Rather, it should run “through a public democratic process that includes elected officials, policymakers, educators, health workers, local officials, and community leaders.”

I agree with essentially all of Gates’ views. Despite being a professional entrepreneur (with the obligatory phase in venture capital, of course) and a big believer that market solutions are in many cases better than regulatory ones, I have been a lifelong progressive. Liberal, even. I believe that society can only work — and markets only properly do their job — from within a framework of thoughtful regulation. Simply put, without solid constraints, the law of the jungle quickly becomes the law of the land, to the eventual destruction of all. You can’t build anything without a solid, sensible set of constraints that keeps the strong from preying on the weak, and you can’t have a safe and well-ordered world without meaningful constraints.

Oliver Wendell Holmes Jr. wrote in a 1927 dissent, “Taxes are what we pay for civilized society.” The same principle applies to governance; I suffer being constrained for the benefits of being protected.

Before I go any further, I should disclose that I am not a neutral observer: I run a start-up that builds infrastructure for exactly one part of the problem he describes. So, what I’m saying is indisputably self-serving. As my father used to say, where you stand on an issue depends on where you sit. But it’s also true that there’s a reason that I came up with a technology that constrains AI. My values combined with my addiction to entrepreneurship naturally led me to this focus and served as my inspiration to dream up a system that unleashes the benefits while protecting against the risks.

Effective governance

The layer that is only now getting the attention it requires is governance. Boring, unsexy governance. I think that absence is the reason a governance regime of the kind Gates wants — well-intentioned but abstracted from the actual mechanics of the thing — would struggle to survive contact with the systems it is meant to govern.

Mere agreements end up being Prisoner’s Dilemmas, and Prisoner’s Dilemmas naturally devolve to the Tragedy of the Commons. Simply put: if all you have is an agreement, and there are a lot of powerful players with incentives to breach it, then breach it they will. And pretty soon it will fail.

Policy is not enforcement

Let’s imagine that Gates gets everything he asks for.

Governments cooperate. An international body is chartered. Regulators establish sensible boundaries. Industries publish standards. Companies write responsible-use policies. Scientists determine which kinds of biological assistance require additional authorization. Financial regulators determine what an autonomous system may execute without human approval. Educators and legislators decide where AI should defer to human judgment.

Now what?

Every one of those decisions still has to become an operational — we call this “determinative” — constraint on a system whose behavior is not only probabilistic, but for which probabilism lies at its very heart. That last part is the whole difficulty.

A capable model can read a policy. It can explain a policy. It can reason, often impressively, about whether a proposed action seems consistent with a policy. But none of that is the same as the policy being imposed on it. It can always weigh the factors and decide the policy, or some element of it, loses out. Or that it doesn’t really apply. Or that its other baseline instructions — please the user; save tokens; suggest novel interpretations or solutions — trump the policy.

Asking a powerful probabilistic system to interpret and apply the rules that govern it is not governance. It’s advisory at best. Little more than a request.

This is the difference between governance as instruction and governance as architecture. Almost all deployed AI governance today is the first kind.

The problem gets worse as the models get better

One of Gates’s observations deserves more attention than it may get. The reliability gaps in current systems, he notes, are closing quickly as models learn to check and improve their own output. “Reliability gaps,” in tech-speak, are things that software can’t do that customers would like it to do. Or, if you prefer, competitive weaknesses. Things that, if you don’t do them, your competitors will, thereby whittling away at your market share. Not good when you’re running a commercial enterprise.

That is good news if you want ever-more useful work from AI. It is not good news if your governance model basically amounts to little more than strong encouragement to play within the rules. Capability and consequence rise together, and the governance goalposts move with every model update. The more capable these systems become, the more authority we hand them, and the less that authority will be limited to producing text.

The arithmetic is inescapable: more capability × more delegated authority = more consequence when something goes wrong.

Agents already send communications, write to databases, call tools, initiate workflows, approve transactions, and emit recommendations that other systems act on autonomously — and probabilistically, which causes the risk to cascade. Physical systems are next. Gates puts cybersecurity, biology, human relationships, and AI control in the same list of risks, all of them, he says, “flashing either yellow or red.”

Once an action is irreversible, checking afterward whether it was permitted isn’t governance. It’s a post-blowup incident report.

Gates reaches for aviation. That analogy is load-bearing.

The template he draws on for his proposed international body is instructive: nuclear weapons inspection and aviation oversight. Both are worth taking literally.

Aviation is not safe just because pilots have read the rules. It’s safe because an entire architecture was built around the rules: controlled airspace, clearances, instrumentation, separation minima, procedures, recorders, and controllers whose authority exists independently of any pilot’s judgment. The rulebook is necessary, but that’s not what does the work; what does the work is that those who want to work in commercial airspace are constrained by an external framework with teeth: if a company or a pilot breaks the rules, their license to operate is revoked.

Nuclear inspection has the same shape. The regime is credible because verification is external to the party being verified, and it’s backed with sanctions that have teeth. (Interesting to note that even that doesn’t always work; bad actors can flout the regulatory regime and evade the brunt of the consequences by trading with other bad actors. But that’s a different conversation.)

AI governance as Gates envisions has the potential for a truly excellent rulebook, but without an architecture to enforce it in real time we’re essentially at the stage of aviation where we’ve all agreed that airplanes should not collide and committed ourselves to trying to prevent them from doing so. Yay.

What we’re building

CaiGR™ — Continuous AI Governance Regime — spoken as “cager” (get it?), is a deterministic governance control plane. Both “deterministic governance” and “control plane” are load-bearing. They make a difference. In fact, they make all the difference.

Deterministic governance: In software, deterministic means that identical inputs produce identical outputs. CaiGR makes the governance function deterministic, not the language model. Given the same governance inputs and configuration, it produces the same admissibility determination and the same governed behavioral region. The model can still choose among many possible responses inside that region; what it cannot do is choose one outside it. The generation remains stochastic. The boundary does not. That separation is the point, and it is why the guarantee holds even though the model underneath is probabilistic. The system cannot generate its way outside the governed region because those behaviors are structurally unreachable. It is locked inside of it. Caged.

Control plane: CaiGR™ operates structurally above the generation layer rather than inside of it. It pre-defines the region of behavior the system is permitted to occupy, enforces that region before and throughout response generation rather than screening results afterward, and produces a verifiable record of the governance of every interaction. This is the aviation architecture, not just the aviation rulebook. Like aviators, if the behavior breaks the rules, there are structures to control it. (As an aside, some of those structures have real teeth; try flying your small plane over the White House or other restricted airspace and you’ll quickly find out just how sharp those teeth are.)

Many authorities, one answer

The multiplicity in Gates’s proposal is where this gets interesting, and where I think most governance thinking is still underspecified. AI governance will not arrive from a single source.

A clinical agent may simultaneously be subject to law and regulation, institutional policy, professional standards, patient consent, and the specific authority granted to that agent for that task. A financial agent answers to a different, yet similarly-structured set of constraints. A research agent to another. And so on.

These sources overlap. Sometimes they conflict. The relevance of each often shifts with context. And yet at the moment the system acts there has to be exactly one answer to exactly one question: is this behavior — this response, this action, this control — permitted or not?

Expecting a probabilistic model to reconcile competing authorities and consistently produce the right answer is a fool’s errand, and precisely the arrangement we should not accept. In CaiGR, governing authorities define a single deterministic admissible region. Behavior outside the region isn’t merely discouraged, or even identified and then blocked. It is structurally unavailable. No single one of the authorities, rules, or policies is imposed at a time; there is no negotiation. Rather, all of them resolve to the single question of admissibility: is this probabilistically generated response in-bounds, or is it out?

Cyber and biology: the honest version

Gates is absolutely right when he says that AI lowers the expertise required to do serious damage in both cyber and biology and that the defensive picture is not keeping pace. CaiGR does not solve cybersecurity. It does not solve biosecurity. What an enforcement layer can supply is necessary, if not sufficient.

Suppose a research agent may reason freely across most of a domain, but a particular combination of capability, information, authority, and requested action requires human authorization. That boundary can be represented as governance and enforced structurally. In practical terms, this means that the AI agent doesn’t have to agree with the boundary, understand why it exists, or even know that it is approaching it and make a judgment about what constitutes crossing the line. The underlying LLM may know perfectly well that things exist beyond the boundary. The governed agent does not. From inside the governed decision-making process, those states are architecturally unreachable: they cannot be received, acted on, or allowed to pollute the downstream process. There is simply what is admissible and nothing operationally reachable on the other side of the line.

Where the human belongs

Gates’s position on mandatory rather than voluntary review is the practical heart of his argument, and this is the part that fails first without an enforcement layer. He notes that industry has been crossing the very thresholds it once promised to respect. As with every new competition-driven technology development trajectory, voluntary restraint withers under pressure.

Mandatory human review of consequential AI action is only meaningful if the requirement cannot be bypassed. In our architecture, when a governed agent reaches the edge of its authority, it does not proceed and it does not decide for itself whether the matter is important enough to raise to the level of human intervention. The interaction stops at that boundary and the decision is routed to the human who holds the authority to answer. Both the human decision itself and the fact that a human made it become part of the record.

For the owners or providers of AI services, this is huge. It does not make a bad human decision good, excuse a bad policy, or create immunity from liability. It does something different: it changes the category of the dispute. The company can show that it did not delegate an unconstrained consequential decision to a probabilistic system. It defined the AI’s authority, enforced a non-bypassable escalation boundary, and, when that authority ended, routed the decision to an empowered human acting under established company policy. In a serious enterprise, those policies and delegated authorities should themselves trace back through executive and board-level risk governance.

If harm follows, the questions become familiar ones: was the policy reasonable, was the human properly authorized and competent, and was the decision itself negligent? Those are materially different questions from whether the company negligently or recklessly deployed autonomous AI without meaningful controls and let it run amok. That distinction does not eliminate liability. It gives the company a fundamentally different factual and evidentiary posture from which to defend its conduct.

CaiGR makes “a human must approve this” an architectural fact instead of a policy aspiration gated by a probabilistic process. It is also, incidentally, the version of AI oversight that scales, because it invokes human attention at exactly the point at which human judgment is actually required. AI can do the work that it can reliably do; people take over where the AI provider has decided that only a human will do. It’s the best of both worlds.

The record is the receipt

Gates’s institutions will need to know whether their rules were followed. Not where a set of rules said they should have been followed, or even where an AI vendor asserts that they were followed, but where a cryptographically verifiable governance record shows that the controls were actually imposed. Evidence with teeth.

A governance record produced by the enforcement layer, rather than reconstructed afterward from logs, is evidence of a different quality: what was permitted, by which authorities, at what moment, and what the system did inside that permission. It is the receipt, not the purchase.

But it gets better. Because the governance is deterministic, you can rewind and replay the governed event. Given the same logged governance state and configuration, CaiGR reconstructs the same admissible control state — the same answer to what was permitted — even if the probabilistic model would express itself differently on another run. The record is therefore not just a log; it is a replayable proof that the governance determination was neither a fluke nor merely a highly probable outcome. In the words of the celebrated author Gabriel García Márquez — writing, as it happens, in Love in the Time of Cholera — it was inevitable.

What is not ours to solve

The temptation for any company responding to an essay like this one is to announce that its technology is a panacea which addresses all of the relevant ills, solves the problem without reservation, slices, dices and makes the bed. Ours does not, and the boundaries are worth stating plainly.

Those are political, economic, and ethical questions. These issues are about the boundaries, and in a very real way represent the burden of participatory democracy. They belong to people. Software that decides how society should run would be a considerably worse problem than the one it solved. Determining the boundaries is the work of institutions and the people who elect them. The job of the technical layer is to make the boundaries they determine actually binding.

Governance belongs outside the intelligence being governed

There is an older principle underneath all of this.

We have spent centuries separating authority from the thing subject to authority. Defendants do not determine their own guilt, nor do they select their own sentences. Traders do not certify their own risk limits. Auditors do not report to the people they audit. Operating systems do not let each application decide which memory or other system resources it may touch. All of these things are structurally separate governance actors, and with good reason.

Yet the currently dominant approach to governing AI still amounts to: here are the rules, please decide where they apply and do your best to make judicious decisions about when and whether to follow them.

That was tolerable when AI was limited to answering questions (along with the ubiquitous disclaimer reminding us that “AI can make mistakes” which greets every new AI interaction). It’s tolerable in an era in which AI engages only on relatively low-stakes activities. It becomes untenable, even dangerous, at the level of autonomy Gates expects. And expects soon.

The more authority we delegate to a system, the more we depend on it to do things that we can’t, don’t want to, or couldn’t handle at scale, the more critical it becomes that the boundary of that authority exists somewhere other than inside the system.

The missing institution is infrastructure

Gates argues that, because AI cuts across national security, employment, health, finance, education, elections, energy, and infrastructure — and does so simultaneously — the world needs institutions unlike anything we have built. I think that he’s right. And it should be clear to anybody who’s deploying AI that those institutions will have to be supported by infrastructure equal to the task: a technical substrate that turns their decisions into machine-enforceable governance.

• There are the unassailable authorities that govern it.
• Those authorities must determine which behaviors they permit.
• It cannot operate outside the set of admissible behaviors.
• It must produce a reliable record of what happened.

None of this addresses the questions Gates is asking. Rather, it does something more modest. It makes the answers enforceable. Without that layer, we could spend a decade building an elaborate apparatus for deciding what AI should be permitted to do, to no avail. Because we’d still be relying on AI to behave itself rather than forcing it to behave. We look forward to being part of making sure that it does.

Adam Caper, Founder | CEO · August, 2026