Horizon 05
Governance & Assurance
The mechanisms by which a system earns the confidence already placed in it.
Capability alone does not establish trust.
The shift
Governance is often treated as a constraint applied after a capability works. In practice it determines whether the capability can be used at all — by a regulated institution, in a safety-relevant setting, or anywhere the consequences of being wrong are borne by someone other than the operator.
Assurance is the harder half. A policy states an intention. Assurance produces evidence that the intention holds — under change, under load, and under an adversary.
Most governance failures are not failures of principle. Organisations rarely lack a statement of values. They lack a mechanism that would notice the statement being violated.
A control that produces no evidence is a preference.
What we ask
- What evidence would show this control is working, rather than merely present?
- Who is able to say no, and what happens to them when they do?
- How does the record survive staff turnover and a change of supplier?
- What changed since the last assessment, and did anything re-check it?
- If this system had been wrong for six months, what would have told us?
Lines of inquiry
- 01
Controls that produce evidence
We are interested in oversight that generates artefacts — logs, evaluations, thresholds, sign-offs — rather than assurance that depends on recollection and goodwill.
- 02
Standards and conformity
Standards are becoming the practical interface between regulation and engineering. Read as design input rather than paperwork, they change what gets built.
- 03
Third-party and supply assurance
Most systems now include components the operator cannot inspect. Assurance has to work across an organisational boundary, or it does not work.
- 04
Governance after deployment
The consequential period begins when a system becomes routine. We examine how oversight is sustained once a capability stops being novel and starts being assumed.
What would you actually be able to demonstrate?
Where the honest answer is less than the policy implies, that gap is worth closing before someone else measures it.