Why AI Safety Requires Ubiquitous Accountability—Not Just Central Oversight

# Why AI Safety Requires Ubiquitous Accountability—Not Just Central Oversight

Originally published May 15, 2026

The AI governance debate has largely centered on a false binary: either strict centralized control or dangerous decentralization. But the real challenge isn't choosing between these extremes—it's recognizing that purely centralized oversight cannot structurally scale to meet the demands of agentic AI systems.

This isn't a political argument. It's an architectural one, rooted in the operational realities of how modern AI systems actually work.

The scaling problem is structural, not political

Consider what happens when an AI agent performs a task on your behalf. It doesn't make a single decision—it makes dozens or hundreds:

• Which data sources to access
• Which tools to invoke
• Which sub-agents to delegate to
• How to handle edge cases and errors
• What information to retain or discard
• Whether to escalate or continue

Each of these decisions happens at machine speed, often across organizational boundaries, with limited direct human oversight. Now multiply this by millions of agents operating simultaneously across enterprises, jurisdictions, and use cases.

A single centralized reviewer—whether a government agency, a corporate risk committee, or an AI ethics board—cannot meaningfully authorize every consequential interaction. The review queue becomes a bottleneck. The approval process becomes a formality. Human reviewers suffer from approval fatigue, clicking "yes" reflexively to keep things moving.

More fundamentally, point-in-time evaluation misses what matters most: the dynamic, multi-step, context-dependent behavior that emerges during actual operation. An agent that looks safe in pre-deployment testing can still:

• Retry failed approaches in ways that compound risk
• Delegate to external tools with their own failure modes
• Accumulate privileges across interactions
• Drift as models update or data distributions shift

This doesn't mean central institutions are obsolete. It means they must play a different role—one that acknowledges the control-distribution problem at the heart of AI governance.

Separating control functions

Effective governance requires distinguishing between five distinct control functions:

1. Rule formation — Who defines acceptable behavior?
2. Assessment — Who determines compliance?
3. Authorization — Who grants permission to act?
4. Runtime enforcement — Where are actions allowed, blocked, or escalated?
5. Evidence and remedy — Who records events, investigates failures, and imposes consequences?

A system can be centralized on one dimension and distributed on another. The EU can establish legal requirements (centralized rule formation) while enforcement happens at national agencies, enterprise gateways, and credential verifiers (distributed runtime enforcement). This hybrid model isn't a compromise—it's the only architecture that can project governance into the massive number of machine-speed interactions where risks actually materialize.

What governance infrastructure we already have

Before proposing new frameworks, it's worth recognizing what's already operational:

A single centralized reviewer cannot meaningfully authorize every consequential interaction. The review queue becomes a bottleneck.

Top-down regulation is real and binding. The EU AI Act combines risk classification, conformity assessment, technical documentation, logging requirements, post-market monitoring, and penalties. NIST's AI Risk Management Framework provides voluntary guidance around Govern, Map, Measure, and Manage. Both emphasize documentation, testing, provenance, and incident response.

Enterprise control planes are increasingly sophisticated. Google's Agent Gateway, Azure API Management, AWS Bedrock guardrails, Cloudflare AI Gateway, and Kong AI Gateway already intercept AI traffic, enforce policies, and emit telemetry. These aren't theoretical proposals—they're production systems mediating real requests.

Identity and credential standards provide building blocks. W3C Decentralized Identifiers (DIDs) enable verifiable control of cryptographic keys without central registries. Verifiable Credentials allow issuers to make attestations that holders can present to verifiers. NIST's NCCoE is developing practical guidance for agent identity and authorization using OAuth 2.0/2.1, OpenID Connect, SPIFFE/SPIRE, and other standards.

Academic research is advancing tamper-evident provenance, proof-carrying execution, and auditability-by-design. This work demonstrates that distributed accountability can be more than access logs—it can be cryptographically verifiable, append-only, and structurally resistant to post-hoc alteration.

The gap: connecting the layers

The problem isn't lack of technology or regulation. It's that these pieces don't connect into a coherent accountability infrastructure. Governance is fragmented across legal, security, data, product, and audit functions. An enterprise might have strong IAM controls but weak logging, or detailed logs with no coherent policy framework, or excellent policies with no runtime enforcement.

What's missing is a unified model that connects:

• Identity and authority (who or what can act, and with whose authorization)
• Policy and permission (what actions are allowed, under what constraints)
• Evidence and audit (what gets recorded, protected, and disclosed)
• Revocation and response (how authority is withdrawn when trust breaks)
• Data governance (what information can be accessed, transformed, or retained)

Introducing F-ACT: a unified accountability framework

F-ACT (Framework for AI Accountability and Control Transparency) is a proposed organizing framework that connects governance requirements currently scattered across AI risk management, conformity assessment, identity standards, API security, and data protection law.

F-ACT encompasses two integrated components:

Part 1: The five-layer accountability stack

#### 1. Grant Who or what has authority, from whom, for which purpose and duration? This layer addresses delegation chains, credential issuance, scope limits, and expiry. An agent should carry verifiable evidence of its operator, authorized purpose, delegated user authority, permitted tools and data classes, and any spending or rate limits.

#### 2. Usage What actions are permitted at runtime and under which constraints? This layer governs access policies, guardrails, tool restrictions, escalation rules, and the conditions under which requests are allowed, transformed, blocked, or referred to human review.

#### 3. Audit What evidence is captured, protected, queried, and disclosed? This layer specifies what gets logged (requests, decisions, tool invocations, policy evaluations), how logs are secured (tamper-evidence, access controls), who can query them (operators, regulators, auditors, affected individuals), and what privacy protections apply.

#### 4. Revocation How is authority withdrawn? This layer addresses credential suspension and revocation, real-time status checking, model or tool removal from allowlists, incident-triggered authority reduction, and coordination across organizational boundaries.

#### 5. Data What data may be accessed, transformed, retained, or propagated? This layer connects AI authorization to data-governance requirements: purpose limitation, consent, retention periods, cross-border restrictions, differential privacy, anonymization, and the right to erasure.

Part 2: F-ACT conformance tiers (L0–L3)

F-ACT includes a tiered conformance model that describes the strength and verifiability of accountability controls rather than claiming that a system is universally "safe."

Accountability infrastructure does not solve alignment. Auditability is not alignment; authorization is not benevolence.

Why conformance tiers instead of binary certification? Because:

• AI systems operate across diverse contexts with different risk profiles
• "Safe" depends on purpose, deployment, data, and affected populations
• Conformance can be objectively evaluated; safety cannot
• Tiers support transparent trade-offs between assurance cost and risk exposure

An F-ACT conformance tier specifies:

• Minimum identity assurance for operators and agents
• Required policy enforcement points and guardrail coverage
• Logging completeness, retention, and tamper-evidence requirements
• Revocation latency (how quickly authority can be withdrawn)
• Data governance integration (consent management, purpose binding)
• Independent audit frequency and scope

Lower tiers might suffice for low-risk, sandboxed research agents. Higher tiers would be mandatory for agents handling sensitive data, making consequential decisions, or operating in regulated sectors.

The value isn't in the tiers themselves—it's in creating a common vocabulary that connects technical controls to governance requirements and makes assurance levels legible across organizations and jurisdictions.

The herd immunity analogy: ubiquitous coverage, not central authorization

One useful analogy comes from public health: herd immunity.

You don't need every individual to be immune to stop disease spread—you need enough protection distributed across the population that transmission chains break. The immune system itself operates on this principle: it doesn't route every potential threat to a central decision-maker. Instead:

• Distributed recognition: local cells carry pattern-recognition receptors that identify threats without waiting for central permission.
• Graded response: minor threats trigger local inflammation; systemic threats escalate to coordinated responses.
• Memory and learning: once a threat is recognized, the system builds lasting defenses.
• Coordination without centralization: signaling molecules enable communication between distributed components without requiring a command hierarchy.

Similarly, epidemiological control doesn't depend on a single authority inspecting every potential exposure. Instead:

• Coverage across the population: enough protected individuals that transmission chains break.
• Local enforcement: healthcare providers, schools, employers apply rules at the point of contact.
• Surveillance and reporting: distributed monitoring detects outbreaks, with escalation to coordinated response.
• Trust framework governance: public health authorities set standards and coordinate responses without directly administering every intervention.

Applied to AI governance, this suggests that ubiquitous accountability can emerge from:

• Coverage: enforcement points at organizational edges where agents interact with tools, data, and counterparties.
• Local verification: each verifier checks credentials, policies, and status without querying a central approval service for every request.
• Shared standards: common semantics for identity, authority, evidence, and conformance that enable interoperability.
• Escalation paths: routine interactions proceed automatically; high-risk or anomalous cases trigger human review or institutional oversight.
• Coordinated incident response: when problems are detected, warnings propagate and remedies are coordinated across affected systems.

The analogy isn't perfect—AI risks are adversarial and strategically adaptive in ways that pathogens typically aren't. But the structural insight holds: you don't need every decision to be centralized to achieve population-level safety; you need enough enforcement points, operating under legitimate rules, that harmful actions are reliably caught.

This isn't an argument against central institutions. It's an argument for projecting their authority into the operational layer through distributed but governed infrastructure.

What this does NOT solve

The future of AI governance is ubiquitous accountability: distributed enforcement projecting democratically accountable rules into every consequential interaction.

Intellectual honesty demands clarity about limits:

Accountability infrastructure does not solve alignment. A well-identified, properly credentialed agent can still pursue a harmful objective, exploit an incorrectly specified policy, or deceive an evaluator. Auditability is not alignment; authorization is not benevolence.

It does not prevent misuse by credentialed actors. If an authorized user instructs their agent to do something harmful, accountability infrastructure will record the action—but may not prevent it, especially if the harm isn't recognized at runtime.

It does not address superintelligence or control problems. If a sufficiently capable system can circumvent technical controls or manipulate its operators, accountability infrastructure becomes a forensic tool, not a preventive one.

It does not solve issuer capture or concentration. If only a few organizations can issue credentials, or if issuers face conflicts of interest, the distributed architecture inherits their biases and failures.

It does not eliminate the need for human judgment. Rules must still be written, policies debugged, evidence interpreted, disputes resolved, and remedies imposed. These are irreducibly social and political choices.

What it DOES provide

Despite these limits, distributed accountability infrastructure offers real value:

• Raising the safety floor — making it harder for agents to act anonymously, with excessive privileges, or without evidence
• Improving enforcement timeliness — catching problems at interaction-time rather than in periodic audits
• Creating better evidence — structured, tamper-evident logs that support investigation and remedy
• Enabling transparency — evidence that can be queried by operators, regulators, auditors, and affected individuals (within privacy bounds)
• Supporting reciprocal governance — allowing organizations to verify each other's controls without re-implementing assurance from scratch

This is infrastructure work—not glamorous, but necessary. The goal isn't to claim we've "solved" AI safety. It's to build the connective tissue between top-down governance and operational reality, so that rules can actually reach the interactions where they matter.

Next steps for Society OS

For SovereignSOS / Society OS, adopting F-ACT means:

1. Mapping existing capabilities to the five-layer stack to identify gaps
2. Developing reference schemas for agent identity, delegation chains, policy semantics, and audit events
3. Building or integrating enforcement components (gateways, policy engines, status registries)
4. Defining conformance profiles for different risk tiers and use cases
5. Establishing governance for who can issue credentials, what assurance they must meet, and how disputes are resolved
6. Contributing to open standards efforts (NIST, W3C, OAuth, OpenID) to ensure interoperability
7. Running pilots with real deployments to validate that the model works under operational constraints

This isn't a one-organization effort. It requires collaboration among platform providers, enterprises, regulators, standards bodies, civil society, and researchers. But the alternative—pretending that centralized review can keep pace with billions of agentic interactions—isn't credible.

The future of AI governance isn't purely centralized or purely decentralized. It's ubiquitous accountability: distributed enforcement projecting democratically accountable rules into every consequential interaction.

About the research: This article synthesizes analysis of the EU AI Act (with enforcement provisions scheduled for August 2026), NIST AI Risk Management Framework, W3C identity standards, enterprise AI gateway implementations, and academic research on accountability infrastructure. A detailed whitepaper with full citations and technical depth is available separately.

Limitations disclosure: F-ACT is a proposed framework, not an established standard. Its credibility depends on precise specifications, threat modeling, assurance requirements, independent verification, and governance mechanisms—all of which remain implementation work. Society OS is positioned to contribute to this development, not to unilaterally define it.

Patent and Foundation status: This work builds on U.S. Provisional Patent Application No. 63/844,868 filed February 1, 2025, which establishes foundational claims for distributed AI accountability infrastructure. The SovereignSOS Foundation is planned but not yet established; current development proceeds under individual authorship.