A governance committee spends forty minutes deciding which AI use cases are safe to wave through and which need a human to look. The line gets drawn by whoever is most senior and most sure. There is a paper, there are tiers, there is a routing rule, and there are thoughtful people weighing it. What there isn’t is evidence. Nobody asks the only question that matters — is the boundary actually in the right place? — because nobody in the room could answer it. They never measured it.
Anyone who has sat in that room knows the other one too: the slide review where a validation team has spent four months producing a beautiful document about a model the business shipped two quarters ago. Both rooms are failing, and they are failing in opposite directions. One is too slow to be relevant. The other is too shallow to be true. The space between them is where AI assurance actually has to be done, and across a decade of sitting in both kinds of room, I have watched almost nobody stand in it.
Two orthodoxies dominate financial-services AI governance right now, and each is a way of avoiding the hard thing. The first is the model-risk inheritance: slow, document-heavy, academic. It comes from a world of static statistical models, where a challenger team could review the development docs, rerun the backtests, check the stability, sign off, and walk away for a year because the model’s weights were genuinely frozen until the next scheduled review. That cadence was honest for scorecards. It is a fiction for foundation models. A vendor reruns its safety fine-tuning and the model you validated in Q1 behaves differently by Q3 — and you changed nothing. A product team edits a system prompt to resolve a customer complaint, and the validated configuration and the live configuration quietly diverge. The orthodoxy’s answer is to do the same heavy review, just more often, and it collapses under its own weight: by the time the four-month validation lands, the object it described is gone. Rigour that arrives after the decision is archaeology.
The second orthodoxy is the consulting reflex, and it is worse because it is faster. It produces a framework. It has a maturity model, a heat map, a target operating model on a page, and a tiering taxonomy benchmarked against the usual standards — the EU AI Act, NIST, a local regulator or two. It moves at the speed the client wants. And almost none of it has ever been checked against the world. “The model is reliable enough.” “This use case is low risk.” “The routing is sensible.” These read as findings. They are predictions wearing the costume of facts. The deliverable is confident, on time, and unfalsifiable — which is exactly why a committee buys it, because the format rewards conviction and has no native way to reward someone who says “I don’t know yet, but here is how we’d find out.”
Neither posture is universal, and the better shops already mix in continuous monitoring and eval-gated deployment. But as defaults the two still dominate the room, and the industry tends to treat them as the only options: be rigorous and slow, or be fast and shallow. Pick your failure. That is the false tradeoff — but it is false for a specific and large subset of the work, not for all of it. For a claim you can cheaply measure, the choice between rigour and speed is not real. Most governance papers never even sort their claims into the measurable and the irreducibly judgemental, so the subset where the tradeoff dissolves stays invisible. Some claims genuinely belong in the judgement bucket, and for those the contribution of this method is not a number — it is forcing the honest label. The rest of this piece is about the measurable subset, which is wider than either orthodoxy behaves as if it is.
The escape is not a compromise between the two. It is a different method borrowed from a different discipline. The experimental method’s rigour does not come from its slowness; it comes from a shape — a sharp hypothesis, the smallest instrumented test that could falsify it, a pre-registered decision rule, an honest reading of the result, and an iteration. Institutional science is slow for reasons a decision-support experiment does not carry: replication, peer review, the burden of producing generalisable knowledge. The shape itself can run in a day, and most of the slowness people associate with rigour in a governance context is the slowness of un-instrumented work — of arguing from conviction because you never built the measurement.
Compress that loop to a consulting timeline and you get the thing that beats both orthodoxies. Not a four-month validation and not a confident slide, but a small bet, instrumented, reviewed, iterated, delivered inside the week the decision has to happen. The discipline is identical to a lab’s; the cycle time is a consultant’s. You are not choosing between rigour and speed. For a claim you can instrument cheaply — and in governance far more claims qualify than anyone assumes — the measurement is the faster path, because you run it once and the question is answered with a number you can put in front of anyone, instead of an assertion you have to keep re-winning every quarter someone challenges it.
The reflex this installs is a single question, asked of every load-bearing claim in a governance paper: what would we measure to know this is true, and what is the cheapest version of that test? When the outcome is genuinely uncertain — a bet on appetite, a read on how a regulator will land — you gather perspectives, because there is no fact to find, only judgement to pool. But when the outcome is measurable for less than the cost of debating it, you gather evidence. Governance keeps reaching for the first reflex even where the second is cheaper, faster, and decisive. Closing that gap is most of what separates assurance that holds up from assurance that merely sounds confident.
Here is the loop running at three different altitudes. One is in-domain, a live governance boundary. The other two are lower-stakes illustrations from my own tooling, chosen deliberately because code and config have cheap, deterministic ground truth: they show the loop’s shape clearly, and the governance altitude is flagged where it gets harder.
Start with the committee from the opening, because its problem is testable and almost nobody tests it. The line between “routine, let it flow” and “needs a human” is the most consequential boundary in any risk-tiering framework, and it usually gets drawn by feel. The claim underneath the approval — this rule safely separates routine cases from the ones that need scrutiny — could be checked in hours, not weeks. Pull a stratified sample of a few dozen recent cases weighted toward the borderline band. Have two or three qualified reviewers classify each one blind, to the rule and to each other. First check whether the reviewers even agree — a simple inter-rater statistic settles it, and if your own experts can’t agree, the rule is calibrated to a boundary that doesn’t exist, which is itself a finding no meeting would have surfaced. Then, where they do agree, look not at overall accuracy but at the miss rate — the cases sent down the light path that needed a human — and bound it with a confidence interval. Be honest about what a few dozen cases buy you: after filtering to the agreed subset and counting only misses, the numerator is small and the interval is wide, so the first pass usually bounds the rate loosely or tells you the rule is uncalibrated, rather than handing you a tidy board-ready figure on day one. And because the sample was deliberately weighted toward the borderline, the raw rate is not the operational miss rate until you re-weight it back to the live population. Even loosely bounded, the committee is no longer deciding whether something “looks sensible.” It is deciding whether it is comfortable that the true miss rate sits below an explicit threshold, at a stated confidence, with the gaps in that estimate named. That is a sentence a regulator can be shown, and the whole exercise costs less than the meeting it replaces.
The second altitude is personal, and I include it because falsifying your own intuition is where the discipline is learned. I suspected that a higher-effort setting on a reasoning model improved its output on multi-step work. That is exactly the kind of confident sentence that ships unmeasured. So I ran a four-arm controlled benchmark across eight tasks from my own work mix, in a single day, with a blind pairwise judge, randomised order, and a pre-registered decision rule: win-rate at chance means drop the default. The result was a null, and I reported the null rather than burying it. Eight tasks is a small sample, so the honest reading is “no detectable benefit at this cost,” not “proven no effect” — still decision-useful, and it pointed one way. Total cost: a few dollars and one day. The operating change — drop the expensive default, save roughly half the latency on every session — is measurable and in production. The honest-outcome signal is the tell: the log explicitly notes where my ground-truth assumption was probably wrong and the experiment was right. That is what real experimental discipline looks like when it is cheap enough to actually do.
The third altitude is the newest kind of assurance object: the multi-agent review itself. I ran an adversarial code-review harness against my own open-source tooling — parallel finder agents, independent refuters per candidate, two dozen agents, under ten minutes wall-clock — and got a precision number that actually meant something: most candidates survived refutation, with two serious defects confirmed by reproduction. The design choice is the whole point. I picked code, not prose, because a code bug either reproduces or it doesn’t, so the failure mode is visible rather than silent. The honest limit is recall: the harness shows precision cheaply but says nothing about how many real defects it missed, and for assurance the miss rate is the dangerous and harder quantity — so this demonstrator earns a narrow claim, that the loop runs and produces a falsifiable metric in minutes, not that the harness is assurance-complete. I named the predicted failure of the first run — without a deduplication step the same root cause gets double-counted — verified it happened, and fixed it for the second.
Three altitudes — a governance boundary, a tooling default, a review harness — one method. State the claim sharply. Build the smallest instrument that could prove it false. Read the result honestly, including when it embarrasses you. That is the spine, and it is the same spine whether the stake is a steering-committee sign-off or a few-dollar config choice.
If the synthesis is right, three things follow for any firm building this function, and all three cut against current instinct. Stop staffing assurance as a writing function and start staffing it as a measurement function: the scarce skill is not the ability to produce a polished framework — the market is drowning in those — but the ability to look at a governance claim and design the cheapest test that could falsify it, a sampling plan, an agreement check, a regression suite, a bounded error rate, on a consulting clock. That is a quantitative-experimental skill wearing a consulting suit, and it is rare precisely because the two orthodoxies select against it. Make the evidence the deliverable, not the document: a mature assurance pack is not prose about a control but the control’s measured result, with a tripwire that fires when the system quietly stops being low-risk — eval harnesses that gate model updates, scheduled red-team probes, drift monitors wired to risk thresholds. But measured evidence feeds an accountable approval; it does not replace it. A specific deployment still needs a named owner signing a residual-risk statement, and several of the deepest failure modes — prompt injection, data leakage, tool-access blast radius, agentic orchestration — are not bounded by any single tripwire metric. Evidence-as-deliverable means the document’s claims are backed by measurement, not that the document and its judgement disappear. A firm that ships measured evidence on a continuous cadence has still closed the time-to-detection gap that the annual model leaves open for months at a stretch. And build the operating model so the experiments compose: none of this scales as a pile of clever one-off tests, and the point of a well-built framework — tiers that scale scrutiny to impact, a handful of non-negotiable gates, evidence expectations sized to the tier — is that it tells you which claims are load-bearing and therefore worth the test. The failure of the consulting orthodoxy is not that it builds frameworks; it is that it builds frameworks no one ever runs an experiment inside.
The credibility this earns can compound in a way neither orthodoxy can touch — though that is a bet about institutional culture, not a law. In a healthy risk culture, a regulator shown a bounded miss rate trusts the next thing you bring more than one shown a confident paragraph, and a risk function that has watched you pause because your own experts disagreed extends you more rope, not less. In a less forgiving culture, a quantified residual risk invites challenge before it earns trust, so the move needs a sponsor and a framing that rewards disclosure. The underlying asymmetry is real either way: conviction has no way to be wrong out loud, and being wrong out loud, cheaply and early, is where durable trust actually comes from.
So here is the whole game, small to describe and hard to live. Pick one load-bearing, measurable claim in a live AI-governance paper. Design the smallest experiment that could prove it false. Run it before the next forum. Defend the boundary with the number, not the title. Do that consistently and you are neither the slow validator nor the fast consultant. You are the only person in the building who actually knows whether the thing is true — and you found out in time for it to matter.