A board approves a workflow once. The workflow keeps changing after that, and nobody is assigned to notice. That gap, not any single bad decision, is where most AI oversight failures actually live.
TOUCH STONE LAW
The Law of the Moving Line: A governance line that has no named owner and no named number attached to it will move every time someone makes a locally reasonable decision, and no one will be responsible for having moved it.
Glenn E. Daniels II, Touch Stone Publishers
Where the Law Comes From
The pattern shows up wherever a company puts a human review step between an AI system and a consequential decision, then treats the review step as a fixed fact rather than a condition someone has to keep maintaining. The illustration below is a composite drawn from the pattern, not a report of one company. An underwriting team adopts an AI-assisted claims triage tool with a standing rule: every claim the model scores above a stated severity threshold gets a second look from a licensed adjuster before payout. The rule is presented to the board once, at approval. It is not presented again, because nothing about it appears to need revisiting. The model has not changed. The threshold has not changed. On paper, eighteen months later, the workflow looks identical to the one the board approved.
It is not identical. A staffing shortage during a systems migration leads a claims manager to raise the review threshold temporarily, covering only the highest severity tier instead of the top two. The fix is sensible, documented in a team log, and framed correctly as a staffing accommodation. A subsequent efficiency review, run by someone with no knowledge the threshold was ever different, benchmarks current throughput against the narrowed tier and concludes staffing is now correctly sized. A vendor contract renewal swaps the escalation contact without anyone updating the internal routing list. Each decision, taken alone, was the right call for the person making it. None of the four people involved did anything a reasonable manager would not do. The workflow the board believes it approved and the workflow actually running the company's claims no longer resemble each other, and no single decision is responsible for the distance between them.
The Mechanism
The reason this keeps happening is not carelessness. It is that most organizations attach oversight to a decision instead of to a condition. The board approves a workflow at a point in time. What it should be approving is a standing commitment: a named domain the review step covers, a named red flag that would trigger a report if the coverage narrows, a named person with authority to restore it, and a named escalation path if that person cannot. Touch Stone Publishers calls this four-part discipline the Accountability Contract Model, and it is the only structure that survives contact with a staffing shortage, because it does not depend on anyone remembering that a threshold used to be different. It depends on a number that either holds or does not.
A workflow governed only by a one-time approval has no mechanism for noticing drift, because drift, by definition, does not look like a decision to break the rule. It looks like four separate people solving four separate problems well. A workflow governed by the Accountability Contract Model has a different property: the moment review coverage falls below the number the board fixed at approval, a report is owed, regardless of how reasonable the manager's reason was for the change. The contract does not ask whether the decision was defensible. It asks whether the number moved. Those are different questions, and only the second one can actually be checked.
The Violation Cost
Consider what happens without that number. The underwriting workflow above runs for fourteen months on the narrowed threshold before anyone outside the claims team learns it exists. A regulatory examination or a plaintiff's discovery request eventually asks for the workflow the board approved and the workflow the company actually ran. The gap between those two documents is not explained by fraud. It is explained by four competent people, none of whom were told that their local, sensible fix was the kind of decision that needed to be reported upward. The minutes from the original approval will read cleanly. They will also be irrelevant, because they describe a workflow the company stopped running more than a year earlier without telling the one body responsible for knowing.
This is where the distinction between authority and reporting does its real work. No one in the scenario needed the board's permission to solve a staffing problem. Operational authority stayed exactly where it belonged. What went missing was the mechanism that would have converted an ordinary operational fix into a fact the board could act on, and the absence of that mechanism costs nothing until the year someone outside the company asks for it. By then, the honest answer is that no one owned the number, so no one can say when it moved or why.
The Application
An executive team applies this law by fixing, at the moment any AI-assisted workflow touches a regulated or consequential outcome, the four elements of the contract before the workflow goes live: the domain the review step covers, the red flag number that would mean coverage has narrowed, the person with standing authority to restore it, and the path that fact takes to reach the board if that person cannot. None of this requires slowing down operations. A claims manager facing a staffing shortage still makes the call to raise the threshold. What changes is that the decision now generates a record the moment the number crosses the line, rather than surviving as an unrecorded accommodation for fourteen months.
The four-part contract is deliberately narrow. It does not ask the board to approve staffing decisions, review-queue redesigns, or vendor transitions. It asks that one condition, fixed in advance and tied to a metric the operation already tracks, be self-executing when it is crossed. A board that builds this once, for each system where an AI output feeds a consequential decision, has built something durable enough to survive the turnover of every manager who ever touches that workflow. The full architecture for building the contract across a portfolio of systems, including how the reporting cadence sits above the technical monitoring layer, is developed in The Fiduciary Vacuum Executive Leadership Playbook.
A line without an owner and a number is not a governance control. It is a sentence waiting for someone to move it.
Touch Stone Publishers Limited | 2026 | touchstonepublishers.com