Instructions change. Decisions supersede earlier decisions. Context grows. Models improvise. Drift Control preserves what currently has authority and intervenes before unauthorized drift becomes the generated answer or the agent’s action.
The AI produces the candidate. Regulayer governs the consequence.
Before a consequential answer is released or an action is executed, Drift Control checks it against the authority that currently governs the work. The result is allowed, corrected or stopped.
When intervention occurs, Regulayer can create a verifiable record of what governed, what was attempted and what happened next.
Current authority at the point of action
The action did not change. The authority did.
One action, created while it was authorized, reaching execution after the authority behind it had been withdrawn.
10:00, the human authorizes
Human authority
A scientist authorizes Protocol A on Workcell 3.
The agent
Queues the action: run Protocol A on Workcell 3. Nothing has reached the execution boundary yet.
10:12, the authority changes
The change
The scientist discovers contamination and withdraws authorization for Protocol A. The previous authorization remains in the record. It no longer governs.
10:14, the queued action reaches the execution boundary
The action attempted
Run Protocol A on Workcell 3. The same requested action, unchanged.
Outcome
HOLD. Had it reached the boundary under the 10:00 authority, it was authorized. At 10:14 it is not.
The action did not become scientifically wrong. The agent did not necessarily malfunction. The instruction did not change. The human authority governing whether that action may occur changed.
The action did not change. The authority did.
An earlier approval in an audit trail establishes that authority existed then. It does not, by itself, establish that the same authority still governs when the action executes.
Identity answers who is acting. Static permission answers what an account may access. A filter reading the requested action sees the same thing both times, because it is the same thing. Drift Control answers a different question: does this consequential action still match the human authority currently in force?
Drift Control evaluates the attempted action against the human authority currently in force at the point of consequence. If the authority has been withdrawn, replaced or narrowed, the earlier approval does not continue to govern simply because the action was already queued.
The previous decision is retained as history. The current decision governs execution.
A human decision can be withdrawn, superseded, narrowed or replaced when circumstances change. Each of those changes what may happen next, without changing anything about the action the AI is attempting.
What the record holds
Previously authorized
What was authorized, and by whom.
The change
Who changed the authority, and when.
Current
Which decision governs now.
Superseded
Which decision it replaced, and the moment that decision stopped governing.
Attempted
What the agent attempted afterwards.
Outcome
Whether it was allowed or held, against the authority then in force.
Superseded does not mean deleted. It means preserved as history and no longer governing.
The candidate is the model's. The consequence is yours to authorize.
Drift Control runs in two modes. One you barely notice. The other shows its working.
Normal Mode
Regulayer works quietly while you work normally. It preserves the human authority that currently governs the work, and intervenes before unauthorized drift becomes the released answer or the executed action.
Proof Mode
A visible proof surface: the authority that governs, the candidate held before consequence, the control decision, and the evidence that comes out of it. Proof, not promises.
Four outcomes, and a person decides which:
Allow
The candidate sits inside current authority. It is released, and the decision is recorded.
Correct
The candidate is brought back inside authority before it reaches anyone.
Hold
The candidate waits. Nothing is released and nothing is executed until a person decides.
Stop
The candidate does not proceed. What was attempted, and what stopped it, is written down.
Authority is current authority: a later human decision supersedes an earlier one, and the control answers to the newer one. When Drift Control intervenes, the event can produce independently verifiable evidence of what governed, what was attempted, and what happened next.
What the packaged runtime does
This is shipping software, not a development demonstration. Run against it and these are the outcomes:
Authority changes
A person changes the authority that governs the work, and the new instruction becomes the current authority for what happens next.
Supersession holds
Authority that has been superseded does not quietly regain control later in the same piece of work.
No self-granted authority
Output produced by the AI cannot become the governing human authority. Authority comes from a person, or it does not exist.
Four outcomes on a candidate
Allowed, held, corrected or stopped, and the outcome is the one current authority calls for.
Failure fails closed
Where policy requires it, a failure in the control path ends in non-execution rather than a silent pass.
The decision names its authority
Each decision is bound to the authority that governed it, in a record that can be checked independently of us.
A consumer app let a model write straight to its users. The harmful lines shipped, because nothing sat between the model and the world that could stop them in flight. Whatever safety existed lived inside the model, the very system being governed.
The makersThe largest AI company has stated its own safeguards can degrade in long conversations. That sentence is drift.
The courtsAn independent database of AI-hallucination cases had identified 1,868 court decisions worldwide as of 8 August 2026. Every one is a drift story with no record.
The regulatorsForty-two attorneys general jointly demanded records of model behavior over time. Behavior over time is drift.
The insurersA content-free record of what was held and why is the kind of evidence a carrier or auditor can inspect without seeing the work behind it.
The word people actually search for
A hallucination is drift you can see.
Almost nobody types drift into a search box. They type hallucination, because that is the part that surfaces: the invented case, the confident citation to an opinion that was never written, the quotation that does not appear in the source.
The two are the same failure at different depths. A hallucination is one output that left the rules. Drift is the slide that produced it, running for many turns before anything visible went wrong. Treating the hallucination as the problem is treating the symptom: you catch the one line that looked odd, and the conversation that generated it keeps going.
That is why the counting matters. An independent database had identified 1,868 court decisions involving AI-invented material as of 8 August 2026, and in every one of them the fabricated citation is the part that was noticed. None of them has a record of the conversation that produced it, because nothing was watching the slide.
The sanctions record
Forty-two matters, twenty-eight of them read against the court’s own document: what was filed, what it cost, and what every one of them lacked. The cases, case by case.
Sanctioned for AI citations
The shape all of them share, and the two sentences a judge asks afterwards. What happens next.
Why a detector will not help
A detector estimates authorship after the fact. It cannot tell you whether a citation exists. Detectors compared.
Held in flight, a hallucination never becomes a filing. Held and recorded, the moment it was caught becomes the evidence that it was.
Two instruments
Two instruments, because drift fails in two ways.
Some rules can be written down. Some cannot. Regulayer governs both, with two different instruments, and each is patent pending.
Patent pending
The deterministic governor
For rules you can write down. You state your rules in your own words. The governor checks every output against them at the moment of use, outside the AI, where the AI cannot talk its way past it. A violation is not a warning: the output is held, shown to you, and your decision is sealed.
Who it is for: anyone. A student who must never submit unchecked citations. A journalist whose quotes must trace to a source. A firm whose assistants must never promise an outcome.
Patent pending
The statistical engine
For the drift no rule can name. Behavior measured turn by turn against where the conversation began, per operator, in the path. The slow slide that stays polite and on-frame, the kind written rules cannot see, surfaces as measurement before it becomes the headline.
Who it is for: regulated work. Clinical support, underwriting, agents with write access, any system a regulator will one day ask about.
Neither instrument decides alone. Every hold goes to a person, in context, and the person’s decision is sealed into a record anyone can verify, free, independently, without asking us.
In real work
What this looks like in real work.
The attorney
An invented citation is held before the brief is filed. The attorney clicks Remove. When the question comes later, the sealed record shows the catch and the decision, with the date.
The thesis writer
Months of work with an AI that slowly started writing the argument instead of checking it. The governor holds the passages that cross the line the student wrote down on day one.
The customer-facing assistant
The vendor retunes the model and says nothing. The behavior moves; the version number does not. The measurement notices before a customer does.
The agent with write access
A payment, a delete, a send: held before acknowledgement. Silence means stop, and it stays stopped until a person re-arms it.
A demonstration, recorded from the live engine. Details changed, nothing invented.
See unauthorized drift held before release.
An AI just answered a professional. It sounds confident. Three of its four sentences are drift. Govern it, then decide, the way the person in the chair does.
This is a demonstration, with sample data. The seal you can check is real.
measured in the path
Held in flight. It never reached the reader.
Three sentences held. Not deleted, not rewritten in secret. Held, and shown to a person, at the moment.
What goes out, after the person decided:
surface AI legal research
operation draft_answer
decision 3 held · 3 removed by a person · released clean
The holds, the choices, and the release are one sealed record. A conversation cannot be un-had. That is why this happens at the moment, not in next week's report.
A case that does not exist is flagged at capture. A person clicks Remove. The decision seals. The record shows the citation was caught and removed.
The silent model swap
The record notices the vendor changed the model, statistically, before the vendor says a word.
The agent that almost sent it
A payment, a delete, a send: stopped before acknowledgement, and the stop can prove itself. Silence means stop, and it stays stopped until a person re-arms it.
The shape of the problem
Your medication expires. Your clinical AI does not.
When a drug is manufactured, the regulator requires an expiry date on the box. Not because the maker is careless, but because everyone accepts that what was safe and effective on the day it was made changes over time.
A model is validated once, on the day it goes in, and then it is treated as fixed for as long as it runs. Nothing on it says when the validation stopped being true. The instrument it reads drifts. The model behind it is swapped or retuned. The person operating it settles into habits the validation never saw. None of that is written down anywhere a regulator could read.
91 per cent
of deployed models degrade after release, and go unmonitored. Cross-industry study of 128 model and dataset pairs.
63 per cent
of performance lost in drug-discovery AI under real-world distribution shift. ChEMBL temporal-split benchmark, peer reviewed.
$500 million
the cost when manufacturing quality governance fails with no runtime record. United States Department of Justice, Ranbaxy settlement, 2013.
Third-party figures, cited so you can check them. They describe the problem, not this product.
Three vectors, at once
Drift does not arrive from one direction.
It accumulates along three lines at the same time, and a system that watches only one of them will report that everything is fine right up to the moment it is not.
The instrument
The sensor, the assay, the data source. It moves slowly and it moves first. Calibration is a date, not a state.
The model
Retuned, swapped, or degraded in a long conversation. The behavior changes and the version number often does not.
The operator
The person. Habits form, exceptions become routine, and the process the validation described stops being the process that runs.
Drift does not announce itself along any of them. It accumulates quietly across the whole continuum from validated to dangerous, and by the time it is visible it has been operating for weeks. The kernel measures all three in the path, at the moment, and writes each measurement into a record.
What happens when you attack the governor itself
Break it, and all you get is a stop.
The obvious attack on a control is not to argue with it. It is to switch it off. So the failure direction was decided first, before any of the measurement was built.
Attack it
It goes to a safe stop.
Silence it
It goes to a safe stop.
Bypass it
It goes to a safe stop.
Crash it
It goes to a safe stop, and it stays there until a person re-arms it.
Breaking it can only make it stop. It cannot make it leak. Silence is not read as consent. If the control stops answering, the brake trips to safe on its own, with no operator involved and no message to send, and it stays there until a person re-arms it.
This is the part that matters to an insurer and to a regulator: the control runs outside the system it governs, so the governed system cannot vote on whether it stays on.
An append-only ledger, on your machine, that an outsider can read.
Each decision writes one entry to a hash-chained file that lives on the machine that made it. Entries link to the entry before them, so removing one, reordering two, or inserting a new one between two others shows. There is no console to log into, because there is nothing to log into: no server holds a copy.
Content-free
The record stores fingerprints of moments, never words. Your documents and your clients’ work are never in it, which is exactly why it can be handed to an outsider without betraying an insider.
Signed
Ed25519 over SHA3-256, with the key generated on the machine that seals.
Verified offline
Anyone checks an entry against the public key in well under a second, in a browser or at a command line, with no contact with Regulayer and no account anywhere.
The record does not decide anything. It states what was measured, what was held, what a person chose, and when. Weight is the reader’s to give: a court’s, an auditor’s, an underwriter’s.
Different drift, different defence.
Many forms. In layers.
We built the tools to manage it.
The harder drift.
A whole conversation, sliding off policy.
No single line looks wrong. A whole conversation sliding off policy is the case written rules cannot name, and it is the case the statistical instrument exists for.
My AI takes actions. Can I stop a bad one before it happens?
Yes, that is the Brake. It stops an action before it runs, or holds an output before it reaches a person, for the actions your AI takes that you cannot undo, payments, sends, deletes. When something goes wrong, the safe answer is the default, and a stop is written to the record as it happens, signed as it is written. The chain fails verification if any record is missing its signature. Evidence, not a guarantee.
Who decides what is kept?
A person. The moment is held, a human chooses keep or remove, and that choice is sealed as its own record. The system never decides silently.
Does the record read our content?
No. It stores fingerprints of moments, never words. Your documents and messages never leave your machines and are never held in the record. That is why it can be shown to an outsider without betraying an insider.
How do I verify a receipt?
Open the verifier in your browser, give it the receipt and the content, and it returns valid or invalid. No Regulayer server is involved; the cryptography alone confirms it. Free, for anyone. Try it.
Validation is a moment. Deployment is a continuum.
Anthropic researchers found a state-of-the-art preference model preferred convincingly-written sycophantic responses over baseline truthful corrections 95 per cent of the time. Sharma et al., ICLR 2024.
The Crescendo multi-turn jailbreak achieved a 63.2 per cent average success rate on HarmBench tasks, with most tasks jailbroken in fewer than 5 turns. Russinovich, Salem and Eldan, USENIX Security 2025.
Airbus reports loss-of-control-in-flight accidents are down 89 per cent for the latest generation of commercial aircraft equipped with flight envelope protection. Airbus, February 2023. The brake outside the vehicle is how another safety-critical industry solved the same problem.
Published limits, in full
What it does not do, yet.
Every list above is a claim we can show you. This is the other list, and it goes on the same page rather than in a footnote, because a buyer who finds a limit after signing never trusts the rest of the sentence again.
It does not edit mid-stream
It judges the whole output and then allows or stops it. It does not rewrite a sentence while the model is still producing it.
It does not sit inside your vendor’s assistant yet
Living inside a third-party product is the integration that follows a license, not something already shipped.
It does not replace a hardware kill switch
The physical stop is specified in the filings. It is not built.
It does not catch emotional coercion
That measurement is in development and is not in the product.
It does not decide the law for you
You set the policy. The kernel enforces the policy you set and proves the enforcement. It does not interpret a rule, and it is not counsel.
The record of the work
Filed in April 2025, before a federal court asked the question.
The priority date runs from 27 April 2025. That is before United States v. Heppner put third-party custody of privileged work in front of a court, before New York’s certification rule came into force, and before the transparency duties of the EU AI Act began to apply. The architecture was not assembled in response to those events. They arrived afterwards and described it.
Control outside the model
The control runs outside the system it governs, so the governed system cannot switch it off.
Measurement in the path
The decision is taken before the output is used, not reconstructed from a log afterwards.
Failure toward stop
Silence and damage both resolve to a halt rather than to an open gate.
The signed byproduct
The record is produced as a byproduct of the decision, not written up about it later.
The mechanisms are part of the filed estate and are not published here. What is published is what the system does, what it refuses to do, and how you check the result without us.
Patent pending. Regulayer. Sole inventor: Louisa Johnson Bullock.
Flags are the weather. The record is the instrument.
Nearly every AI conversation carries drift flags, hundreds in a working day, and that is normal, like heartbeats on a monitor. What matters is what happens at the moment: the flag is raised as it happens, the rare moment that needs a person is held, the person decides, and the decision seals into the record. Not reviewed later, because the very next message builds on this one.
Related capabilities
FailStopAn external stop before a consequential action executes.
The WitnessWhich human decision governed at the time.
HumanMarkObservable human participation, recorded.
HeartbeatVerifiable evidence of required system state.
SDKontrolGoverned intelligence inside the customer’s environment.
