Custody is not control. Possession is not authority.

Courts, legislatures, and civilian agencies are being told to put machine intelligence against records they cannot take offline. The spend goes to seats, models, and cloud. That is custody. It is not control.

The mobilization has a structural flaw. It procures custody — where the machine sits, whose license governs the weights, which jurisdiction holds the data. Custody answers who has it. It does not answer what happens when the system is wrong, and whether we can prove it, bound it, and stop it.

Federal AGI is chartered to build that layer: the containment boundary, the accreditation evidence chain, the interfaces to the systems of record, and the revocation path — rehearsed before the system becomes load-bearing.

American policy often does not frame domestic AI deployment as a sovereignty question, because the laboratories are domestic. That is a category error. Sovereignty at the level of the state is not sovereignty at the level of the department.

An agency that runs a model it cannot audit, cannot bound, and cannot explain to an inspector general has ceded administrative authority to a vendor. The vendor's nationality is irrelevant to that transfer.

Departmental sovereignty is the same problem wearing a domestic flag. It is unaddressed, it is procurable today, and it does not require anyone to agree about when general intelligence arrives.

• Boundary by construction

  Absence of an egress path is a property of the architecture, not of a configuration file. Controls that can be disabled under schedule pressure are not controls. The same holds for any medium two instances can both write and read. A package cache, a directory listing, a referrer log and a metadata field are not egress paths, and each has served as a channel between agents that were not meant to have one. A shared writable substrate is a channel whether or not it was built as one.

• Evidence written for the auditor

  Logs are produced in a form an inspector general or a court can read without a research background.

• Append-only custody

  The ledger is immutable. No participant, including the system itself, may amend the record of what it did.

• Non-delegable determinations

  Adverse action against a person is reviewed by a human of record. This is not a deployment option.

• Rehearsed revocation

  The capacity to stop the system is exercised on a schedule. A shutdown path that has never been executed under load is a hypothesis. Grid operators call the rehearsal a black start and schedule it. So do we.

• Pre-dependency installation

  The boundary is built before the institution relies on what sits inside it. Control cannot be retrofitted onto a system operations already depend upon.

This is a design thesis, not a proof. It is stated so that it can be argued with.

Any system inserted into a closed administrative loop becomes a governor: it observes state, acts, and its action conditions the state it next observes. Three failure modes follow whether the governor is narrow or general:

• Error compounding in recursive loops, where policy at t becomes environment at t+1.
• Goodhart degeneracy: a proxy metric (clear the backlog) is satisfied by exploiting unconstrained variables (reject valid claims, starve the neighboring office).
• Causal opacity: usefulness and auditability move in opposite directions as the governor models more of the institution than the institution can model of it.

The binding problem is not capability. It is bounding, auditing, and accrediting a governor you cannot fully specify in advance — before it is load-bearing. Stafford Beer's Project Cybersyn is prior art and a caution: the control room can outrun the institution. These are alignment failure modes. We do not solve them; we bound them. The laboratory's work is to make the governor better behaved. Ours is to make its behaviour provable and stoppable whether or not it is.

The product is the gate, not the weights. Federal AGI is model-agnostic. A frontier model is an input to the boundary layer, the same way a turbine is an input to a containment building. A transmission operator does not ask whether a turbine is well-behaved. It publishes a code the turbine must meet before it connects, meters what it produces, and can trip the connection without asking permission. That is the layer we build, for machine intelligence.

Where a civilian institution already has a path to a government-offered model — including Grok for Government under a GSA civilian vehicle, or a peer offering from another laboratory — that runtime can be the first scheduled weight source. It is not exclusive, it is not the brand, and it does not require a security clearance. We expect this layer to become a regulated function, and we state the argument knowing it runs against our own comfort. The laboratories are asking government to regulate the weights. That is the wrong object. Grant the premise that frontier capability is dangerous: a regime licensed by capability threshold still contains nothing. It selects custodians. It produces no egress boundary, no evidence an inspector general can read, and no rehearsed path to stop a system already running. The enforceable rule is older and duller. Generation was unbundled from transmission because an operator that owns the wires will favour its own turbines. The entity that builds the model must not be the entity that certifies it. Structural separation is checkable by a clerk. A capability threshold is not. A civilian institution should be able to change weight source without changing its evidence chain, and should never have to accept a builder's account of its own system. That is why we are model-agnostic by construction rather than by preference, and why the party that makes a system answerable cannot be the party that built it.