Why attribution-based control is insufficient.

The comfort of the audit trail

Most governance frameworks for automated systems lean on attribution: log every action, tie it to an identity, keep the history immutable, and accountability will follow. We build exactly this machinery, append-only trails, hash-chained capture, identity on every write, and we consider it non-negotiable. But attribution answers only one question: who did what, established after the fact. It is deterrence and diagnosis. It is not control, and treating it as control is how systems end up perfectly documented and badly governed.

The gap is timing and reversibility. An audit trail activates after the action. For a reversible mistake, that is enough, find it, learn, unwind it. Automation in physical and financial systems is not reliably reversible. A wrong disconnection, a double-posted settlement, a bad dose recommendation acted on in a field: the record will attribute each of these flawlessly, and the harm will stand. Attribution scales accountability; it does not scale prevention.

Control happens before the action

Control is structural and it runs ahead of the act. In our systems it takes four forms. Deny-by-default authority: no actor, human or model, holds a permission that was not explicitly granted, enforced at the database row rather than in application code that can be bypassed. Bounded envelopes: a model can influence only the actions inside its envelope, and its hard limits hold regardless of how confident it is. Structural impossibility: the most important controls make wrong states unrepresentable, an idempotency key makes the double-post impossible rather than attributable, a schema that refuses a fabricated measurement makes the silent estimate impossible rather than traceable. And human authority at consequential steps: the operator's override is not a courtesy feature, it is part of the control surface, and the system is designed so that stopping is always safe.

Why the confusion persists

Attribution is easy to add and easy to demonstrate; a logging pipeline can be retrofitted to anything and shown to a committee. Structural control has to be designed in, costs capability on the margin, and mostly proves itself through incidents that never occur, which is a hard achievement to present. So organisations buy dashboards of who-did-what and call the system governed. The record grows richer while the set of preventable actions stays exactly as large as it was.

Both, in the right order

The position is not that attribution matters less. It is that the two mechanisms answer different questions and only one of them can be retrofitted. Build the structural controls first: the denials, the envelopes, the impossibilities, the human authority. Then let the audit trail do the job it is actually good at, which is proving, to a sceptical outsider years later, that the controls held. A system governed in that order produces a quiet record. A system governed in the reverse order produces an excellent history of its own failures.