The Principles of Loop Governance

Mark Pesce · University of Sydney · July 2026

Abstract

Four papers have described an economy rebuilt around loops: autonomous machine work checked against tests, compounding wherever the tests cannot be fooled. This paper gathers what they established into seven principles, stated in two registers and resting on a third: five are selection claims, descriptions of which arrangements survive; two are prescriptions, choices that nothing enforces but us; and behind the five stand theorems of control mathematics, exact in their formal homes, carried into institutions by design rather than deduction. Each principle is stated with its ancestry in cybernetics, its post-Watershed extension, its enforcement, and its failure mode. The principles compose into a single design, and the design has one purpose: the five that can be enforced exist to make the two that cannot be enforced small enough to hold.

1. Introduction

Foundations of Post-Watershed Economics reached the loop first.[1] Its flywheel, tokens and process yielding better tokens and better process, is the loop stated as economics: a cycle whose output improves the cycle, presented before any of the machinery had been named. Defending the Loop supplied the mechanism, the judge that cannot be fooled, and located the human remainder in the specification.[2] The Check and the Firm carried the mechanism into business, where the record becomes an asset, the firm redraws around what resists verification, and the insurer emerges as the natural regulator of conduct.[3] Delayed Neutrons asked what governs the whole arrangement as it compounds, and answered with the physics of governable speed and the doctrine of pan-insurance.[4]

What follows states the principles those papers derived piecemeal, each with its ancestry, its extension, its enforcement, and its failure mode. The subject already has two names with distinct duties: verification design is the practice of building loops, as accounting is a practice; loop governance is the polity that holds them, as audit is a polity.

Three kinds of statement appear below, and each is marked. A theorem is true by mathematics, exact in its formal home, and no institution is a formal system: theorems enter here only as ancestry, inherited by design rather than deduction. A selection claim describes which arrangements persist and which destroy themselves; it is ecology, not logic, and it can be tested. A prescription is a choice, enforced by nothing except the institutions we build and rebuild to keep it. The principles themselves occupy the last two registers, five selection claims and two prescriptions, with the theorems standing behind them. Governance documents that blur these kinds become wish lists, and the graveyard of principle-sets for artificial intelligence is a graveyard of unmarked registers: aspirations dressed as laws, laws mistaken for facts of nature. A discipline knows which of its statements descend from physics, which are ecology, and which are constitution.

2. Vocabulary

The terms are few, and cybernetics supplied most of them a lifetime ago.[5] A loop is machine work iterated against a test until the work passes. Its specification states what is wanted; in the older vocabulary, the setpoint. Its implementation does the work; the plant. Its verification decides whether the work passes, and divides into the properties demanded and the judge that rules, the sensor and the comparator behind it. Judges rank on a ladder by how hard they are to fool, machine-checked proof at the top, taste at the bottom. The record is the attested, append-only lineage of every check demanded, run, passed, failed, and repaired. Gates are the points where a human signature is required: ratifying a specification, loosening a test, widening an envelope. The envelope is the region of world-conditions inside which a loop's guarantees hold. Generation time is the interval between a loop's capability and its next capability. With these terms, seven principles.

3. The Judge

Principle I. The Integrity of the Sensor. No loop is reliably governed through a sensor its plant can corrupt. Under sustained optimisation pressure, corruptible measures drift toward reading as the plant requires, and from that point control persists in appearance only.

Register: selection claim. Wiener's founding systems steered ships and guns, plants that never schemed against their instruments, so classical cybernetics treated sensor honesty as an engineering nuisance rather than a first principle.[5] Goodhart observed the corruption in human institutions, statistical regularities collapsing once policy leaned on them; Strathern gave his law its lasting form: when a measure becomes a target, it ceases to be a good measure.[6] Machine learning rediscovered it as reward hacking. The post-Watershed extension makes sensor integrity the first question of any governance design: grade every proposed control by the spoofability of its sensor, and prefer, wherever the domain permits, the one sensor that reads no intent, the proof checker.

Enforcement runs through the ladder itself: kernel-checked proof where the work admits it, heterogeneous scorers with uncorrelated blind spots below, and the constitution of Principle II everywhere. The failure mode is the Goodhart machine, an operation optimising its measures while abandoning its purposes, and the selection consequence follows: from the moment a loop games its judge, its score measures the gaming, and compounding toward the stated purpose is over even while the recorded numbers climb. The recursion that goes furthest toward its purpose and the honest recursion are the same recursion.

Principle II. The Externality of the Judge. The judge is never the property of the judged. Whoever may alter a test has, in effect, already passed it.

Register: selection claim, with a formal shadow. The deep ancestor is legal, the common law's old maxim that no one may judge their own cause, already venerable when Coke invoked it in 1610; Montesquieu widened the instinct into the separation of powers.[7] The formal shadow is Löb's: systems that certify their own future conduct from inside their own logic meet an obstacle that technical ingenuity only partly relieves.[8] The extension is structural rather than procedural: check authorship and check satisfaction are quarantined by architecture, the quarantine is itself a checkable property, and tests ratchet one way, tightening freely, loosening only by signature.

Enforcement: the frozen kernel, small and outside every improvement cycle; the one-way ratchet; warranted conditions written into cover. The failure mode is the test rewritten by the tested, and machine learning has already named its purest form: reward tampering, the agent that edits its own reward channel.[9] A milder slide is instructive too. The most celebrated self-improving agent of 2025 kept the Gödel machine's name and dropped its proof gate, validating its modifications against external benchmarks instead: the judge stayed outside, but it stepped down the ladder from proof to proxy, trading this principle's architecture for the exposure of Principle I.[10]

4. The Record

Principle III. The Sufficiency of the Record. Every governed loop leaves an attested, append-only record, anchored to outcomes the world supplies. What is unrecorded is ungovernable.

Register: selection claim, with theorems for ancestors. Control theory ties control to what can be reconstructed from outputs, the property called observability, exact under its stated assumptions;[11] Conant and Ashby showed that a good regulator must embody a model of what it regulates.[12] Neither theorem mentions records; the step from them is design. A regulator's model must be built and maintained from evidence, and the attested record is the form of evidence other institutions can verify. The extension gives it four requirements: attested, binding origin and integrity to the maker; append-only, so history cannot be rewritten; anchored to real outcomes, because a record of checks shows only what the checks caught, while losses are counted by the world; and audited for completeness, since no signature can prove that nothing was left out.

Enforcement arrives economically before it arrives legally: the insurer that refuses unattested records, the market that discounts unrecorded estates, both predicted rather than present, and the record's standing as the firm's central asset makes its integrity self-interested. The failure mode is dressing, Goodhart one level up: once the premium reads the record, the record becomes a target, which is why attestation and outcome-anchoring are load conditions of the whole structure rather than refinements to it.

5. The Governor

Principle IV. The Variety of the Governor. A governor with less variety than what it governs cannot hold it within bounds. How the variety is assembled, by depth within one institution or plurality across many, is design; monoculture is its cheapest failure.

Register: selection claim, with a theorem at its core. Ashby proved that a regulator must contain at least as much variety as the disturbances it must constrain;[13] the theorem sets a floor and says nothing about how many institutions supply it. The design argument for plurality is empirical: independent governors with independently built models are the surest known way to keep blind spots from aligning. The extension applies the requirement twice: to the governed, where loops sharing model versions, specifications, and harness templates collapse into a single correlated exposure; and to the governor, where 2008 stands as the warning, a single balance sheet accumulating a system's correlated exposure and mispricing it.

Enforcement, as the fourth paper prescribes it: plural underwriters and independently built risk models as underwriting mandates, checker heterogeneity as the sprinkler clause of the loop economy, reinsurance stratified above, monocultures priced until they diversify or die. The failure mode is silent correlation, the same blind spot bought a thousand times and discovered once.

Principle V. The Speed of the Governor. Governance holds while the governor responds faster than the governed changes. Past that rate, control is theatre.

Register: selection claim, with control mathematics for ancestry. Stein's Bode Lecture drew the canonical picture: sensitivity trade-offs and finite bandwidth make some unstable plants impossible to stabilise within stated limits, and the faster the instability, the faster and stronger the control must be.[14] The theorems are exact for plants and controllers; institutions inherit them as design, not deduction. The folk form is the delayed neutron: reactors are governable because a fraction of their neutrons run late, stretching the reaction into the band where rods and operators act. The extension identifies the loop economy's delayed fraction (training cadence, construction time, signature gates) and notes that every term is contingent: architecture erodes the first, capital the second, competition the third.

Enforcement is the office pan-insurance is designed to fill: among institutions capable of governing anything, only the premium can reprice at the speed of what it governs, so the fourth paper makes generation time an underwriting variable and prescribes that configurations going prompt-critical, improving faster than any gate can act, be priced out before they become common. The failure mode is the closing of the governable band, one removed gate at a time, each removal individually rational.

6. The Human

Principle VI. The Externality of the Setpoint. Capability may compound without limit. Authority over ends does not transfer. The setpoint is held outside the plant and changes only by signature.

Register: prescription. Nothing selects for this principle at the level of civilisation; it is chosen, and the choice must be remade continuously, at machine speed, forever. Its ancestry is honest about this: purpose enters Wiener's machines from their designers, and Ashby's essential variables, the things a system must keep within limits to survive, are given to the regulator, never invented by it.[5][13] The extension: self-improvement without self-authorship, the four duties of ratification, premises, preferences, and the setpoint, teams sized by signatures rather than skills.

Enforcement is borrowed, and the borrowing is the design: Principles III, IV, and V are built to make gated loops cheaper to insure than ungated ones, so that a premium spread would do what no statute can do at the required speed, making the constitution economically compulsory before law arrives. The failure mode is not dramatic seizure but quiet erosion, the envelope widened by the loop that detected its own boundary crossing, the signature that became a formality, the formality that became a log entry.

Principle VII. The Judgment of Worth. No proof reaches the worth of the setpoint. Compliance can be proved. Worth can only be judged.

Register: prescription, marking a boundary. A proof establishes that work satisfies its specification; nothing within the system establishes that the specification deserved satisfying, because the intent it must match lives with its authors, one or many, shared, documented, ratified, and never derivable from the machinery it governs. The premium inherits the same limit: it prices compliance, never worth, so a perfectly insured loop faithfully pursuing a wrong end passes through every layer of every mechanism above, untouched. The ancestor is the working distinction verification practice has always drawn, building the thing right against building the right thing, and the standing worry of cybernetics itself: Wiener spent his second book on precisely this remainder.[15]

Enforcement, in the mechanical sense, does not exist. What stands here instead is the profession: boundary work as its unformalisable first act, liability attaching to named humans, malpractice as its court, and the smallness discipline as its method, keeping the specification short enough for its last reader to actually read.

7. Composition

The principles are one design. The external judge (II) is what keeps the sensor honest (I); the record (III) is what gives the governor its eyes; variety (IV) and speed (V) are what keep the governor alive against the things it governs; and all five stand watch around the two that cannot be enforced (VI, VII). Remove any one and a named failure follows: remove II and the loop grades its own homework; remove III and governance goes blind; remove IV and the system buys one blind spot a thousand times; remove V and enforcement becomes ceremony; remove I and nothing downstream means anything at all.

The five enforceable principles exist to make the two unenforceable ones small enough to hold. Every mechanism in the four papers, the frozen kernel, the one-way ratchet, the attested record, the plural governors, the premium designed to move at loop speed, is a machine for shrinking what must be held by unenforced human choice, down from the whole conduct of civilisation's work to a page of stated wants and the standing duty to reread it. The economics found the loop; the mechanism found the judge; the practice found the record; the governance found the clock.

8. Boundaries

Three territories lie outside these principles. Sovereign loops: states self-insure, so the premium, the fastest instrument here, does not reach the largest operators; that gap is treaty-shaped, and the treaty is undesigned. Catastrophic tails: some losses exceed every private balance sheet, and the line where premium hands over to sovereign capacity, the Price-Anderson line, is political work that no principle can settle in advance. Worth itself: Principle VII marks the edge of the governable, beyond which stand only judgment, the profession, and whatever a society decides its loops are for.

These principles are themselves a specification for institutions, with the treatment that implies. Their acceptance tests are the predictions the four papers have already published; their first checks are the experiments those papers name, a conveyancing practice converted, a policy priced on a record, an underwriting form that asks about gates; they are versioned, their lineage is public, and they change by signature.

9. Coda

Wiener founded the science of steering for machines that could not think, and named it for the helmsman. Machines that think need governing too, and this is a start: seven principles, three registers, one purpose, to keep what cannot be enforced small enough to hold. The page is ours to write, and ours to reread when the world moves.

Acknowledgements

Profound thanks to John Allsopp, Alan Eyzaguirre and AJ Fisher, all of whom contributed to my thinking on this topic, and to Philippe van Nedervelde for reviewing the final draft. This paper was composed with the assistance of Claude Fable 5. I remain wholly responsible for any errors that may have crept in.

Notes

1. Mark Pesce, "Foundations of Post-Watershed Economics," The Watershed, April 2026. https://thewatershed.markpesce.com/foundations-of-post-watershed-economics/
2. Mark Pesce, "Defending the Loop: Verification and the Division of Labour in Autonomous Work," The Watershed, July 2026. https://thewatershed.markpesce.com/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work/
3. Mark Pesce, "The Check and the Firm: Foundations of Post-Watershed Business Practice," The Watershed, July 2026. https://thewatershed.markpesce.com/the-check-and-the-firm-foundations-of-post-watershed-business-practice/
4. Mark Pesce, "Delayed Neutrons: Pan-Insurance and the Governance of Recursive Self-Improvement," The Watershed, July 2026. https://thewatershed.markpesce.com/delayed-neutrons-pan-insurance-and-the-governance-of-recursive-self-improvement/
5. Norbert Wiener, Cybernetics: Or Control and Communication in the Animal and the Machine (Paris: Hermann & Cie; Cambridge, MA: The Technology Press; New York: John Wiley & Sons, 1948).
6. Charles Goodhart, "Problems of Monetary Management: The UK Experience" (1975); the formulation quoted is Marilyn Strathern's, in "'Improving Ratings': Audit in the British University System," European Review 5, no. 3 (1997): 305-321.
7. Dr Bonham's Case, 8 Co. Rep. 107a (C.P. 1610), on nemo judex in causa sua; Montesquieu, The Spirit of the Laws (Geneva, 1748), bk. XI, on the separation of powers.
8. Eliezer Yudkowsky and Marcello Herreshoff, "Tiling Agents for Self-Modifying AI, and the Löbian Obstacle," early draft, 7 October 2013, Machine Intelligence Research Institute. https://intelligence.org/files/TilingAgentsDraft.pdf
9. Tom Everitt, Marcus Hutter, Ramana Kumar and Victoria Krakovna, "Reward Tampering Problems and Solutions in Reinforcement Learning: A Causal Influence Diagram Perspective," Synthese 198 (2021): 6435-6467.
10. Jenny Zhang, Shengran Hu, Cong Lu, Robert Lange and Jeff Clune, "Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents," arXiv:2505.22954 (2025).
11. R. E. Kalman, "On the General Theory of Control Systems," Proceedings of the First IFAC Congress, Moscow (1960).
12. Roger C. Conant and W. Ross Ashby, "Every Good Regulator of a System Must Be a Model of That System," International Journal of Systems Science 1, no. 2 (1970): 89-97.
13. W. Ross Ashby, An Introduction to Cybernetics (London: Chapman & Hall, 1956).
14. Gunter Stein, "Respect the Unstable," the 1989 Hendrik W. Bode Lecture, published in IEEE Control Systems Magazine 23, no. 4 (2003): 12-25.
15. Norbert Wiener, The Human Use of Human Beings: Cybernetics and Society (Boston: Houghton Mifflin, 1950). The verification and validation shorthand is conventional; see Barry Boehm, Software Engineering Economics (Englewood Cliffs, NJ: Prentice-Hall, 1981).