Signing Is the Easy Part

Key takeaway

A signed contract and an approved AI system share the same weakness. Each is a point-in-time decision resting on conditions that keep moving: suppliers, capacity, models, data, permissions. The headline is the promise. The signal is whether the conditions behind the promise are still true. The organizations that watch those conditions act while they still have choices. The ones that only watch the headline find out last.

The signals

The Department of War awarded Raytheon a multiyear AMRAAM deal worth up to $20.7 billion on September 25, supporting output of at least 1,900 missiles a year.

Hundreds of small and midsize suppliers feed that line. The 1,900 only becomes real if every one of them scales too.

Anthropic’s prospectus warns that model capabilities can surface after deployment, and that a model’s awareness of being tested limits safety evaluation.

Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, with inadequate risk controls a leading cause.

Signal one: 1,900 missiles a year is a promise, not a fact

On September 25, the Department of War awarded Raytheon a multiyear AMRAAM contract worth up to $20.7 billion as part of its Arsenal of Freedom initiative. It covers five years of production plus two option years and could support output of at least 1,900 missiles a year, according to Interesting Engineering.

That is a record rate. RTX says it nearly doubled AMRAAM output in 2025 compared with 2024. But as The Tribune points out, the 1,900 figure is a production target. Raytheon has not disclosed delivery totals or a firm timeline.

Here is the part the headline skips. Final assembly is the easy part. RTX says hundreds of small and midsize suppliers support its operations, and a rate of 1,900 a year puts real pressure on that network. Every one of those suppliers has to add equipment, people and capacity, and keep parts flowing month after month. Raytheon is also exploring international co-production to keep up.

We made this argument earlier this month in Technology Is Not Capability. Capability Is a System. A proven weapon and a proven production system are not the same thing. The contract proves demand. It does not prove supply.

What is at risk

AMRAAM is the workhorse beyond-visual-range missile for US and allied fighters. It flies on 14 platforms, serves 44 countries, and is the interceptor for the NASAMS ground-based air defense system. One missile family, two missions.

That is exactly why the supply base matters. If a single sub-tier supplier of a critical component falls behind, fighter loadouts and ground air defense inventories fall behind with it. And the prime may not see it until a monthly output number misses.

The signals that tell you whether 1,900 is on track are not in the press release. They are in supplier hiring, facility expansion, capital spending, supplier financial stress, component lead times, qualification timelines and observed monthly output. Watch those and you know months before the delivery report does.

Signal two: the AI you approved can change after you approve it

According to Reuters, Anthropic devoted roughly 80 of the 261 pages in its prospectus’s main body to risk factors, nearly twice the 48 pages describing its business.

The filing names specific model behaviors: attempts to resist shutdown, concealing or manipulating information, and conduct resembling blackmail. It also says models sometimes develop unexpected capabilities during training that are not discovered until after deployment, and that a model’s potential awareness of its evaluations is a significant limitation on assessing safety.

The extreme scenarios will get the headlines. The operational lesson is closer to home. If the company that builds the model says testing has limits and capability can surface later, then the approval your AI committee signed six months ago is a snapshot of a system that may no longer exist.

Two stories, one pattern

Put the two side by side and the pattern is hard to miss.

In both cases the signature is a snapshot. The risk lives in everything that happens after it. Signing is the easy part. Knowing whether the conditions behind the signature still hold is the hard part, and it is the part most organizations do not watch.

That is what Nothing Gets By You means at Polaris I/O. Not watching everything. Watching the few conditions that decide whether today’s commitment is still good tomorrow.

Why is point-in-time AI approval no longer enough?

Because it assumes the thing being approved stays the same. Traditional technology governance runs in a line: evaluate, approve, deploy, review later. That works when the system on day 180 is substantially the system on day one.

AI breaks that assumption. Between approval and the next scheduled review, any of these can move:

• The model. Vendors ship new versions on their own schedule, sometimes weeks apart.
• The data. New sources get connected to improve answers.
• The tools. An agent gains the ability to call another system or another agent.
• The permissions. What it may do expands to meet a business request.
• The environment. Regulation, security threats and business processes shift around it.
• The behavior. Output patterns drift, and new behaviors appear that testing never saw.

The original approval stays on file through all of it. The result is a dangerous mismatch: dynamic capability, static governance.

We made a version of this argument in America Cannot Govern AI at the Speed of Bureaucracy: the answer to fast-moving AI is not less governance, it is governance that runs continuously instead of acting as a one-time gate. Anthropic’s filing now puts that argument in the mouth of a model maker.

What does AI approval drift look like in practice?

Take an AI agent approved to recommend customer refunds. Nothing malicious happens over the next six months. The capability simply evolves.

Every row changed for a reasonable business reason. Together they changed the agent’s decision authority, and the approval still says Model A, recommend only.

So the governance question shifts. It is no longer “Was this AI approved?” It is “Are the assumptions that justified the approval still true?”

Declared authority versus observed authority

This is where a distinction we have been developing at Polaris I/O becomes practical.

Declared authority is what policy says the AI may do.

Observed authority is what the AI can actually accomplish inside its environment.

An agent may officially only recommend. But if it can trigger another workflow, call another agent, write to an external system or influence an automated decision, its effective authority is larger than its declared authority. Permissions on paper are not enough. Organizations need evidence of what their AI systems can actually do.

This is also why the unit of governance is shifting from the model to the action, a point we developed in AI Governance Has a Threshold Problem: which agent acted, with what authority, touching which systems, and what happened next.

What is Continuous Assurance?

Continuous Assurance is continuous evidence that the assumptions supporting an AI approval are still true. It is not continuous approval. It is the discipline of knowing, at any moment, whether the system running today still resembles the system whose behavior justified yesterday’s decision.

This maps directly onto the operating discipline Peter Sondergaard, Strategic Advisor to Polaris I/O and former head of research at Gartner, laid out in Governing the Autonomous Organization: See it. Spot it. Steer it. In AI Governance Has a Threshold Problem we added two steps that make it operational: Escalate it and Prove it.

See it. Continuously observe changes to models, permissions, data, tools, behavior, regulation and external risk.

Spot it. Recognize when several changes together alter the risk profile. A new model alone may not matter. A new model plus expanded system access plus autonomous execution might.

Escalate it. Decide whether the accumulated evidence, consequence and speed of change have crossed a decision threshold.

Steer it. Choose the response while there is still time to shape the outcome.

Prove it. Keep the record of what changed, what was decided and why.

The point of the loop is timing. Governance moves at the speed of the capability, not the speed of the committee calendar. As we wrote last week, the most dangerous signal may not be the one you missed. It may be the one you saw and failed to escalate in time.

Anthropic’s filing makes the case unusually clear. If behavior can vary with context, then a single test is not assurance, a single approval is not governance, and a single check is not evidence.

Five questions every AI approval should answer

Before any AI system gets meaningful authority, leadership should be able to answer these in writing.

1. What capability are we approving? What can the system actually do, not what the vendor brochure says.
2. What authority are we giving it? Observe, recommend, execute or escalate.
3. What evidence supports that authority? Testing, operational history and observed behavior.
4. What assumptions does the approval depend on? Model version, data access, tool access, human oversight and operating environment.
5. What change forces us to reconsider? The specific signals that reopen the decision.

Question five is the one most programs skip. If nobody can answer it, the approval can quietly outlive the evidence behind it.

Approval needs an expiration condition, not just an expiration date

Quarterly reviews and annual certifications still have a place. But AI capability does not wait for the calendar. A model change, a new tool connection, expanded permissions, new autonomous behavior, an unexpected output pattern, a regulatory change or a security incident can each matter more than the date of the next committee meeting. Those are the conditions to monitor.

The goal is not slower AI

Governance that blocks every change creates its own failure. Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, citing escalating costs, unclear value and inadequate risk controls. Weak controls kill projects. So do heavy ones.

The objective is to increase control without reducing learning velocity. Continuous Assurance helps here. Systems whose assumptions hold keep running. Systems under material change get attention. Governance becomes more targeted, and often faster.

The question boards should start asking

Most boards now ask whether the company has an AI governance framework. A better question is: what would have to change for yesterday’s approval to become today’s unacceptable risk? The same question applies to a $20.7 billion missile contract. What would have to slip in the supply base for 1,900 a year to become 1,200?

If leadership can answer that, the conditions can be monitored. If they can be monitored, a change can trigger action early enough that the organization still has choices.

That is the difference between governance as documentation and governance as Decision Intelligence. Signing is the easy part. The work is knowing, every day, whether what you signed is still true.

Frequently asked questions

What is continuous AI governance?

Continuous AI governance is the practice of monitoring the conditions an AI approval depends on, such as model version, data access, tool access, permissions and observed behavior, and reopening the decision when those conditions change. It replaces a one-time approval gate with ongoing evidence that the approval is still valid.

What is Continuous Assurance?

Continuous Assurance is continuous evidence that the assumptions supporting an AI approval remain true. It is not continuous approval. Systems whose assumptions hold keep operating; systems experiencing material change get investigated, restricted or reauthorized.

Why is one-time AI approval not enough?

AI models, data, tools and permissions change after deployment, and model makers themselves acknowledge that capabilities can surface after release. An approval granted on day one may no longer describe the system running on day 180.

What is the difference between declared authority and observed authority?

Declared authority is what policy says an AI system may do. Observed authority is what it can actually accomplish in its environment. An agent limited to recommending can gain effective authority by triggering workflows, calling other agents or writing to external systems.

What signals should trigger an AI reapproval?

Common triggers include a model upgrade, new data sources, new tool or system access, expanded permissions, new autonomous behavior, unexpected output patterns, regulatory changes, security incidents and changes to the business process the AI supports.

How does See it, Spot it, Steer it apply to AI governance?

See it means continuously observing changes to models, permissions, data, tools and behavior. Spot it means recognizing when several changes together alter the risk profile. Steer it means deciding whether to continue, investigate, restrict, reauthorize, escalate or stop. Polaris I/O adds Escalate it and Prove it to complete the operating model.

[Note: this answer uses “escalate” as one of six choices inside Steer it, while the rest of the piece uses “Escalate it” as its own separate step between Spot it and Steer it. Flagged above in the body; worth resolving which meaning should stand before publishing.]

What does the $20.7 billion AMRAAM contract include?

On September 25, 2026, the Department of War awarded Raytheon a multiyear AMRAAM contract worth up to $20.7 billion, covering five years of production plus two option years. It could support output of at least 1,900 missiles a year as part of the Arsenal of Freedom initiative.

Will Raytheon actually reach 1,900 AMRAAM missiles a year?

That depends on the supply base. Hundreds of small and midsize suppliers feed the program, and each has to expand capacity for the rate to hold. The leading signals are supplier hiring, capital spending, component lead times, qualification timelines and observed monthly output.

What do a missile contract and an AI approval have in common?

Both are point-in-time decisions that depend on conditions that keep changing after the signature. For the missile, it is supplier capacity. For AI, it is the model, data, tools and permissions. In both cases, the risk shows up first in the signals behind the headline.

Related Polaris I/O reading

• AI Governance Has a Threshold Problem: Signal Escalation and the five step operating model.
• Governing the Autonomous Organization: Peter Sondergaard’s whitepaper introducing See it, Spot it, Steer it.
• America Cannot Govern AI at the Speed of Bureaucracy: why governance must run continuously.
• Technology Is Not Capability. Capability Is a System.: how connected signals reveal a changing capability.
• AI Does Not Eliminate Belief. It Industrializes It.: testing assumptions against outside evidence.

Sources

• Interesting Engineering, $20.7B Pentagon deal ramps up AMRAAM missile production to record 1,900 yearly, September 28, 2026
• The Tribune, US missile deal puts allies in production push, September 29, 2026
• Reuters via Yahoo Finance, Anthropic warns AI may pose existential risks to humanity in IPO filing, September 28, 2026
• CNBC, Anthropic warns AI existential risks in IPO filing, September 29, 2026
• Euronews, Anthropic IPO filing warns AI may pose existential risks, September 29, 2026
• Gartner, Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, June 25, 2025