Governance by Post-Mortem: Why Risk Tolerance Cannot Substitute for Pre-Execution Authorization

This essay examines a failure pattern in AI governance: the use of risk-appetite language to excuse the absence of a control capable of performing the required control function. It separates experimental failure, bounded operational failure, and governance failure at consequential execution boundaries; states the control-sufficiency precondition, under which risk acceptance begins only after the control relied upon is capable of performing the function the consequence requires; and defines governance by post-mortem as reliance on post-execution observation as the operative control for a requirement that depends on pre-execution authorization. The argument extends prior FERZ work on the distinction between monitoring and runtime authorization. Risk appetite can price residual risk. It cannot cure structural incapacity. Artifact class: Essay.Canonical web version: ferz.ai/articles/governance-by-post-mortemVersion: 1.0 (August 2026)License: CC BY 4.0. © 2026 FERZ, Inc. Related works: From Monitoring to Authorization; On the Impossibility of Observability-Based Authorization.