When Should You Stop an AI Deployment?

The question every governance program should answer — and almost none do

Every AI Article Tells You How to Launch. This One Tells You When to Stop.

Your AI deployment is live. It is generating revenue. Leadership is celebrating. Customers are using it. And you have found evidence it is causing harm. What do you do?

This is the question nobody in AI governance wants to confront. The entire discourse — conferences, frameworks, vendor blogs, consulting decks — is oriented toward launching, scaling, governing, and optimizing. Thousands of articles tell you how to build an AI governance program. How to assess risk. How to comply with the EU AI Act. How to structure an ethics board. Almost nothing tells you when to exercise the hardest power governance confers: the power to stop.

The evidence demands this conversation. Zillow lost $881 million because nobody stopped an algorithm that was known to be underperforming for months. Australia's Robodebt scheme cost $1.87 billion and was linked to deaths by suicide because it operated for five years despite internal knowledge of its legal fragility. NYC's MyCity chatbot gave illegal advice for nearly two years after harmful outputs were documented, because political inertia and sunk costs kept it running. 42% of companies abandoned most AI initiatives in 2025, up from 17% in 2024 — a wave of delayed stop decisions that represents billions in wasted investment and untold organizational damage.

This article is the capstone of the "honest governance" trilogy. B13 established that governance frameworks have structural limitations — they are necessary but not sufficient. B14 exposed governance theatre — the gap between what organizations claim about their governance and what their governance actually does. B15 asks the question that connects them: if your governance is real — not theatre, not performance — prove it. When would it stop something?

The thesis is straightforward: the measure of your AI governance is not the documents you have written, the boards you have convened, or the audits you have conducted. It is whether you would stop a deployment that is making money but causing harm. If you cannot answer yes — not hypothetically, but with specific criteria, designated authority, and organizational will — then everything else is theatre. This article gives you the framework to answer yes.

What follows draws from four domains that have been solving the "when to stop" question for decades — aviation, NASA launch operations, clinical trials, and financial markets. Each provides a model that AI governance can adopt, adapt, and operationalize. The stop decision is not novel. It is borrowed. The only novel thing is that AI governance has not borrowed it yet.

A Taxonomy of AI Deployments That Should Have Been Stopped

The pattern is consistent across every major AI failure: the evidence of harm preceded the stop decision by months or years. The question is never "did someone know?" It is always "why did nobody act?"

Stopped Too Late: Zillow ($881M Write-Down)

Zillow's iBuyer algorithm used an automated model to price and purchase homes for resale. The algorithm consistently overvalued properties in rapidly changing markets and failed to account for cooling conditions in summer 2021. Worse, Zillow deliberately began bidding above its own model's predictions to gain market share — a human decision to override an already-flawed algorithm. The result: an $881 million write-down, 2,000 employees laid off (25% of the workforce), and approximately 7,000 homes the company had overpaid for that needed to be sold at a loss.

The stop decision came in November 2021, when CEO Rich Barton cited a "lack of confidence in its home buying algorithm's ability to accurately predict fluctuations in home prices." The algorithm was known to be underperforming for months before anyone with stop authority acted. Nobody with stop authority acted until the losses became catastrophic and public.

Stopped Too Late: Australia's Robodebt ($1.87B + Lives)

Australia's Robodebt scheme replaced manual welfare overpayment calculations with automated data-matching that compared Centrelink records with averaged annual income data. The averaging method was fundamentally flawed: it attributed equal income across all periods, systematically flagging people with variable incomes — seasonal workers, students, casual employees — as having been overpaid. The Royal Commission found the scheme was "crude, cruel, and unlawful".

The human cost: $1.872 billion in total settlement, approximately 400,000 people received compensation, and at least two documented deaths by suicide linked to Robodebt debt notices. The scheme operated for approximately five years despite internal knowledge of its legal fragility. The governance mechanisms existed on paper — ombudsman, privacy commissioners, auditors — but nobody exercised them. The stop decision was ultimately forced by legal action, not by governance.

Stopped Too Late: NYC MyCity Chatbot (Years of Illegal Advice)

The Markup's testing in March 2024 revealed that NYC's $600,000+ MyCity business chatbot was advising employers they could take workers' tips (violating NY Labor Law), telling landlords they could refuse tenants using housing vouchers (illegal since 2008), and stating "no regulations" mandated cash acceptance (NYC has required businesses to accept cash since 2020). Despite documented evidence, the chatbot remained active for nearly two years after problems were identified. Incoming Mayor Mamdani called it "functionally unusable" and moved to terminate it in January 2026, amid a $12 billion budget gap.

This is a case where the stop decision took almost two years from evidence to action. Political inertia, sunk costs, and the absence of clear stop criteria kept a system running that was actively encouraging illegal behavior on an official government website.

Stopped Quickly: Microsoft Tay (16 Hours)

Microsoft's Tay chatbot was shut down within 16 hours of launch in 2016, after coordinated exploitation by 4chan users turned it into a vehicle for racist and antisemitic content. This is the positive case study. Someone at Microsoft had both the authority and the willingness to pull the plug immediately. The lesson is not that the deployment was bad — it was. The lesson is that the stop decision happened in hours, not months or years. Compare Tay's 16 hours to NYC MyCity's two years or Robodebt's five years.

Stopped After External Pressure

Google paused Gemini's image generation in February 2024 after overcorrected diversity prompts produced historically absurd outputs — Black Vikings, non-white US Founding Fathers. The stop was reactive, driven by viral social media backlash, not proactive governance. Microsoft paused Recall in June 2024 after security researchers discovered unencrypted screenshot databases — external pressure, not internal monitoring. McDonald's ended its AI drive-thru partnership with IBM in June 2024 after three years of the AI consistently misinterpreting orders and generating viral customer complaints. Waymo recalled 1,212 robotaxis in May 2025, then again in December 2025 when vehicles were found passing stopped school buses.

Stopped Internally: Amazon AI Hiring Tool (3 Years Too Late)

Amazon's automated hiring system was built starting in 2014 and systematically penalized resumes containing the word "women's" or names of all-women's colleges. Engineers attempted to fix the bias for years before the company scrapped it in 2017. The right decision — years too late. The sunk cost of 3+ years of development made stopping harder than it should have been.

The Pattern

The spectrum runs from 16 hours (Tay) to 5+ years (Robodebt). The longer the delay, the higher the cost — and the cost compounds exponentially, not linearly. No organization in this list stopped because governance told them to. They stopped because the situation became untenable: public embarrassment, catastrophic financial losses, legal action, or all three. That is not governance. That is crisis management.

What Other Industries Knew Before AI Governance Existed

The stop decision is not new. Four domains have been solving it — with rigor, standardization, and lives at stake — for decades. AI governance does not need to invent the wheel. It needs to borrow it.

Aviation: The Go/No-Go Decision

The go/no-go decision is arguably the most important decision a pilot routinely makes. Pilots use structured evaluation tools: the PAVE checklist (Pilot, Aircraft, enVironment, External pressures), the IMSAFE checklist (Illness, Medication, Stress, Alcohol, Fatigue, Emotion), and continuous evaluation across three domains: the aircraft, the environment, and the human factor.

Three principles transfer directly to AI governance. First, the go/no-go decision is not a single decision but a series of continuous reevaluations throughout the flight. AI deployments should have continuous go/no-go checkpoints, not just a single launch gate. Second, the decision must be made independently of external pressures — schedule, passengers, economics. Third, the "Good Sense Rule" applies: even when no specific constraint is violated, if any hazardous condition exists, the decision-maker reports the threat. In aviation, stopping is a normal operational decision, not a failure.

NASA: Launch Commit Criteria and Mission Abort

NASA's Launch Commit Criteria define specific, pre-determined responses to anomalies during countdown. Individual factors must each go "green" before a "go" decision — ANY red means scrub. Every mission has pre-planned abort modes designed BEFORE the mission launches: Return to Launch Site, Transatlantic Abort Landing, Abort Once Around, Abort to Orbit. Specific roles have explicit abort authority at each phase.

The principle for AI: treat abort as a designed capability, not an emergency improvisation. Every AI deployment should have pre-planned stop criteria and decommissioning procedures before it launches, just as every shuttle mission had abort procedures before it left the pad.

Clinical Trials: Data Safety Monitoring Boards

Data Safety Monitoring Boards (DSMBs) are independent committees — explicitly separate from trial organizers and investigators — established to conduct interim monitoring of clinical trials. They review accumulated data for participant safety, study conduct, and efficacy. Stopping rules are triggered by three conditions: significantly increased risk of serious adverse effects, futility in obtaining meaningful outcomes, or significant treatment benefits (stopping for efficacy). Statistical stopping boundaries use methods like O'Brien-Fleming procedures.

This is the strongest analogy for AI governance. The DSMB model provides: independence from the team running the deployment, pre-defined stopping criteria, access to real-time data, and authority to recommend continuation, modification, or termination. AI deployments need an equivalent body — an independent safety board with the same four properties.

Financial Markets: Circuit Breakers

Stock market circuit breakers halt trading at three pre-defined thresholds when the S&P 500 drops: Level 1 (7% drop) triggers a 15-minute halt; Level 2 (13% drop) triggers another 15-minute halt; Level 3 (20% drop) halts trading for the remainder of the day. No human judgment is required to trigger them. The thresholds are quantitative, objective, and automatic.

There is an important caveat. MIT Sloan research identifies the "Magnet Effect": the fear of an imminent trading halt causes some investors to sell more aggressively, actually increasing volatility. This is directly relevant to AI: announcing that a system will be stopped at a certain threshold might cause stakeholders to game the metrics to avoid or accelerate the trigger.

The Common Thread: Pre-Commitment

All four domains share one principle that AI governance has largely failed to adopt: pre-commitment. Aviation defines go/no-go criteria before the flight. NASA defines abort modes before launch. Clinical trials define stopping rules before enrollment begins. Financial markets define circuit breaker thresholds before markets open. In every case, the stop conditions are defined BEFORE the pressure to continue exists. Post-hoc decisions to stop — made under the pressure of sunk costs, career risk, and organizational momentum — are almost always too late.

Why Organizations Don't Stop

Understanding why the stop decision fails is essential to designing systems where it succeeds. The barriers are not mysterious. They are structural, predictable, and addressable — but only if you name them.

The Sunk Cost Trap

AI projects cost $500,000 to $10M+ depending on scope and complexity. 50-90% fail to deliver on expected benefits. 95% of companies see zero measurable bottom-line impact from AI investments. When significant investment has been made, organizations resist abandoning projects even when evidence shows they are failing or harmful. Loss aversion compounds the sunk cost fallacy: when we follow through, we frame it as success. When we stop, we frame it as failure — even when stopping was the rational choice.

The Career Asymmetry

This is the most underexplored dynamic in AI governance. You are more likely to face career consequences for stopping a profitable AI product than for continuing to deploy a harmful one. Stopping creates a visible decision with an identifiable decision-maker who "killed" the project. Continuing is a diffuse, ongoing non-decision that nobody is individually accountable for.

The evidence from AI whistleblowers makes this concrete. Leopold Aschenbrenner was fired from OpenAI after warning that security defenses were "egregiously insufficient" against foreign adversaries. Daniel Kokotaljo faced retaliation; equity worth approximately $1.7 million was initially conditioned on compliance with a non-disparagement agreement. 13 whistleblowers in June 2024 issued "A Right to Warn about Advanced Artificial Intelligence", explicitly noting that confidentiality agreements and fear of retaliation prevented employees from raising safety concerns. The bipartisan AI Whistleblower Protection Act was introduced in May 2025, providing relief including reinstatement, back pay, and compensation — an implicit acknowledgment that the existing career asymmetry actively suppresses stop decisions.

The Diffusion of Responsibility

When multiple stakeholders are involved in an AI deployment, individual members feel less personal responsibility for stopping it. Junior employees defer accountability upward. Senior leaders assume the technical team would flag problems. Product teams expect someone else to raise the red flag. "Everyone assumed someone else was handling it" — the organizational version of the bystander effect. Robodebt had governance mechanisms at every level — ombudsman, privacy commissioners, auditors — and none stopped it.

The Competitive Pressure

"If we stop, our competitor won't." The race-to-the-bottom dynamic has been amplified by AI arms race rhetoric from 2024-2026. Executive compensation tied to product launches, not risk management. Board pressure for competitive speed. Without clear legal mandates to stop, organizations default to continue. The competitive argument provides the intellectual cover for a decision that is actually driven by sunk costs, career risk, and inertia.

The Missing Mechanism

Perhaps the simplest reason organizations don't stop: they never built the mechanism to do so. Most organizations lack pre-defined stop criteria, designated stop authority, and established stop procedures. 42% of companies abandoned most AI initiatives in 2025, up from 17% in 2024 — but these were not timely stops governed by criteria. They were delayed capitulations after prolonged failure. 65% of enterprise AI deployments are stalling. The gap between abandonment and timely stopping represents the cost of not having stop criteria in place. You cannot exercise a power you never built.

The Red Lines: Non-Negotiable Stop Triggers

Red lines are specific, non-negotiable prohibitions on certain AI behaviors or uses deemed too dangerous to permit. At the Seoul AI Safety Summit in 2024, 27 countries and the EU committed to establish shared risk thresholds. 300+ prominent figures endorsed the Global Call for AI Red Lines. The OECD defines red lines as thresholds of unacceptable model capabilities regardless of mitigations.

Global red lines are necessary but insufficient for organizational deployment decisions. What follows operationalizes the concept into six categories that any organization can adopt as pre-committed stop triggers for specific AI deployments.

Category 1: Physical Safety

Trigger: Documented physical harm or credible risk to life from AI system outputs or actions. Response: Immediate stop. No investigation period — stop first, investigate second. This is the Waymo recall model: when robotaxis were colliding with stationary objects, the recall was immediate. When they were passing stopped school buses, the second recall was immediate. Physical safety red lines are binary. If there is credible evidence of physical harm, the deployment stops. Period.

Category 2: Legal Compliance

Trigger: System outputs that violate applicable law. Response: Immediate stop. The NYC MyCity chatbot was advising illegal behavior on an official government website for nearly two years. A legal compliance red line with pre-committed enforcement would have stopped it the day The Markup published its findings — or ideally, before external testing caught what internal testing should have.

Category 3: Discrimination and Bias

Trigger: Statistically significant disparate impact on protected classes. Response: Stop for investigation. Amazon's hiring tool systematically disadvantaged women for three years before it was scrapped. A discrimination red line with pre-committed thresholds would have triggered investigation when the first statistically significant gender disparity was detected — not three years into a failed remediation effort.

Category 4: Privacy Breach

Trigger: Unauthorized collection, storage, or exposure of personal data. Response: Immediate stop. Microsoft Recall's unencrypted screenshot databases represent a privacy breach that external researchers caught before internal governance did. Clearview AI's scraping of 30+ billion photos led to a $51.75 million ACLU settlement. Privacy red lines are bright lines: unauthorized data handling stops the deployment.

Category 5: Accuracy Failure

Trigger: Systematic factual errors in high-stakes domains — medical, legal, financial. Response: Stop for investigation. NYC MyCity's legal advice was systematically wrong across multiple domains of law. Google's Bard demo error cost over $100 billion in market capitalization in a single day. Accuracy failures in high-stakes domains are not edge cases to be fixed iteratively — they are stop triggers to be enforced immediately.

Category 6: Capability Threshold

Trigger: Model reaches a pre-defined dangerous capability level. Response: Stop until safeguards are upgraded. This is the Anthropic RSP model: AI Safety Levels define specific capability thresholds, and reaching a threshold requires upgrading to the corresponding safety standard before deployment can continue. Anthropic activated ASL-3 safeguards in May 2025 for models that could assist in creating CBRN weapons. This is the closest thing in the AI industry to NASA's launch commit criteria: pre-committed thresholds with mandatory action.

The Stop Decision Architecture

Red lines define WHEN to stop. Architecture defines HOW. The stop decision requires four structural components: a kill-switch mechanism, a decision authority model, an escalation procedure, and post-stop protocols. Without all four, the stop decision is a hope, not a capability.

Kill-Switch Design

Current best practices for AI kill switches include layered shutdown systems rather than single switches, control plane separation (kill switches placed outside the agent's runtime, controlled by authenticated operators), multi-agent architecture where the coordinator decides what gets done and the gateway decides whether it is allowed, and automated monitoring combined with manual override capability.

Stanford's CodeX lab warns: "Kill switches don't work if the agent writes the policy." Kill-switch effectiveness depends on the governance architecture being outside the system's ability to modify. In 2024, major tech companies pledged to implement kill switches in advanced AI models, but the governance challenge remains: who controls the switch, what triggers it, and what happens to dependent systems when it is activated.

The Two-Key Model

Borrowing from nuclear launch authority, the two-key model requires multiple independent stakeholders to agree before a deployment proceeds — or before it is stopped. This prevents both rogue stops (one person unilaterally killing a valuable deployment) and rogue continuations (one person overriding safety concerns to keep shipping). Deployment and continuation decisions require sign-off from both the business owner AND an independent safety/governance function. Neither can overrule the other unilaterally. The business owner cannot ship over a safety objection. The safety function cannot kill a deployment without documented criteria.

Escalation Tiers

Based on the aviation, clinical trial, and financial circuit breaker models, the recommended escalation architecture has five tiers:

• Tier 1 — Automated Monitoring: Real-time detection of anomalies against predefined metrics. This is the financial circuit breaker equivalent — objective thresholds that trigger automatic pause for human review.
• Tier 2 — Operational Team: Investigation within defined SLA (hours, not weeks). The operational team determines whether the anomaly is a false positive, a fixable issue, or a genuine red-line violation.
• Tier 3 — Governance Function: Review with authority to pause deployment. The independent governance body — the DSMB equivalent — makes the continuation/modification/termination recommendation.
• Tier 4 — Executive Escalation: For decisions with significant business impact. The two-key model applies here: business AND governance must agree to continue.
• Tier 5 — Board Notification: For decisions involving red-line violations. The board must be informed when a deployment is stopped for safety, legal, or ethical reasons — and must be informed why.

Whistleblower Protections as Infrastructure

Without whistleblower protections, the career asymmetry ensures that nobody will exercise informal stop authority. The AI Whistleblower Protection Act introduced in May 2025 provides reinstatement, back pay, and compensation for damages — with bipartisan support from six senators. But legal protection is the floor, not the ceiling. Organizations must build internal cultures where raising stop concerns is rewarded, not penalized. The person who stops a deployment that would have caused harm should be treated the same way aviation treats the pilot who scrubs a flight: as a professional making a professional judgment.

Post-Stop Procedures

The stop decision is not the end. Post-stop procedures must include:

• Immediate containment: Prevent further harm while investigation proceeds.
• Root cause analysis: Determine whether the issue is fixable or fundamental.
• Stakeholder communication: Transparent disclosure to affected parties.
• Remediation: Fix the underlying issue if possible; permanent decommission if not.
• Lessons learned: Update organizational stop criteria based on findings.
• Regulatory compliance: Report to relevant authorities as required. Per NIST AI RMF guidance, irregular termination may itself increase risk if not properly managed — AI systems may be subject to regulatory requirements or future investigations.

What Governance Frameworks Already Say About Stopping

The good news: existing governance frameworks do address stopping. The bad news: none of them provide the operational specificity that aviation, clinical trials, or financial markets demand.

Anthropic RSP: The Strongest Model

Anthropic's Responsible Scaling Policy v3.0 is the closest thing in the AI industry to a pre-committed stop framework. AI Safety Levels define specific capability thresholds, and reaching a threshold requires upgrading to the corresponding safety standard before the model can be deployed. This is a binding commitment to stop — or at minimum pause — when specific conditions are met. It is not advisory. It is not optional. It is the commitment that makes the RSP more than a policy document.

NIST AI RMF: Decommissioning Provisions

NIST AI RMF GOVERN 1.7 establishes that processes and procedures must be in place for decommissioning and phasing out AI systems safely. It provides that when negative impacts arise, "superseding, disengaging, or deactivating/decommissioning may be necessary when impending risk is detected and feasible mitigation cannot be identified." It also warns against irregular or indiscriminate termination — AI systems may be subject to regulatory requirements or future investigations that require orderly decommission.

EU AI Act: Withdrawal Authority

The EU AI Act gives market surveillance authorities the power to require corrective action within a prescribed period, order system withdrawal or disabling if correction is inadequate, and mandate distributor recall. Penalties for non-compliance reach up to EUR 30 million or 6% of global turnover. The Act establishes the regulatory authority to stop — but places the mechanism in the hands of regulators, not deploying organizations themselves.

ISO 42001: Corrective Action

ISO 42001 Clause 10.2 requires organizations to take action to control and correct nonconformities, investigate root causes, prevent recurrence, and verify that fixes work. This is the AI management system equivalent of a corrective action process — but it does not explicitly mandate stopping deployment as a corrective action option.

The Gap

All frameworks address stopping to some degree, but none provide the operational specificity that high-reliability domains demand. No AI governance framework specifies quantitative stop thresholds (circuit breakers), mandates independent monitoring bodies (DSMBs), requires pre-planned stop procedures for every deployment (NASA abort modes), or treats stopping as a normal operational decision rather than an extraordinary crisis response (aviation go/no-go). This gap is what B15 fills.

From Stop Authority to Stop Culture

Architecture creates the capability to stop. Culture creates the willingness. Without both, the stop decision remains theoretical. The career asymmetry, the sunk cost trap, and the diffusion of responsibility are not solved by org charts and escalation procedures alone. They require a fundamental shift in how organizations think about the stop decision.

In aviation, the pilot who scrubs a flight due to safety concerns is never penalized. The decision is normalized, expected, and respected. In clinical trials, the DSMB that halts a trial early for safety reasons is doing its job — nobody questions whether the trial "should have been given more time." In financial markets, circuit breakers activate automatically, and the question of whether the halt was "necessary" is not asked.

AI governance must achieve the same normalization. Stopping is not failure. Stopping is governance working as designed. The organization that treats a stop decision as a success — evidence that the monitoring, the criteria, and the authority functioned correctly — will make better stop decisions than the organization that treats stopping as a sign that something went wrong.

Three cultural practices build this normalization. First, celebrate stops publicly: when governance halts or modifies a deployment, communicate the decision and the reasoning across the organization. Second, protect stop-decision makers: ensure that the individuals who exercise stop authority face no career penalty. Third, practice stops regularly: conduct tabletop exercises where the governance function practices the stop decision under simulated pressure, just as NASA practices abort procedures and clinical trials practice DSMB deliberations.

The Honest Governance Test: Five Questions

B13 asked: does your governance acknowledge its structural limitations? B14 asked: is your governance substance or theatre? B15 asks the capstone question: does your governance have the power, the criteria, and the willingness to stop a deployment?

Five questions determine whether your governance is real:

• Do you have pre-defined stop criteria for every AI deployment? Not general principles — specific, quantitative, testable criteria defined before launch. If the answer is no, you are operating without abort procedures.
• Is there an independent body (not the product team) with authority to halt deployment? The DSMB model requires separation of builder and evaluator. If the team that built it is the same team that decides whether to continue, you do not have independent oversight.
• Has your governance ever actually stopped or materially changed a deployment? The B14 substance test. If the answer is no after 12+ months, you have documentation, not governance.
• Are the people closest to the deployment protected if they raise concerns? Without whistleblower protections — both legal and cultural — the career asymmetry ensures silence.
• Could your stop decision survive pressure from a CEO, a board, or a market analyst? The stop decision that cannot survive institutional pressure is not a stop decision. It is a suggestion that leadership is free to overrule.

If you answered yes to all five, your governance has teeth. If you answered no to any, you have identified the specific structural gap to address. Start with the question you are most uncomfortable answering — that is where the gap is widest.

The Honest Governance Trilogy: Complete

This trilogy began with a premise: the most valuable thing AI governance can offer is honesty about what governance can and cannot do. Three articles, one argument:

• B13: The Limits of AI Governance Frameworks — Governance frameworks have five structural limitations that honesty, not denial, must address. The pacing problem, the opacity problem, the boundary problem, the measurement problem, and the emergence problem are architectural features, not implementation failures.
• B14: AI Governance Theatre — Most governance is performance, not substance. Five types of theatre — ethics board, policy, audit, transparency, and consultation theatre — create the appearance of responsibility without reducing risk. The 57-point drop from "having a policy" to "having decision authority" is the quantified gap.
• B15: When Should You Stop? — The ultimate test. If your governance acknowledges its limits (B13) and is substance rather than theatre (B14), then it must be able to answer this question with specific criteria, designated authority, and organizational willingness. The stop decision is the acid test that connects the entire trilogy.

Together, these three articles form the most honest public analysis of AI governance available. They are pro-governance. They are honest about what governance cannot do. And they provide the operational frameworks — from epistemic humility practices to failure pattern recognition to the ROI business case — that bridge the gap between what governance promises and what governance delivers.

The honest governance practitioner does not claim that frameworks solve everything. The honest governance practitioner says: "Here is what governance does, here is where it stops working, and here is the decision — the stop decision — that proves whether the governance is real." That practitioner, and that position, is what the field needs. It is the position this trilogy defends.

“The fragmentation we keep trying to fix is not a bug in our governance efforts. It is a feature of the thing we are trying to govern. And the willingness to stop — to say "this deployment should not continue" — is the feature that makes governance real.”