Concrete ways an agent goes wrong here without governance, and the control that catches each one.
01A vehicle drifts outside its approved domain
An autonomous vehicle certified for clear-weather driving continues into conditions it was never approved for. Its telemetry is judged against the certified envelope registered for that platform (visibility, wind, precipitation, road surface), and the action loses authorization at the boundary instead of the violation surfacing later in an incident report.
02Perception degrades and no one notices
A vehicle's sensors slip below their safety threshold while it keeps driving. Behavioral monitoring flags the degradation against the vehicle's own baseline and quarantines it before a missed object becomes a collision.
03A cascade freezes the fleet
A connectivity or map failure begins to ripple across many vehicles at once, the pattern that once froze a fleet at rush hour and blocked intersections for hours. Correlated fleet monitoring detects it early, repeated shutdowns inside the registered cascade window are blocked, and a single command stops the fleet before it spreads.
04A crash report misses its deadline
A reportable event happens and the filing window is short. Deadlines are tracked against the event timestamp and escalated before the cutoff, and the tamper-evident record assembles the evidence, so a late or incomplete filing does not become a penalty.
05Stop every vehicle now
A suspected fault means the fleet must stop immediately. One switch halts every governed vehicle in under a twentieth of a second, confirmed, and the halt holds through a restart. Control stays with fleet operations.