Human Signal · Field Instrument No. 01

The Two-Minute Governance Test

Find the sentence in your AI policy that decides which failures never reach leadership. Then rewrite it before an assessor, a regulator, or the failure itself finds it first.

What this instrument does.

One sentence in your AI governance policy decides which failures reach leadership and which failures compound in silence. This instrument finds that sentence, names the pattern behind it, scores your exposure, and walks you through the rewrite.

Prerequisites: your own policy, and the willingness to read it as an assessor would.

The distinction the whole test turns on.

An evidence trigger fires when a defined condition gets met, whether or not anyone finds the condition alarming. Error rate crosses a documented baseline. A model touches data outside its authorized scope. Nobody's judgment stands between the condition and the escalation.

An obviousness trigger fires when a human judges the problem visible enough, severe enough, or explainable enough to escalate. Significant incidents. Material issues. Clearly harmful outputs. Every one of those words hands the trigger to a person, and hands that person a stopwatch, a calendar, and a boss.

A control that only fires when the harm is obvious is not a control. That's a headline detector.

The failures that destroy institutions are precisely the ones that fail the obviousness test. A model drifting three percent a quarter never looks significant in any single week. A retrieval system quietly ingesting out-of-scope records produces no outrage until the audit.

The Trigger Lexicon: ten phrases.

Ten phrases, each one an obviousness trigger wearing a compliance font. Your policy contains at least two. Most contain five. Four of the ten:

• 01"Escalate significant incidents."
• 02"Report material issues to leadership."
• 04"Notify the committee as appropriate."
• 10"The vendor will provide notification of relevant events."

The instrument carries all ten, each with the reason it survives audit and fails in production.

What belongs in an AI escalation criteria policy.

Most teams searching for an AI incident response policy or an AI governance policy template are looking for the same missing thing: the criteria that decide when a human must act. A usable escalation criterion carries four properties, and a sentence missing any one of them will not fire under pressure.

A threshold, meaning a number, a boundary, or a named event that two reasonable people cannot dispute. A clock, stated in hours or days, because an escalation without a deadline is a suggestion with a routing slip. A name, held by one person rather than a committee, since alerts sent to everyone get read by no one. And no judgment verbs in the trigger sentence: assess, consider, evaluate, and determine belong in the disposition after the alarm fires, never in the decision of whether it fires.

Templates rarely supply those four. They supply the language that survives audit, which is a different goal from language that survives an incident. The gap between the two is where this instrument works.

Who runs this test.

Operators who own an AI system and the escalation path around it. Risk and compliance leads preparing for an assessment. Municipal and agency CISOs whose policy binder has never been read against the running environment. Anyone who would rather find the discretionary sentence themselves than have a regulator quote it back to them.

Contents.

• 01The Instruction
• 02The Test
• 03The Trigger Lexicon: Ten Phrases
• 04The Score
• 05Why Institutions Write Headline Detectors
• 06The Trust Gap: Locating Your Failure Mode
• 07The Three Questions That Survive the Stopwatch
• 08The Three Layers: Where Triggers Live
• 09The Rewrite Workshop
• 10Worksheet: The Trigger Inventory
• 11The Forty-Eight Hour Fix
• 12What This Test Cannot Do
• 13The Principle, and the House

Questions.

• How long does the test take?

  Reading the action-deciding sentences takes about two minutes per policy. Completing the trigger inventory, scoring the ratio, and drafting the first rewrite takes one afternoon.

• What format is the instrument, and how does delivery work?

  A 17-page PDF, First Edition, July 2026. Delivery is an instant download immediately after checkout. Licensed for individual professional use.

• Do I need a governance framework already in place?

  No. The test locates absence as readily as insufficiency. If the action-deciding sentences do not exist in your policy, that finding is itself the result, and Section 06 names what follows from it.

• Does this replace an assessment?

  No, and Section 12 says so directly. The test reads sentences, not systems, and the reader audits their own document. Independent scoring against a recognized control set is separate work.

What this test cannot do.

An instrument that oversells itself is an obviousness trigger with a price tag. The test reads sentences, not systems. The test cannot verify that conditions actually fire. The test cannot score your controls against a standard. And the test cannot supply independence, because you just audited your own document, which is the right first move and the wrong last one.

Section 12 states each boundary plainly, and names the work that lives beyond them.

Licensing this for a team, a cohort, or client work? Let's talk about a team license.

Dr. Tuboise Floyd is Founder & Principal of Human Signal, an independent AI governance research and media platform, and host of The AI Governance Briefing, an Apple Top 100 podcast. PhD, Adult Education and Systems Theory, Auburn University. TAIMScore™ Certified Assessor, HISPI. Defense Compliance Partner. Author of The Pedagogy Problem in AI Governance (SSRN, 2026).

Govern the machine.
Or be the resource it consumes.