AI Governance: What Exactly Are We Governing?

WP_AI_8.5 develops a three-object framework for clarifying what AI governance is actually governing. The paper begins from a structural problem in contemporary AI governance. Technical systems, human decision-makers, institutional actors, oversight mechanisms, accountability, safety, and responsibility are often discussed within the same governance language without clearly separating the objects to which those rules apply. This can produce governance object drift, in which the focus of governance shifts during analysis, and governance subject inversion, in which AI becomes increasingly personalized as the apparent actor while the humans and institutions exercising real authority become less visible. The paper identifies three distinct but connected objects of AI governance. The first is the AI entity itself. The paper distinguishes four governance identities: Tool, System, Agent, and Autonomous Actor. These categories are not claims about consciousness or legal personhood. They describe different operational relationships between AI capability, delegated authority, persistence, external consequence, and human reauthorization. The second object is the human authority structure across the AI lifecycle. Developers, testers, providers, approvers, regulators, administrators, operators, and users exercise different forms of authority and therefore require different forms of governance. Human conduct must remain a direct object of AI governance rather than being displaced by anthropomorphic descriptions of AI behavior. The third object is the institutional interface through which AI capability enters society. Admission, authorization, release, deployment, access, supervision, review, restriction, suspension, and withdrawal determine how technical capability becomes socially operative. The paper also distinguishes Governance Identity Drift from Governance Object Drift. The former occurs when an AI system’s actual operational identity changes while its formal governance category remains unchanged. The latter occurs when governance itself shifts its analytical object, for example when a human authorization decision is gradually redescribed as autonomous machine behavior. The central argument is that governance must define its own objects rather than inherit them passively from technical narratives. AI should be governed according to what kind of operational entity it is. Humans and institutions should be governed according to the authority they exercise. The human-AI institutional interface should be governed according to the social consequences it enables. WP_AI_8.5 builds on the preceding papers in the WP_AI_8 series. WP_AI_8.1 established the engineering circuit-breaker principle; WP_AI_8.2 examined responsibility escape; WP_AI_8.3 developed a dual-track framework connecting capability control and human responsibility; and WP_AI_8.4 addressed the conditions under which AI capability may move from controlled development into social release. WP_AI_8.5 moves one level upward by clarifying the governance objects to which those mechanisms apply.