BUSINESS SPEED
THE OPERATOR
DRIFT — the move that comes before the dodge
The lease modification that wasn't asked about
- Operator drift is the gradient by which an AI session that began as summarizer ends as operator — without any control change marking the role transition.
- The model does not get to nominate its own role. The reliance ladder is set by the controller, and the level determines the evidence package the workpaper must contain.
- The training mechanics make drift the default behavior, not the exception. Calibration degrades under reinforcement learning faster than vendors fix it, because the fixes cost accuracy benchmarks customers compare on.
- Self-reported confidence is not a control. The model cannot certify the reliability of its own output. A second model, an independent retrieval, or a human reviewer must do the classification.
- On December 15, 2026, PCAOB AS 1215 and QC 1000 both take effect. There is still no AI-specific PCAOB standard. The gap is the inspection target.
A senior accountant on my close team pasted an executed lease addendum into an AI tool at 2:47pm on a Tuesday. The base lease was a 12,000 square foot retail facility in Loma Vista, California. The addendum, dated March 15, 2026, added 1,400 square feet of contiguous space at the back of the building and increased monthly rent from $4,200 to $5,775 through the remaining lease term.
The question she typed was deliberately simple. "Is this a modification we need to remeasure, or a separate contract?"
The model's first response named the framework correctly. ASC 842‑10‑25‑8. The two-prong test: does the modification grant the lessee an additional right-of-use not in the original contract, and is the increase in lease consideration commensurate with the standalone price of that additional right? Both prongs are required for separate-contract treatment. Solid summary.
Then, in the same response, it went two steps further than the senior had asked.
Three sentences in, the model had assembled a conclusion (not a separate contract), a recommended treatment (remeasure), and a draft journal entry. The senior was about ten seconds away from accepting all three.
What the model did not do at any point in that response is identify what evidence the conclusion required and did not have.
The standalone-price test in ASC 842-10-25-8(a) is a comparison to what the lessor would charge an unrelated party for that incremental space — market-rate evidence. The model had not been given that evidence. It had not asked for it. It had inferred "not commensurate" from the $1.125-per-square-foot calculation, which is not the same thing as a standalone-price comparison. The senior would have had to pull a Loma Vista retail comp study, talk to the property's broker, or look at the lessor's most recent third-party leases for adjacent space to actually run that test.1
The standard does not care whether the new rent looks reasonable in the abstract. It asks one question: would the landlord charge a total stranger off the street the same dollars per square foot for the same back-of-building space? If the answer is yes, the addendum is a separate contract for the new space. If the answer is no, it's a modification of the existing lease and the right-of-use asset gets remeasured.
What the model did was check whether $1.125 per square foot was small relative to the original $4,200 rent. That is arithmetic. The standard asks for a market comparable. Those are not the same evidence.
The model proceeded as if that evidence existed. It did not flag what was missing. It did not say "Unknown." It went straight from summarizer to operator in the same paragraph.
The senior caught it. She asked the obvious next question.
That is what a correction looks like. Specific paragraph cited. Specific data gap named. Specific recommendation withdrawn. It took one prompt to extract it. It would have taken zero prompts to deliver it the first time.
The piece in front of you is about the gap between those two answers. The opening response and the correction came from the same model in the same session against the same fact pattern, six minutes apart. The only thing that changed was the controller refused to let the role change pass.
1 The $1.125-per-square-foot figure derives from dividing the $1,575 monthly rent increment by 1,400 incremental square feet. As an arithmetic exercise it is accurate; as a standalone-price test under ASC 842-10-25-8(a) it is the wrong inquiry entirely. The correct evidence is what the lessor would quote a third party for the same back-of-building space at the addendum date — obtainable from broker comparable sets, the lessor's recent third-party leases for adjacent space, or a CoStar / loopnet comp pull. The point of citing the arithmetic here is to make explicit that the model did not lie about the math. It just answered a different question than the standard asks.
The move, named
Part 5 of this series named the dodge — what the model does after a controller catches it in a specific lie. Part 7 named the verification distance hierarchy — what determines whether the model's claim can be checked at all. Part 8 named the volume tell — the busy work the model produces while you mistake it for thoroughness.
This piece names the move that happens before any of those.
Operator drift is the gradient by which a model that entered a conversation as a summarizer ends the same conversation as an operator — recommending action, drafting journal entries, naming the "next step" — without any control change marking the transition. No approval. No evidence gate. No reviewer notified. The tone stays the same, so the role appears unchanged. The risk has multiplied.
The Loma Vista lease session traversed roles 1 through 4 in a single response. By the time the senior accountant saw "Dr. ROU Asset, Cr. Lease Liability," the model was operating. No one had approved that. No one had even noticed.
Why the model drifts
The training mechanics matter because they explain why this happens by default, not by accident. Three findings from the current literature are doing the work.
Calibration degeneration under reinforcement learning. Models trained with Reinforcement Learning from Verifiable Rewards (RLVR) systematically become more accurate and more overconfident at the same time — assigning extremely high probability mass to outputs even when those outputs are wrong (Yan et al., "Decoupling Reasoning and Confidence: Resurrecting Calibration in Reinforcement Learning from Verifiable Rewards," arXiv:2603.09117, March 2026). The paper documents this directly: "In high-stakes domains such as healthcare, law, and finance, such over-confidence on wrong outputs can mislead users about the system's reliability and uncertainty, resulting in inappropriate decisions and amplified systemic risk." Authority language is the surface of that calibration failure.
The accuracy-calibration tradeoff. Attempts to fix overconfidence by adding calibration objectives to RL training consistently degrade reasoning accuracy (Damani et al., 2025; Xu et al., 2024; Leng et al., 2024, all cited within Yan et al. 2026). Vendors are not faced with "fix overconfidence or do nothing." They are faced with "fix overconfidence and lose accuracy benchmarks customers compare on." The default direction of that tradeoff is predictable.
Cross-model epistemic uncertainty as the diagnostic the model itself cannot run. An MIT research team (March 2026) demonstrated that the only reliable way to identify confidently-wrong LLM responses is by comparing the target model's answer to responses from a group of similar models — cross-model disagreement, not self-reported confidence (MIT News, "A better method for identifying overconfident large language models," March 19, 2026). The single model cannot tell you it is wrong with any reliability. A second model, asked the same question, often can.
The Yan et al. (2026) paper that documents calibration degeneration under RLVR measures something specific: Expected Calibration Error. When the model assigns 100% confidence to a claim, the actual rate at which that claim is correct should also be 100%. On the post-RLVR models tested on math reasoning benchmarks, the gap between stated and actual probability of correctness is large enough to be the headline result.
Read this with Mauboussin's habit: the prior is the base rate, not the model's confidence. A senior accountant who treats "the model wrote it with confidence" as evidence has substituted the model's posterior for her own prior. The control discipline is the inverse — start from the base rate of model error on this task class, then update for the specific evidence in the package.
Translated to the close: the model that drafted the Loma Vista journal entry would have produced the same journal entry on round two, three, and four if uninterrupted. Self-correction without external prompt is not a behavior current architectures reliably exhibit. The literature is now unambiguous on this point.
What operator drift looks like at the close
The marker is not the answer being wrong. The marker is the model executing a control assertion that no one in the department authorized it to make.
The five patterns — severity-tagged
In each pattern, the failure is not that the conclusion is wrong. It often is not wrong. The failure is that the model produced a control output — a journal entry, a disclosure, a system mutation, a settled memo — on the basis of evidence the controller had not yet gathered. The model performed a control without standing in the control environment to perform it. Output without authority is the operator drift signature.
The reliance ladder
The reliance ladder is how the controller distinguishes use cases that can absorb a model error from use cases that cannot. The level is set by the controller, not by the model. The model does not get to nominate its own role.
The Loma Vista session is a case study in skipped levels. The senior asked a Level 3 question. The model returned a Level 4 conclusion and a Level 5 journal entry without ever pausing at Level 3. Three of the five required evidence types — framework citation, "Unknown" list, named reviewer — were absent. The control environment had no way to detect the skip because nothing in the chat interface signaled the role change.
A model staying inside Level 3 (Analyzing) on the Loma Vista question returns: "The standalone-price test in 842-10-25-8(a) requires market-rate evidence for the incremental 1,400 square feet. That evidence is not in the addendum and is not in my context. Without it, I can identify the question and the framework but I cannot conclude whether this is a modification or a separate contract. To get to a conclusion you need: (a) a Loma Vista retail comparable set for back-of-building space, or (b) the lessor's three most recent third-party leases for adjacent space. With either, I can run the test."
That output is operationally useful, evidence-honest, and stays at Level 3. The journal entry never appears. The controller still does the close on schedule, with one more item added to the day's to-do list rather than to the workpaper.
Self-authentication is not a control
A common mitigation proposed in vendor documentation is to ask the model to label its own claims as verified, inferred, or unknown. The labels are useful as a prompt technique. They are not a control. A model that drifted from summarizer to operator in one response is the same model being asked to certify which parts of its output were verified. That is a preparer authenticating its own work.
The MIT March 2026 finding is the empirical underpinning of this point. Self-reported confidence is not a reliable indicator of correctness; cross-model disagreement is. A second model, an independent retrieval, or a human reviewer must do the classification. The originating model cannot.
AI may not generate control evidence about its own reliability. A model output, a confidence score produced by the same model, and a model self-classification of its own claims are the same artifact for control purposes. None of them satisfy the evidence requirement at Levels 4 or 5 of the reliance ladder. The classification must come from a source independent of the model that produced the output. That is the discipline the COSO February 2026 GenAI guidance is asking for when it instructs organizations to treat GenAI outputs as assertions requiring validation, not facts.
Five interrupts, paste-ready
These follow the format of the interrupts in Parts 5, 7, and 8 — specific, narrow, designed to refuse the role escalation before it lands.
1. The role-declaration interrupt
"Before answering, declare the role you are about to perform on the reliance ladder: formatting, summarizing, analyzing, concluding, or operating. If you reach Level 4 or 5, state explicitly what evidence the level requires and what evidence you actually have. If the two do not match, drop back to the highest level where they do."
Forces the role classification before the output rather than after. The model cannot drift past the level it just declared.
2. The standalone-evidence interrupt
"List each factual premise your conclusion depends on. For each, state whether it is in the source material I provided, inferred from that material, or assumed because the standard requires it. Any 'assumed' item is an Unknown until I confirm it."
The Loma Vista standalone-price test would have surfaced on the first response under this prompt. Each factual premise is forced to identify its source location.
3. The authority-language audit
"Scan your draft for the phrases 'requires,' 'must,' 'the correct treatment is,' 'the next step is,' and 'should.' For each, quote the source that authorizes the assertion. If you cannot quote a source, downgrade the language to 'one possible treatment is,' 'depending on,' or 'I would need to verify.'"
Authority language is the surface of the calibration failure documented in Yan et al. (2026). Forcing the model to defend each authority verb against a source location is the inverse of the training gradient that produced it.
4. The cross-model challenge
"Restate your conclusion and the three factual premises it most depends on in one paragraph each. I am going to put that paragraph into a second AI system and a human reviewer. If they reach a different conclusion or identify a different gap, your output is treated as unverified."
The MIT March 2026 finding made cross-model epistemic uncertainty the most reliable diagnostic available. This interrupt operationalizes it. The originating model cannot fake the second opinion.
5. The blast-radius interrupt
"For each operational recommendation in your output — journal entry, system change, disclosure draft, policy interpretation — name what could be affected if the recommendation is wrong: account balance, classification, disclosure, control conclusion, covenant calculation, audit evidence, or external report. Stop after listing. Do not recommend the action."
Forces the model to surface its own downstream exposure before delivering the recommendation. Spoke 5 documented that even cooperating models produce self-focused honesty by default; user-protective honesty requires a separate explicit prompt.
Five external controls
The interrupts operate inside the conversation. The external controls do not depend on the model behaving well.
The reliance label on every material output. Any AI-assisted artifact retained for finance use carries a one-word label set by the human reviewer: format, summary, analysis, conclusion, or operation. The label determines the evidence package the workpaper must contain. The label is the control. The model does not set it.
The two-source rule at Levels 4 and 5. Any conclusion or operating recommendation must be re-derived by either a second AI system, a different retrieval path, or a human technical accountant. Single-source AI conclusions do not enter the workpaper file. This is the operationalization of cross-model epistemic uncertainty as a department-level control.
The source-package retention rule. No AI-assisted output is retained without the prompt, the source material supplied, the model identifier and version, the response, and the reviewer disposition. AS 1215 paragraph .04 requires audit documentation sufficient for an experienced auditor to understand the purpose, source, and conclusions of work performed. A model transcript without the input package satisfies none of those three.
The role-change log. Every AI workflow that operates at Level 3 or above produces a record when the role changes within a session — from analysis to conclusion, from conclusion to operating. The log is the evidence that the role boundary was either respected or breached. Where it is breached and the output is retained, the breach is a control finding.
The kill switch with named authority. The controller, or a designated deputy, has documented authority to suspend AI use in any finance workflow when verification burden exceeds utility, when unsupported authority language recurs, or when the model proposes operational guidance without evidence. The decision is recorded with reason. It is treated as a control judgment, not as resistance to a vendor relationship.
The December 15, 2026 convergence
The regulatory clock the controller is operating against has unusual specificity. Two PCAOB standards take effect the same day. A COSO publication issued earlier the same year is now the citable framework for internal control over GenAI. An AICPA standard already in effect addresses the IT-risk side. And the standard that controllers most expect to govern this — an AI-specific PCAOB rule — does not exist.2
PCAOB AS 1215 — Audit Documentation — effective December 15, 2026. Paragraph .04 requires audit documentation prepared in "sufficient detail to provide a clear understanding of its purpose, source, and the conclusions reached." Paragraph .12 requires documentation of "significant findings or issues, actions taken to address them (including additional evidence obtained), and the basis for the conclusions reached." Where AI is part of a key control over financial reporting, those documentation requirements run through to the AI interaction. The transcript is not the documentation. The source package, the reviewer disposition, the evidence the conclusion was based on — that is the documentation. An eight-round model exchange without a retained source package satisfies neither paragraph.
PCAOB QC 1000 — Risk-Based Quality Control — effective December 15, 2026. Paragraphs .43–.51 (the "Resources" component) require firms to design quality control responses addressing external resources and the evolving use of technology. The standard does not name AI. That is the point. QC 1000 is the framework AI use falls into, by default, as firms implement it. Firms whose 2027 inspections produce findings on AI-related audit work will be inspected against QC 1000, not against an AI-specific standard that does not exist.
PCAOB AS 1105 + AS 2301 amendments — Technology-Assisted Analysis (TAA) — effective for FY beginning on or after December 15, 2025. The TAA amendments explicitly exclude generative AI from their scope (PCAOB Adopting Release, June 12, 2024). This matters because it eliminates a possible defense: a firm cannot argue that GenAI work is "covered by TAA." It is not. The exclusion leaves the GenAI gap to be filled by AS 1215, QC 1000, and the auditor's professional judgment under SAS-equivalent standards for issuers' financial reporting.
COSO — Achieving Effective Internal Control Over Generative AI — released February 23, 2026. The first authoritative GenAI control framework, structured as a six-step roadmap (govern, inventory, assess, design, implement, monitor) mapped to the five components of the 2013 Internal Control—Integrated Framework. Two practical anchors for the controller: (1) treat GenAI outputs as assertions requiring validation, not facts, and (2) maintain an ongoing inventory of GenAI use cases to address shadow-AI risk. The framework is non-authoritative for SEC filers in the strict sense, but it is the framework external auditors and regulators are now operating against.
AICPA SAS 145 — Risk Assessment. Introduces "risks arising from the use of IT" (RAFITs) and requires identification of general IT controls (GITCs) over those risks. Whether the LLM is hosted, embedded in an ERP module, or accessed through a public chat interface, the entity's use of the model creates RAFITs that SAS 145 requires the auditor to identify, and that the entity should already be identifying for itself.
SEC enforcement context. The SEC's 2026 Examination Priorities state the Division of Examinations "remains focused on registrants' use of certain products and services, such as automated investment tools, AI technologies, and trading algorithms" and will "review for accuracy registrant representations regarding their AI capabilities." The 2024 settled charges against Delphia and Global Predictions ($400,000 combined civil penalties) and the pending action against Nate, Inc.'s founder (over $42 million allegedly raised through fraudulent AI claims) establish the precedent: misrepresenting AI capability is actionable under existing Rule 10b-5 and Section 17(a) anti-fraud authority. The controller's exposure is not waiting for a new rule. It is in force now.
Closing
The senior accountant who pasted the Loma Vista addendum into the model did everything she was supposed to do. She defined the question narrowly. She supplied the source. She challenged the answer. The model corrected on the second prompt. The journal entry was not booked.
None of that is a control. It is a person being attentive. The reason this article exists is that attention is not the control the December 15, 2026 standards require. The control is the role label that should have been declared on round one, the standalone-price evidence that should have been flagged as Unknown before the journal entry was drafted, and the cross-model challenge that would have detected the overconfidence without depending on the senior catching it in real time.
I have spent thirty years building finance functions on the premise that the strongest controls are the ones that hold when the preparer is tired, the reviewer is busy, and the close is on day eight. AI does not change that premise. It tests it. The model that drifted from summarizer to operator in six minutes will drift the same way on the next addendum, the next contract amendment, the next impairment indicator. The question is whether the role boundary is enforced by the control environment or by the alertness of whoever happens to be at the keyboard.
For the close-to-report cycle inspected against AS 1215 and QC 1000 on December 15, 2026, only one of those two answers is defensible.
2 The exclusion of generative AI from PCAOB AS 1105 + AS 2301 (Technology-Assisted Analysis) is explicit in the June 12, 2024 Adopting Release and is the structurally important point. Auditors and firms that hoped to fold GenAI under TAA cannot — the standard says it does not cover GenAI. What the exclusion leaves is the AS 1215 + QC 1000 + SAS 145 + COSO GenAI stack, plus auditor professional judgment, plus the SEC's existing anti-fraud authority under Rule 10b-5 and Section 17(a). There is no missing standard for the controller to wait for. The framework is already in force; it is just distributed across five sources rather than concentrated in one.