Somewhere in a federal register, a single word is doing more to decide the fate of American wildlife than any budget line, court ruling, or enforcement sweep. For 50 years, "harm" under the Endangered Species Act meant more than shooting or trapping an animal: it included destroying the habitat the animal needs to survive. The Trump administration is now narrowing that definition, and as Yale Environment 360 reports, hundreds of species could lose federal protection without a single statute being repealed.
Read that again, because it is one of the sharpest governance lessons of the year, and it has nothing to do with wildlife. The law didn't change. The penalties didn't change. The enforcement agency didn't change. A definition changed, and with it, the entire population of things the law protects.
If you run policy, compliance, or risk for a living, this should stop you cold. You spend most of your energy on controls, thresholds, and workflows. But the highest-leverage lever in any governance system isn't the control. It's the definition that decides what the control applies to.
The word is the control
Every control has a scope, and that scope is set by language. "Material." "Harm." "Suspicious." "Resilient." "In-scope." Change the word and you change everything downstream, silently, because no threshold trips and no exception gets logged.
The Endangered Species Act is the cleanest example this week, but it isn't the only one. Bloomberg reported that Fitch is upgrading 30 portions of collateralized loan obligations, on top of hundreds of tranches already flagged for upgrades, under a new methodology. Sit with that phrase. The underlying loans didn't suddenly perform better. Borrowers didn't get more creditworthy overnight. The definition of what qualifies for a given rating changed, and hundreds of instruments were reclassified as a result.
Anyone who lived through 2008 should feel a familiar chill. A rating is a definition wearing a letter grade. When you rewrite the methodology behind it, you move risk across the financial system without touching a single loan.
Consider what actually shifted in both cases:
- What didn't change: the species and their habitats, the loans and their borrowers, the observable facts on the ground.
- What did change: the words that decide which facts count, and therefore who is protected, what qualifies, and where risk now sits.
That gap between the facts and the words is where governance lives. And it is almost always ungoverned.
Expansion is as powerful as contraction
Narrowing a definition strips things out of scope. Expanding one pulls things in, and it is every bit as consequential.
Executive Order 14415, signed in July 2026, does exactly this for aerospace and defense contractors. As Protiviti notes, the order reframes supply chain resilience as "an auditable business capability." That phrase is doing enormous work. Resilience has lived for years in strategy decks and board presentations, a virtue everyone endorsed and no one could measure. The moment it becomes auditable, it acquires a definition, evidence requirements, testing procedures, and the possibility of a finding. A concept becomes a control.
This is the move governance professionals should learn to spot in both directions:
- Redefine "harm" more narrowly, and protections evaporate with no repeal.
- Redefine "resilience" as "auditable," and an entire discipline of controls springs into existence with no new statute.
In both cases, the leverage sits in the definition, not the machinery bolted onto it.
Why definitions slip past everyone
Here is the uncomfortable part. Organizations have change management for code, for financial controls, for vendor onboarding, and almost none for the words in their own policies.
Definition changes don't behave like other risk events. They don't breach a limit. They don't generate an alert. They live in glossaries, appendices, and methodology footnotes that no one reviews with the seriousness they deserve. Yet they quietly reset the denominator for every metric, every control, and every report that references them.
Enforcement runs on the same fuel. Compliance Week reported that UBS Financial Services was hit with a record $125 million joint civil penalty from four regulators for "willful" violations of the Bank Secrecy Act, including failing to maintain an anti-money laundering program and failing to file suspicious activity reports. Notice the word that made it a record: willful. The conduct is one set of facts. Whether regulators characterize it as willful or merely negligent is a definitional judgment, and that judgment is what set the penalty tier. The same actions, characterized differently, produce a fraction of the fine.
You can see the mirror image in trade policy, where the BBC reported that refunds from the "Liberation Day" tariffs have reached $100 billion, roughly 60% of all revenue collected under the program. That is not a story about businesses behaving differently. It is a story about a contested classification reversing en masse, dragging enormous sums with it. When the definition of what qualifies flips, the money follows automatically.
Govern the words, not just the workflow
If a competitor, a regulator, or a plaintiff can move your risk exposure by editing a word, then your definitions are a control, and probably your least protected one. Treat them accordingly.
- Version your definitions like source code. Every material term ("material," "reportable," "high-risk," "resilient") should have an owner, a change history, an approval trail, and an effective date. If you can't say who changed a definition and why, you have an ungoverned control.
- Map definitions to the controls they scope. Before a word changes, you should be able to answer: which policies, metrics, and controls does this term feed? A definition impact analysis is the semantic equivalent of a code dependency check.
- Treat external redefinitions as risk events. When a regulator narrows "harm," a rating agency rewrites a methodology, or a court reclassifies a tariff, your scope just moved whether you noticed or not. Monitor definition changes the way you monitor rule changes.
- Make characterization an explicit decision. Willful versus negligent, in-scope versus out-of-scope, material versus immaterial, these judgments deserve documented rationale, not a quiet call buried in a memo.
The definition layer is about to become executable
This is not an academic concern that can wait. Policies are becoming machine-readable, and AI systems are increasingly the ones reading and enforcing them. A model doesn't infer the spirit of a rule; it reads "harm" or "material" or "suspicious" exactly as written and acts on it at scale. That means a stale or unversioned definition is no longer a documentation problem. It is a live control gap that an automated system will execute faithfully, thousands of times a day, without ever questioning the word.
The organizations that come out ahead will be the ones that stopped treating their glossary as boilerplate and started treating it as critical infrastructure. Because the most powerful move in governance was never tightening a control. It was changing the word that decided what the control was for, and this week, three very different institutions just showed us how much moves when someone does.
Sources
- For America’s Rarest Wildlife, Survival May Hinge on a Single Word, Yale Environment 360
- Executive Order 14415 Signals a New Supply Chain Readiness Mandate for Aerospace and Defense, The Protiviti View
- Fitch Adds to Hundreds of CLOs Slated for Rating Upgrades, Bloomberg Markets
- UBS hit with record $125M civil penalty for ‘willful’ BSA violations, Compliance Week
- Trump's 'Liberation Day' tariff refunds hit $100bn, BBC Business