Blog
Notes on the line between probabilistic components and deterministic controls.
-
The frameworks aren't the runtime
An agent can pass the demo and still fail the deployment. What closes that gap is a runtime that governs what the agent may do, a layer below the framework you compose it with.
-
Your agent doesn't need permissions. It needs not to exist outside them.
Almost all of the agent-security conversation restricts what an agent can do. The inversion: the action does not exist outside what the contract declares.
-
Changing what your agent may do shouldn't be a deploy
A new rule needs new data and new logic. What the change should show you before it applies, who should agree to it, and a real run of it, with what it does not cover.
-
Your customer's agent is untrusted by definition
When customers bring their own agent, the vendor stops controlling the model. What it can still control is what the model is allowed to do, and the evidence of what it did.
-
Your model's safety is not your governance
Frontier labs hold back their most capable models for safety reasons, calibrated to their own risks. If you run AI agents in a regulated business, that does not stand in for yours.
-
A gate is three claims too
A deterministic gate in front of an AI agent is the right instinct. But "gated" carries three guarantees: whether it can be skipped, what its receipt proves, and what it checked.
-
Separation of duties is a deployment, not a policy
When one API and one credential both run the agent and rewrite what it may do, two trust boundaries collapse. Separation of duties is two planes, not a policy on top.
-
Durable execution keeps the state. It doesn't keep the rules.
Durable execution keeps an agent's state across hours and failures. When the pause is a consequential action waiting on a human, resuming it is an authorization problem.
-
A signed receipt is three claims, not one
Signing an agent's actions is becoming table stakes. But "signed" is asked to carry three guarantees, integrity, trustlessness and veracity, and they are not one claim.
-
Persuasion versus governance
What happens if the user is more persuasive than your prompt? Why an agent defended only by its prompt is a negotiation, not a system.
-
Audit you don't have to trust
A complete audit log is not evidence if whoever produced it can rewrite it. Under a regulator, integrity has to be checkable by someone who doesn't trust the vendor.
-
The agent proposes; the runtime presses the button
Most agent governance contains a free-acting agent. The stronger move is never to let it act: the agent proposes, and the runtime presses the button.
-
The refusal is a control output, not a conversation
Venkat Peri is right that intent classification isn't a quality gate. In a regulated domain, a scope layer biased toward pass isn't one either: the refusal is a control output.
-
A typed output is not a governed action
Models that answer with a calibrated choice make deciding cheap. The schema guarantees the shape of the answer; who authorized acting on it is a separate question.
-
You can't fight probabilism with probabilism
Everyone agrees regulated agents need deterministic controls. The failures come from controls that are secretly probabilistic, and from not knowing where the line goes.