The working research behind Enterprise Agent Architecture — governance, security, and architecture for a workforce of humans and agents, written as it is built.
New to this work? Begin with the Enterprise Agent Architecture framework — the practice for governing an enterprise’s human-and-agent workforce — and the position-paper series: Part 1, Part 2, Part 3, Part 4.
Seven reads, in order
A valid token does not settle the decision.
Authority is conditional, not merely possessed.
GitLost: valid permissions, illegitimate outcome.
Even explicit approval needs binding to execution.
The opening piece of an August arc on governing the layer that governs your agents — the rest publish as each one clears editorial review.
A staged model for assessing where your organization stands on governing its agent workforce.
How NIST, OWASP, ISO, and emerging agent standards fit together — and where the gaps are.
The oversight questions that separate governed agent programs from ungoverned ones.
Extending TOGAF and enterprise architecture practice to include a governed workforce of agents.
Agent identity standards settle who an agent is and what it was granted. None of them check that against the call that actually arrives — a per-refund limit can still let a sequence total ten times the budget.
Read field note →Binance's preliminary account and Bitquery's on-chain analysis raise one narrow question: what should a signing system check before it signs? Three proposed controls, attributed sources, and the limits.
Read field note →An approval cached by tool name authorizes a tool, not an action; how to test that human approvals bind the arguments that execute.
Read field note →Meta documents a serious design for Muse: a separate permission authority, credential substitution, task-scoped approvals. The enterprise question sits above it — was this employee authorized to delegate this action, and can you limit, revoke, and reconstruct it?
Read field note →PACT, CognOS LUMEN, and Microsoft’s Agent Host Protocol each carry a record of an agent’s approval. A preprint asks one narrow question of all three and finds they establish different, non-overlapping subsets of the answer.
Read field note →Noma Labs’ GitLost technique against GitHub Agentic Workflows: an agent read private repos and posted the contents to a public comment. No credential was exposed, no boundary crossed. The data still got out.
Read field note →An agent’s effective authority is shaped by both its information scope and its permitted actions. Retained evidence from a 97%-token-reduction experiment, and the one finding that failed its own preregistered bar.
Read field note →Agent identity standards settle who an agent is and what it was granted. None of them check that against the call that actually arrives — a per-refund limit can still let a sequence total ten times the budget.
Read field note →A security gate that has only ever passed has not shown it can block; three checks make the line that decides a release falsifiable.
Read field note →An AI research assistant described its sources as independently verified. They weren’t. What resolved it was checking whether a retrieval had happened at all, not asking the assistant to re-check its own claim — and the verification and evaluation controls the gap points toward.
Read field note →Buzz signs every agent action into one append-only Nostr log and has passed 31,500 GitHub stars. The log shows, precisely and verifiably, who walked the dataset out the door one signed file at a time. Nothing asked whether the sequence should have happened — the same boundary MCP’s spec named eight days later.
Read field note →MCP’s 2026-07-28 specification retires protocol-level sessions and names the replacement: mint a handle from a tool and pass it back. That makes a sequence of tool calls legible. It does not make it governed — and the spec is honest that supplying the evaluator is now your job.
Read analysis →A five-plane reference architecture on arXiv framed agent risk as “sequences of individually-permitted actions” thirty-six days before my own preprint. The credit, and the narrower claim that survives it: what Definition 1 of that paper specifies, and what it leaves unspecified.
Read analysis →RufRoot (CVE-2026-59726, CVSS 10) exposed 233 internal tools with no authentication. Shell access is loud and ends when you evict the container. Poisoning the agent’s learning store is quiet, survives remediation, and looks like the agent developing an opinion — and it is a real argument against stateful governance, including ours.
Read analysis →Three consecutive releases of our own harness were correctness disclosures, not features. An absent answer read as safe; a refusal read as a failure; a compliance read as a refusal. One module that exists to catch wrongly-blocked requests passed 25 of 25 against an agent that refused everything.
Read disclosure →A reasoning model’s hidden thinking tokens are billed against the same max_tokens ceiling as its answer. We measured 928 of them on a trivial prompt — 86% of the budget — truncating the JSON, failing the parse, and zeroing a pipeline stage that logged success every morning for two weeks. Includes the diagnosis we got wrong first.
The UK AI Security Institute’s own evaluation agents took 19 unsanctioned actions against real people and organisations. Internet access was deliberately granted, so authorization did not fail. Nothing was watching what the authorized actions added up to, while they added up.
Read incident analysis →Agent risk composes across sessions, so authorization — a property of the action — can never fully answer for it. The role still largely unclaimed in shipped systems is evaluation authority: who holds the pen on whether a composed run is still sound, at execution time, and can that evaluator itself be trusted? First in an August series on governing the layer that governs your agents.
Read field note →My autonomous system paused its own expansionary work after four HIGH-severity security events, none of them a real threat. Not a clean win — here is what the production data showed.
Read field note →curl just shipped experimental support for RFC 9421 HTTP Message Signatures. A valid signature proves who sent a request and that it wasn’t altered in transit. It doesn’t prove the request — or the sequence it belongs to — was ever authorized. The same blind spot as agent decision governance, one layer down the stack.
Read field note →Anthropic’s agent cookbook ships a dozen autonomous agents — SRE responders, threat-intel hunters, multi-agent orchestration. Each is governed per-action or by a human approving one step. None governs what an agent’s authority accumulates to across a session. That missing layer — cross-session risk composition — is the point.
Read field note →The Hugging Face intrusion comprised ~17,600 recovered attacker actions — ordinary-looking operations interleaved with outright exploitation — run, by Hugging Face’s own account, by an autonomous agent framework. A per-action policy gate is memoryless; the harm lived in the sequence. A field note reading the breach through cross-session risk composition, with live observe-only production telemetry.
Read field note →A memoryless gate scores each action and forgets it — so an agent can pass every gate and still be dangerous over a sequence. Cross-session composition accumulates on the trajectory. A field note with initial, self-attested production telemetry: observe-only, honestly labeled, and clear about what one reading does and doesn’t prove.
Read field note →CSA identifies a gap in enforceable, agent-specific standards. Identity, authorization, and auditability address part of it — a vendor-neutral decision layer must also evaluate whether an authorized action stays sound in context, and whether individually compliant actions compose into unacceptable cumulative risk. With measured evidence and a shipped composition module (constitutional-agent v0.6.0).
A per-session spend cap can hold on every call while the authorized exposure composes across five sessions past the aggregate budget. The gap isn’t stateless-vs-stateful policy — it’s isolated decision evaluation vs composition-aware enforcement. With a runnable synthetic reference and a published paper (DOI).
Read the finding →Six months running an autonomous enterprise; 451,163 logged security events. The external attackers were beaten on autopilot. The real control problem, 25,000 times over, was an agent I had already authenticated and authorized — that’s runtime governance, the missing layer.
Read field note →An AI coding agent deleted a production database despite a destructive-actions rule in its own instructions, then quoted that rule afterwards. A rule in a prompt is advisory; only a pre-execution gate the code enforces actually blocks the action. A quickstart for constitutional-agent, in working Python.
The Omnibus deferred the high-risk deadlines to 2027–2028 — and then Article 101 landed on 2 August 2026 anyway, unmoved, carrying fines up to 3% of worldwide turnover. Three of its four grounds are evidence-production failures, not model failures. The paperwork slipped; the duty to produce evidence did not.
Private data, untrusted content, and the ability to communicate out. When an agent has all three, prompt injection becomes exfiltration — and nearly every useful agent acquires all three by default. Break the chain at the gate.
The moment you give an agent a tool registry, every piece of text it reads becomes a candidate command. Your attack surface is not the prompt or the model — it is the list of tools you handed the model the authority to call. Shrink it, scope it, gate it.
When a Model Context Protocol server runs shell commands from model output, the answer that command execution is expected behavior is true — and exactly why it is dangerous. Expected capability plus a steerable model is an exploit. The control belongs in a gate.
A company that cannot stop itself is not governed — it is just running. The FREEZE→STOP machinery, the self-locking loop it can create, and the investigation-mode carve-out that fixes it. Two failures from our own system, told honestly.
MetaComp StableX launched the first AI agent governance framework for regulated finance. Know Your Agent (KYA) answers WHO and HOW. This is the layer underneath it — and why it matters in 2026.
One Anthropic Mythos search run that found a zero-day cost under $50; the full search cost under $20,000. Your agents may have similar governance gaps. The CGST runs the same six-layer check on your system — scored output, remediation roadmap — before a bad actor or regulator does it first.
When an economic gate FAILs and freezes the agents that would have fixed the failing metric, you get a self-locking loop. 34 days of it. Today we made gate suppression unconstitutional—Section 8.9, binding law.
Before selling the Constitutional AI Governance Stress Test, we ran it on our own library. constitutional-agent v0.4.0b3 scored 63/100. Ungoverned baseline: 6/100. An honest account of the 57-point delta — what it means, layer by layer.
Anthropic’s Mythos finds zero-day vulnerabilities autonomously and cheaply (one successful run cost under $50; the full search under $20,000). Glasswing governs who gets access. Nobody governs what autonomous agents do with those capabilities once inside. That gap is the constitutional WHY layer—and it remains open.
An AI agent ran 200+ cycles and earned $6.74 on day 41. Four governance failures burned most of those cycles. constitutional-agent is the open-source Python library—six gates, 12 hard constraints, a formal amendment process—that would have caught each one.
Anthropic’s Project Glasswing ($104M, 11 launch partners) is a serious initiative. It governs who gets AI cyber capabilities. It does not govern what agents do with them once deployed inside member organizations. That gap has a name—and it remains open.
What Level 4 AI autonomy actually means operationally: agents that execute within constitutional constraints, surfacing only genuine escalations. The three governance mistakes that stall adoption, and why the governance layer is the enduring investment.
Compliance-based AI governance expires when regulations change. Principle-based governance survives regulatory churn because it governs behavior, not checkboxes. Why the EU AI Act, NIST AI RMF, and ISO 42001 are floors—not architecture.
Amendment 67 fixed a bug in a gate. These three fix something subtler—how the system makes pivot calls, how audits must convert to tracked tickets, and how audits avoid false positives from agents that log to specialized tables. Meta-governance, operated in public.
Our consumer assessment had 923 users and zero conversions. Our open-source governance library does 96 installs a month with no marketing. A founder field note on the moment a company learns who its real user is.
Autonomous agents do not execute your strategy. They generate it—through thousands of micro-decisions that compound into direction. The tools built for deliberate planning cannot govern a system that produces strategy continuously at operational speed.
Identity tells you who an agent is. The six-gate architecture governs what that agent is allowed to do—and stops it when the answer changes. A practitioner account of building behavioral authorization into production AI systems.
The entire AI governance debate is framed around the wrong question. The shift from control-as-permission to control-as-behavior is the core architectural insight that most organizations miss.
Single-shot AI execution is brittle by design. The RALPH loop — Signs, Verify, Gutter, Circuit, Backoff, DLQ — is how autonomous systems detect their own failures and recover without human intervention.
AI agents can propose amendments to their own constitution — but never ratify them unilaterally. The KLA (Karpathy Learning Architecture) is constitutional self-governance: improvement through structured amendment, not free modification.
EdTech institutions have SSO, MFA, and enterprise identity. They still aren’t deploying AI at scale. The missing layer isn’t authentication — it’s behavioral authorization. Which decisions is the AI actually allowed to make?
How our 342 published tests were mapped to the OWASP Agentic Top 10 — with a correction: our original category labels did not match OWASP’s published list.
Gartner predicts over 40% of agentic AI projects will be canceled by the end of 2027. BCG found 33% more decision fatigue among workers who reported “AI brain fry” than among those who did not. Both trace back to the same missing layer: nobody is measuring whether AI strategy is working.
Kaplan and Norton added leading indicators to lagging financial metrics in 1992. AI organizations have the same problem. Four quadrants, 12 numbers, one metric the original scorecard never needed: Autonomy.
Policies describe how agents should behave. Hard constraints determine what they can do. Most AI governance frameworks confuse the two — and pay for it when something goes wrong at the execution layer, not the documentation layer.
MuleSoft's core insight was that governing connections matters more than making them. In 2026, the same architecture applies to AI agents — one abstraction layer up.
What 75 documented lessons actually reveal about building production AI systems under constitutional constraints.
MCP solves tool connectivity. It does not solve authorization, audit, or behavioral constraints. The governance problem in multi-agent systems is not a protocol problem.
When our gate system detected EPG FAIL, every agent stopped spending. 34 days of zero growth spend while we diagnosed the root cause.
Microsoft’s Agent Governance Toolkit (AGT) governs the HOW layer — behavioral policies, trust scoring, execution sandboxing. CTE governs the WHY layer — the constitutional principles that determine whether an action is right, not just permitted. These are not competing tools. They are orthogonal layers.
A full retrospective on 90 days of building an AI-governed company from scratch — what worked, what failed, and what we would do differently.
Anthropic shipped Computer Use — Claude controls your apps, browser, spreadsheets. Four incidents in one week (OpenClaw, Langflow, Trivy, Computer Use) expose the escalating governance gap.
We open-sourced a security testing framework: 209 tests, 4 wire protocols, OWASP ASI Top 10 coverage, NIST AI 800-2 alignment, and 20+ enterprise adapters.
The US has a three-layer AI governance stack with a missing implementation layer. Policy exists. Frameworks exist. Production governance does not.
ClawTeam is brilliant multi-agent engineering: 8 AI agents, git worktree isolation, 2,430 autonomous experiments. But it has zero governance. What happens when swarm intelligence meets real-world consequences?
Four new AI governance startups launched in one week. They all govern who agents are. Nobody governs how agents decide. That's the gap.
Anthropic's GTG-1002 report reveals the first AI-orchestrated cyber espionage campaign. The attack worked because the agents had no governance layer.
We submitted comments to two NIST initiatives based on operating 56 autonomous AI agents. Four evaluation failures. Zero would have been caught by a benchmark. Part 5 of the AI Governance series.
Jensen Huang called OpenClaw "the operating system for personal AI." The analogy maps precisely — and the gap it reveals is governance. Part 4 of the AI Governance series.
Andrej Karpathy's 630-line framework uses fixed evaluation, bounded autonomy, and automatic rollback. The same architecture as constitutional self-governance.
Why dashboard governance breaks at scale and what constitutional self-governance looks like. Part 1 of 4.
AI tools can intensify work rather than reduce it (UC Berkeley field study, HBR 2026). Adding governance decisions to fatigued decision-makers backfires. Part 2 of 3.
What we learned running 56 agents under a constitutional framework for 65 days. Honest failures included. Part 3 of 3.
Gartner sized the AI governance market at $492 million. But most solutions govern what agents can do, not what they should do. That's the gap.
Our autonomous system reported 90% agent activation. The real number was 2.6%. Here's what happened when we made it tell the truth.
When a rate limiter throws an exception, should the action proceed or halt? The answer reveals everything about your AI governance.
A detailed operational case study from running 88 AI agents under constitutional governance for 58 days. Real incidents, real failures, real data.
AI agents now ship code, find vulnerabilities, and propose capital raises without human oversight. Here's what we learned building the oversight first.
The reference model for governing a workforce of humans and agents — the framework, the position-paper series, and the open-core runtime.
The most AI-fit companies capture up to 7.2x the AI-driven revenue and efficiency gains of other companies (PwC 2026 AI Performance Study).
Explore the frameworkOne email when a new position-paper part or field note publishes. No newsletter, no marketing list.