Research & Field Notes

The working research behind Enterprise Agent Architecture — governance, security, and architecture for a workforce of humans and agents, written as it is built.

Start Here

New to this work? Begin with the Enterprise Agent Architecture framework — the practice for governing an enterprise’s human-and-agent workforce — and the position-paper series: Part 1, Part 2, Part 3, Part 4.

August Series — “Can You Trust the Evaluator?” New

Authorization Was the Easy Part: Who Is Allowed to Evaluate the Sequence

The opening piece of an August arc on governing the layer that governs your agents — the rest publish as each one clears editorial review.

July Practitioner Series

The Agent Governance Maturity Model

A staged model for assessing where your organization stands on governing its agent workforce.

The Agent Governance Standards Landscape

How NIST, OWASP, ISO, and emerging agent standards fit together — and where the gaps are.

Seven Questions Your Board Should Ask About Its Agent Workforce

The oversight questions that separate governed agent programs from ungoverned ones.

Enterprise Architecture’s Missing Viewpoint: The Agent Workforce

Extending TOGAF and enterprise architecture practice to include a governed workforce of agents.

Featured Field Notes

Security Research

  1. The Gate That Would Have Stopped the Cursor Incident
  2. Most Useful Agents Carry the Lethal Trifecta
  3. When Prompts Become Shells: The Tool Registry Is the Attack Surface
  4. “Expected Behavior” Is Not the Same as Safe: MCP Command Execution
  5. Mapping Our Test Suite to the OWASP Agentic Top 10

Agent Governance

  1. The EU AI Act Was Written for Models. Your Agents Need Runtime Compliance
  2. We FREEZE-d Our AI System for 34 Days
  3. Hard Constraints, Not Policies
  4. The Strategy Gap Nobody Is Talking About

Enterprise Architecture

  1. The 12 Numbers: A Balanced Scorecard for AI Organizations
  2. Why AI Adoption Stalls: It’s About Authority, Not Identity
Categories: Agent Governance Security Research Enterprise Architecture
Browse:
Featured Field Note

The Morning the System Throttled Itself

This morning my autonomous system limited itself — paused its own expansionary work after four HIGH-severity security events, none of them a real threat. That’s not a clean win; it’s the fail-safe tradeoff. A gate that only fires on confirmed breaches is one you’ve taught to hesitate — and automatic release is the design choice that makes the occasional false throttle a price worth paying instead of a reason to switch it off.

Agent Governance 6 min read July 2026 · production data
Read field note →
Agent Governance

Authorization Was the Easy Part: Who Is Allowed to Evaluate the Sequence

Agent risk composes across sessions, so authorization — a property of the action — can never fully answer for it. The unclaimed role is evaluation authority: who holds the pen on whether a composed run is still sound, at execution time, and can that evaluator itself be trusted? First in an August series on governing the layer that governs your agents.

Agent Governance 5 min read August 4, 2026
Read field note →
Agent Governance

Signed, Not Sanctioned

curl just shipped experimental support for RFC 9421 HTTP Message Signatures. A valid signature proves who sent a request and that it wasn’t altered in transit. It doesn’t prove the request — or the sequence it belongs to — was ever authorized. The same blind spot as agent decision governance, one layer down the stack.

Agent Governance 6 min read July 27, 2026
Read field note →
Agent Governance

The Layer the Cookbook Doesn’t Govern

Anthropic’s agent cookbook ships a dozen autonomous agents — SRE responders, threat-intel hunters, multi-agent orchestration. Each is governed per-action or by a human approving one step. None governs what an agent’s authority accumulates to across a session. That missing layer — cross-session risk composition — is the point.

Agent Governance 6 min read July 25, 2026
Read field note →
Agent Governance

Authorized, Composed, Breached

The Hugging Face intrusion was ~17,000 individually-authorized-looking actions that composed into a breach — run, by Hugging Face’s own account, by an autonomous agent framework. A per-action policy gate is memoryless; the harm lived in the sequence. A field note reading the breach through cross-session risk composition, with live observe-only production telemetry.

Agent Governance 7 min read July 25, 2026
Read field note →
Agent Governance

The Governance Engine That Remembers

A memoryless gate scores each action and forgets it — so an agent can pass every gate and still be dangerous over a sequence. Cross-session composition accumulates on the trajectory. A field note with initial, self-attested production telemetry: observe-only, honestly labeled, and clear about what one reading does and doesn’t prove.

Agent Governance 7 min read July 18, 2026
Read field note →
Agent Governance

The Missing Layer in Agent Governance: Decision Soundness at Execution Time

CSA identifies a gap in enforceable, agent-specific standards. Identity, authorization, and auditability address part of it — a vendor-neutral decision layer must also evaluate whether an authorized action stays sound in context, and whether individually compliant actions compose into unacceptable cumulative risk. With measured evidence and a shipped composition module (constitutional-agent v0.6.0).

Agent Governance 7 min read July 17, 2026
Read the response →
Agent Governance

The Spend Cap Held. The Risk Budget Didn’t Compose.

A per-session spend cap can hold on every call while the authorized exposure composes across five sessions past the aggregate budget. The gap isn’t stateless-vs-stateful policy — it’s isolated decision evaluation vs composition-aware enforcement. With a runnable synthetic reference and a published paper (DOI).

Agent Governance 8 min read July 16, 2026
Read the finding →
Agent Governance

Agent Identity Is the Wrong Fight

Six months running an autonomous enterprise; 451,163 logged security events. The external attackers were beaten on autopilot. The real control problem, 25,000 times over, was an agent I had already authenticated and authorized — that’s runtime governance, the missing layer.

Agent Governance 7 min read July 2026
Read field note →
Security Research

The Gate That Would Have Stopped the Cursor Incident — in 10 Lines

An AI coding agent deleted a production database while quoting its own destructive-actions rule. A rule in a prompt is advisory; only a pre-execution gate the code enforces actually blocks the action. A quickstart for constitutional-agent, in working Python.

Security Research 8 min read June 25, 2026
Agent Governance

The EU AI Act Was Written for Models. Your Agents Need Runtime Compliance

The Digital Omnibus simplified the AI Act and pushed the high-risk deadlines to 2027–2028 — but every obligation still lands on the model and the provider at placing-on-market. Nothing governs the decision your deployed agent makes at 3 a.m. That gap is runtime compliance.

Agent Governance 8 min read July 3, 2026
Security Research

When Prompts Become Shells: The Tool Registry Is the Attack Surface

The moment you give an agent a tool registry, every piece of text it reads becomes a candidate command. Your attack surface is not the prompt or the model — it is the list of tools you handed the model the authority to call. Shrink it, scope it, gate it.

Security Research 7 min read July 3, 2026
Security Research

“Expected Behavior” Is Not the Same as Safe: MCP Command Execution

When a Model Context Protocol server runs shell commands from model output, the answer that command execution is expected behavior is true — and exactly why it is dangerous. Expected capability plus a steerable model is an exploit. The control belongs in a gate.

Security Research 7 min read July 3, 2026
Agent Governance

The STOP State: When an Autonomous Company Should Stop Itself

A company that cannot stop itself is not governed — it is just running. The FREEZE→STOP machinery, the self-locking loop it can create, and the investigation-mode carve-out that fixes it. Two failures from our own system, told honestly.

Agent Governance 6 min read July 3, 2026
Security Research

Run a Governance Stress Test on Your AI Agents Before Someone Else Does

Anthropic’s Mythos found zero-days for $50. Your agents may have similar governance gaps. The CGST runs the same six-layer check on your system — scored output, remediation roadmap — before a bad actor or regulator does it first.

Security Research 8 min read April 18, 2026
Agent Governance

Amendment 67: The Design Flaw That Locked Our AI System for 34 Days

When an economic gate FAILs and freezes the agents that would have fixed the failing metric, you get a self-locking loop. 34 days of it. Today we made gate suppression unconstitutional—Section 8.9, binding law.

Agent Governance 10 min read April 18, 2026
Security Research

We Ran Our Own Governance Framework on Ourselves. Here’s What We Scored.

Before selling the Constitutional AI Governance Stress Test, we ran it on our own library. constitutional-agent v0.4.0b3 scored 63/100. Ungoverned baseline: 6/100. An honest account of the 57-point delta — what it means, layer by layer.

Security Research 8 min read April 11, 2026
Agent Governance

Introducing constitutional-agent: The Open-Source WHY Layer for AI Governance

An AI agent ran 200+ cycles and earned $6.74 on day 41. Four governance failures burned most of those cycles. constitutional-agent is the open-source Python library—six gates, 12 hard constraints, a formal amendment process—that would have caught each one.

Agent Governance 9 min read April 9, 2026
Security Research

Glasswing Governs Access. Constitutional Governance Governs Action.

Anthropic’s Project Glasswing ($104M, 12 Big Tech partners) is a serious initiative. It governs who gets AI cyber capabilities. It does not govern what agents do with them once deployed inside member organizations. That gap has a name—and it remains open.

Security Research 7 min read April 8, 2026
Agent Governance

The Autonomous Organization — Level 4 in Practice

What Level 4 AI autonomy actually means operationally: agents that execute within constitutional constraints, surfacing only genuine escalations. The three governance mistakes that stall adoption, and why the governance layer is the enduring investment.

Agent Governance 14 min read April 5, 2026
Agent Governance

The Governance Layer That Outlasts Any Regulation

Compliance-based AI governance expires when regulations change. Principle-based governance survives regulatory churn because it governs behavior, not checkboxes. Why the EU AI Act, NIST AI RMF, and ISO 42001 are floors—not architecture.

Agent Governance 11 min read April 5, 2026
Agent Governance

Amendments 68, 69, 70: Governing the Governance Process

Amendment 67 fixed a bug in a gate. These three fix something subtler—how the system makes pivot calls, how audits must convert to tracked tickets, and how audits avoid false positives from agents that log to specialized tables. Meta-governance, operated in public.

Agent Governance 9 min read June 11, 2026
Enterprise Architecture

Emergent Strategy and the AI Organization

Autonomous agents do not execute your strategy. They generate it—through thousands of micro-decisions that compound into direction. The tools built for deliberate planning cannot govern a system that produces strategy continuously at operational speed.

Enterprise Architecture 10 min read May 28, 2026
Agent Governance

The Six-Gate Architecture: Behavioral Authorization for AI Agents

Identity tells you who an agent is. The six-gate architecture governs what that agent is allowed to do—and stops it when the answer changes. A practitioner account of building behavioral authorization into production AI systems.

Agent Governance 10 min read May 21, 2026
Agent Governance

AI Governance: Who Controls What vs. How It Behaves

The entire AI governance debate is framed around the wrong question. The shift from control-as-permission to control-as-behavior is the core architectural insight that most organizations miss.

Agent Governance 9 min read April 18, 2026
Agent Governance

The RALPH Loop: How Autonomous Agents Survive Their Own Failures

Single-shot AI execution is brittle by design. The RALPH loop — Signs, Verify, Gutter, Circuit, Backoff, DLQ — is how autonomous systems detect their own failures and recover without human intervention.

Agent Governance 8 min read April 19, 2026
Agent Governance

Constitutional AI Self-Governance: When Agents Write Their Own Rules

AI agents can propose amendments to their own constitution — but never ratify them unilaterally. The KLA (Karpathy Learning Architecture) is constitutional self-governance: improvement through structured amendment, not free modification.

Agent Governance 9 min read April 19, 2026
Strategy & Governance

The Strategy Gap Nobody Is Talking About

Gartner predicts 40% of agentic AI projects will be canceled by 2027. BCG found decision fatigue up 33% among AI users. Both trace back to the same missing layer: nobody is measuring whether AI strategy is working.

Strategy & Governance 14 min read April 30, 2026
Strategy & Governance

The 12 Numbers: A Balanced Scorecard for AI Organizations

Kaplan and Norton added leading indicators to lagging financial metrics in 1992. AI organizations have the same problem. Four quadrants, 12 numbers, one metric the original scorecard never needed: Autonomy.

Strategy & Governance 12 min read May 7, 2026
Strategy & Governance

Hard Constraints, Not Policies

Policies describe how agents should behave. Hard constraints determine what they can do. Most AI governance frameworks confuse the two — and pay for it when something goes wrong at the execution layer, not the documentation layer.

Strategy & Governance 13 min read May 14, 2026
Technical

MCP Is a Transport Layer, Not a Governance Layer

MCP solves tool connectivity. It does not solve authorization, audit, or behavioral constraints. The governance problem in multi-agent systems is not a protocol problem.

Technical 6 min read April 10, 2026
Constitutional Enterprise

Microsoft Governs How Agents Behave. We Govern Why.

Microsoft’s Agent Governance Toolkit (AGT) governs the HOW layer — behavioral policies, trust scoring, execution sandboxing. CTE governs the WHY layer — the constitutional principles that determine whether an action is right, not just permitted. These are not competing tools. They are orthogonal layers.

Constitutional Enterprise 7 min read April 7, 2026
Security Research

Claude Can Now Use Your Computer. Who Governs What It Does?

Anthropic shipped Computer Use — Claude controls your apps, browser, spreadsheets. Four incidents in one week (OpenClaw, Langflow, Trivy, Computer Use) expose the escalating governance gap.

10 min read March 25, 2026

Enterprise Agent Architecture

The reference model for governing a workforce of humans and agents — the framework, the position-paper series, and the open-core runtime.

Companies with responsible AI frameworks generate 7.2x more AI-driven value (PwC, 2026).

Explore the framework