Someone Else Described the Problem 36 Days Before I Did

In July I published a preprint arguing that the governance problem for production AI agents is not authorization. It is composition: risk that lives in a sequence of individually-permitted actions, where every step passes its own gate and the trajectory is the harm. I have written variations of that argument here for a quarter.

While preparing a landscape read at the end of August, I sat down with Krti Tallam’s A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents (arXiv 2606.12320) — properly, the paper rather than the abstract. The overlap is not adjacent to my argument. It is my argument.

…risk moves inside the workflow, into sequences of individually-permitted actions that may transform a business process no one authorized.

That is from the abstract. In the body it gets more specific still: “a sequence of individually-permitted actions whose composition is an exfiltration.” “Individually-permitted actions” and “composition” are the two load-bearing terms in everything I have published this quarter, and they appear together, in that order, in a paper submitted five weeks before my preprint.

Why publish this instead of quietly adding a citation

Three reasons, in ascending order of how much I believe them.

The first is defensive and I will not dress it up: it is true, it is checkable in ten seconds by anyone who looks, and being caught claiming priority I do not have would cost far more than the claim was ever worth. I have added the paper to my references and corrected the framing in my own writing. Publishing the correction is cheaper than being corrected.

The second is that it is the honest application of a standard I have been loudly holding other people to. I have spent this quarter arguing that unearned confidence is what makes this field untrustworthy — that a passing test that cannot fail is not evidence, and that a stage reporting success while producing nothing should alarm somebody. A priority claim nobody has audited is the same species of unearned verdict. It would be strange to publish two correctness disclosures about my own tooling in a fortnight and then decline to publish one about my own authorship.

The third is the one I actually think is right. Two people arriving independently at the same problem statement is better evidence that the problem is real than either of us claiming it alone. If the goal is a category rather than a credit line, convergence is the stronger result. Sole authorship of an idea nobody else has reached is indistinguishable, from the outside, from being wrong in an unpopular direction.

Where the contributions actually differ — and it is narrower than I first wrote

My first pass at this concluded that the paper’s statefulness was scoped within a single session, and that cross-session accumulation was therefore mine. That was wrong, and I caught it only because I went back and asked for a definition verbatim instead of asking myself a yes-or-no question. Definition 1:

The reasoning plane is a stateful policy adjudicator that, for each proposed agent action a, evaluates the tuple ⟨p,π,s,h⟩ — where p is the composite principal, π is the agent’s current plan, s is the session state, and h is the accumulated decision history.

Note that h is a separate term from s. The paper does model accumulated decision history as a first-class input to adjudication. It is not a per-action stateless engine, and saying it was would have been a misrepresentation in my favour.

What the paper does not do is fix that history down. It never defines “session” or demarcates a session boundary. It specifies no lifetime for either s or h — nothing says whether either survives an agent invocation. And it gives no quantitative rule for how history composes into a decision: no risk weight, no budget, no decay window, no escalation threshold. Adjudication stays predicate-shaped — if X occurred in context Y, forbid Z.

So the correct statement of the difference is about specification precision and implementation, not about who thought of what:

The distinction between underspecified and absent is the whole of the correction. My first version claimed the paper excluded cross-session persistence. It does not exclude it; it is silent on it. Those are different things, and the difference matters a great deal when you are about to publish a comparison.

What I am not claiming, since this is where it would be easy to

Having conceded the problem statement, there is an obvious temptation to over-defend the remainder. Three limits, stated plainly.

What the paper contributes that I did not have

Reading it as a rival would have been the wrong way to read it, so: four things worth taking on merit.

• Composite principals with capability attenuation. Human → planner → executor → tool, where authority is the intersection across the chain and narrows monotonically. This is the cleanest treatment of delegated agent authority I have read.
• Stop-anywhere mediation. Enforcement is not concentrated at a single chokepoint — which matters, because a single chokepoint is a single thing to bypass.
• Audit as a structured evidence substrate rather than a log you grep after an incident. Adjacent to the decision-evidence argument I have been making, and arrived at independently.
• The five-plane decomposition itself — a reasoning plane that adjudicates intent, sitting over four enforcement planes (network, identity, endpoint, data).

The paper also names its own next step: evaluation against live agent benchmarks. That happens to be the thing I have and it does not — a fleet that has been running under this kind of governance long enough to produce a telemetry record. Which is a good description of why the two pieces of work are complementary rather than competing, and a poor description of a rivalry.

The uncomfortable general point

I found this because I finally read a paper I had previously only read a summary of. That was the fifth time in a single working session that a summary had stood in for a source, and the second time one of those had already reached a published page before anyone caught it.

The practice that works is not “be more careful.” It is mechanical: ask for the text, not for the answer. Every one of those five errors came from an under-specified probe returning something plausible — a yes-or-no question answered yes. The one that got caught in time got caught because I asked for Definition 1 verbatim rather than asking whether the paper handled cross-session state. The question that returns a quotation is much harder to fool yourself with than the question that returns a verdict.

Which is the same argument as the rest of this quarter’s writing, arriving from an unexpected direction. A system that cannot fail has not passed. A claim nobody checked is not a finding. And a priority you have not audited is not yours.