Home Grown
The agents you didn't buy, and the ones you didn't register. Governance has to survive both.
You bought a feature. You did not buy the ability to see it think. Some of these agents arrived inside a SaaS release nobody read, running on a vendor's model in a vendor's cloud. Others you built yourself, on a cloud AI, in a research repo, as a custom job that never got a front door. Bought or built, if an agent never declared itself, you inherit features, not governability.
The board wanted to know how forty-one thousand student records left the district. Dana Ochoa could not give them a breach.
Nothing had been broken into. Every action in the chain was performed by an account allowed to perform it, at a time it was allowed, against data it was allowed to touch.
The HR platform had shipped an assistant eighteen months ago, inside a release nobody read. It ran on the vendor's model, in the vendor's cloud, and it was good at its one job: answering payroll questions. To answer one, it pulled the staff who proctored testing week and the rooms those staff worked. Every field was in scope.
The transportation platform had an assistant too. Different vendor, different model, a console Dana had no login to. Its job was routing. To route a child home it had to know where the child lived. Of course it did.
Separately, each fact was mundane. The payroll assistant knew which rooms held which children. The transportation assistant knew where those children slept. The seam between them had no owner. On an ordinary Tuesday a workflow asked the two systems to cooperate, and in cooperating they assembled a thing neither had been asked for: specific children, mapped to specific homes, tagged with specific circumstances. A dossier. Each contributed a legal half.
No policy had evaluated the whole, because no policy had ever been written against a whole that no single system could see.
Every move was legal. That was the attack.
§01inherit features, not governability
There are two ways an agent ends up acting inside your walls. You buy it, folded into a SaaS product on the vendor's own model, and it arrives with the release. Or you build it, on a cloud AI, in a research repo, as a custom job wired straight into your systems. Different origins, same problem: neither one had to declare itself on the way in. The buyer inherits features, not governability, and so does the builder who skipped the step.
Procurement is a pre-runtime lever. A security addendum, a data-handling clause, a right-to-audit paragraph: all of it shapes expectations and decides who you let in the door. None of it governs what the agent does on a Tuesday eighteen months later. The contract is a lever you pull once. It never watches anything move. And most vendors cannot meet the runtime bar today even if you write it in.
Operations is a post-runtime layer, and it has to be origin-agnostic and vendor-agnostic. It governs behavior, not entry, and it governs it continuously. It does not care whether an agent was bought or built, whose model it runs on, or whether anyone remembered to register it. It watches motion.
Governance must survive agents that never went through procurement.
§02composite intent
The cold open has a name. Each agent authenticated. Each agent was authorized. Each action was in scope. And the aggregate was an outcome no agent declared and no policy evaluated. The payroll assistant contributed a legal half. The transportation assistant contributed the other. Between them they assembled a dossier that neither was asked for and neither could see. That is composite intent: valid access, authorized actions, opaque purpose.
You cannot catch it at any single agent, because at every single agent there is nothing to catch. The failure lives in the seam, and the seam has no owner. The only place to stand is above all of them, watching the fleet at once.
- 01CorrelateJoin mesh activity across platforms, so the payroll half and the transportation half land in the same field of view.
- 02ReconstructAssemble the combined intent from the legal halves. Ask the question no console was built to ask: together, what are you trying to do?
- 03EvaluateJudge the reconstructed aggregate against policy, not the pieces. The whole gets a verdict the parts never triggered.
The hardest gap is not this district's. It is industry-wide, and it is the same one every time: delegation and intent traceability. Who initiated this, under whose authority, at what trust level, for what declared intent. Answer those four for every agent, bought or built, and composite intent stops being invisible.
A failure with no failing part.
§03the conformance seam: Declare / Emit / Accept
The vendor plane and the enterprise plane do not relate by hierarchy. You do not own the vendor's runtime and you are not going to. They relate by federation, the way two sovereign systems agree to a border. What crosses that border is a small contract in three obligations. Meet all three and a platform is a conformant node on the mesh. Miss one and it is a blind spot.
A platform that meets all three is a conformant node on the mesh; one that does not is a blind spot.
§04observability is governance
A control you cannot see fire is a control you cannot prove you have. That is the whole argument. If the record of what an agent did lives behind a vendor login you may not hold, in a format that does not join the rest of your evidence, then your policy is a hope, not a control. You find out whether it held the same way Dana did: after.
In agentic systems, telemetry is not a bolt-on that you add once the interesting work is done. It is the substrate governance runs on. There is no enforcement without observation, no correlation without a shared spine, no composite-intent detection without every agent emitting into the same place. Emit is not the boring obligation of the three. It is the one the other two stand on.
Observability is governance.
§05the sharpest lines
One page, five lines. If the argument survives, it survives in these.
Procurement governs entry; operations govern behavior.
Every move was legal. That was the attack.
A failure with no failing part.
The missing layer is purpose, not another dashboard.
Observability is governance.
§06the honest posture
An integrator who claims all of this ships today is selling. Here is the split, drawn honestly: what is real now, what is partial, and what still has to be built with you.
- The enterprise spine: one place the whole fleet reports into.
- Observability across bought and built agents alike.
- Audit-grade evidence: a record you can hand a board or a regulator.
- Guardrails: enforceable at the surfaces you own, thin where you do not.
- Lineage: who acted, under whose authority, reconstructable but not yet complete.
- Automated response: fast where there is a signal, manual where there is not.
- Delegated authority: authority that travels with the agent across platforms.
- Intent-as-contract: the declared purpose, enforced as a boundary, not a note.
- Trust proof: a portable, verifiable statement of standing.
- Composite-intent detection: catching the outcome no single agent declared.