Two Gates
One decision. Two gates. Most orgs have neither.
Your agentic systems can act on their own.
You're checking whether they can.
You never built the gate for whether they should.
One rule: answer honestly. The second you'd say no — stop. (You won't want to.)
Every action an autonomous system takes should pass two gates.
CAN it? — is the action within bounds.
SHOULD it? — is the action the right thing to do.
Miss either gate, and you have a problem.
A credential says an agentic system is allowed.
Its trajectory — the path it has actually traced — says whether to trust it now.
The credential is only a thin proxy.
So — what a system has done
tells you more than what it holds.
Agree?
CAN has a law.
Never grant an agentic system more autonomy than the environment can contain.
Autonomy ≤ Environment.
So — authorization should be continuous,
recomputed along the path,
not granted once and forgotten.
Agree?
An action can be perfectly authorized and still be the wrong thing to do.
The second gate doesn't ask what a system may do.
It asks what it ought to do.
Permission is not permission to harm.
So — “it was allowed”
is not the same as “it should have happened.”
Agree?
Now watch what happens at scale.
A swarm of agentic systems — every one of them clearing gate one.
Every action allowed. Every credential valid. Every audit passed.
And no one ever built gate two.
So the most dangerous swarm isn't the one that breaks the rules.
It's the one that follows them — perfectly.
Still with me?
Look at what you just agreed to.
CAN without SHOULD → an obedient catastrophe.
SHOULD without CAN → good intentions, no enforcement.
You need both. And both now exist.
Trust as a measurable force. Authority recomputed along the path, bounded by the environment that must contain it.
enter →The normative layer: what an autonomous system ought to do — riding on the rail of what it can.
visit →Together: autonomy you can actually trust.