When the Customer Is Software

Visa to Stripe to Shopify, June rebuilt the commerce stack for a buyer that is software. Every layer sells the decision to allow. None sells the answer when an allowed act goes wrong.

Start with two numbers from the same quarter, because together they are the whole situation. Orders arriving at Shopify merchants from AI-powered searches grew nearly thirteenfold year on year. And ninety-five per cent of the e-commerce sales those AI platforms drive still complete on the merchant’s own site: Stripe’s annual letter, not a sceptic’s estimate.

The machines have taken the top of the funnel, and the bottom of the funnel has come home. The agent shops; the transaction still lands on your stack. Whatever agentic commerce becomes, it will be executed, overwhelmingly, on the merchant’s own premises. That makes the question not whether the platforms will own the customer, but whether your stack was built for the customer that is now arriving.

That stack has layers with names on them: the card rails, the processors, the wallet, the platform. June moved every one of them, each layer announcing, in its own launches, exactly what it will and will not be doing for you. Walk them in order, then take two facts from the stack’s edges: a rail in India that already shipped the piece everyone else is asking you to build, and a settlement floor that just turned final.

The rails did the recognising

On 10 June both card networks moved on the same day. Visa announced Agent Scoring, an Agentic Registry, and a Large Transaction Model for machine-initiated payments; Mastercard launched Agent Pay for Machines, a machine-payments product this essay reaches at the settlement floor, while its person-side Agent Pay programme, credentialing trusted agents through Agentic Tokens, has been rolling across its cardholder base since 2025. This is the identity problem being solved where it should be solved, at network scale, by the two institutions with the reach to make an agent credential mean something everywhere at once.

The rails shipped recognition: who is this agent, is it registered, is this transaction inside its declared shape. What no June artifact from either network touches is the question this newsletter put at the centre a month ago: what happens after a correctly credentialed agent completes a valid transaction and the outcome is wrong. The chargeback machinery that made human e-commerce trustworthy adjudicated a binary: did the human authorise this payment. A registered agent inside its mandate producing a mistaken order is a different case, and the new registries are silent on it.

The processors are competing for the decision to allow

One layer up, the two processors that fight for the same merchants have made opposite bets on the same architecture, and each bet is legible in the products. Stripe is betting on owning the surface and the wallet: it co-authored the Agentic Commerce Protocol with OpenAI and Meta and runs the checkout path inside ChatGPT; its Shared Payment Tokens let the agent itself pay; and its stablecoin and machine-payment lanes point at the endgame of software paying software.

Adyen launched Adyen Agentic in June as the opposite posture: launched 16 June as a universal translator across UCP, ACP, and AP2, compatible at launch with Meta’s AI checkout and built to add surfaces as they appear, explicitly preserving the merchant of record, with token portability and its EU banking licence underneath. One wants to be where the agent is; the other wants to be whatever the agent arrives through. The protocol field between them is already four lanes wide: UCP and its council, ACP, Google’s AP2 with its sixty-plus partners now stewarded at FIDO, and x402 for machine-native payments. Adyen’s answer to the proliferation is to speak all of them, while Stripe’s is to write them.

The rails, meanwhile, did not stay on their own layer: Visa, Mastercard, and Amex sit on Adyen’s announced partner roster, the networks distributing their new agent recognition through the neutral processor even as they sell it directly. The early merchant lists make it concrete: Sézane, SharkNinja, and Scheels arriving through one door; Etsy, Coach, and Revolve through the other, with Meta, characteristically, on both.

These are serious products, built with skill, and a merchant should be running one of them. But strip the two strategies to their common element. Moving the money is commoditising. Both stacks, all four protocols, the same rails underneath. What each side is building as the thing rivals cannot route around is the decision that comes before the money moves: whether this agent, for this person, should be permitted to act. Stripe scores it through Radar and token scoping; Adyen through a risk engine built, in its own words, to “distinguish a legitimate AI agent from a bot”; the networks through their registries.

Then read the fine print of the trust layers, because it settles where this essay is heading. In Adyen’s model, liability and disputes sit, by design, with the merchant of record: the neutrality bet’s honest price tag. In the reach model, the wallet and the surface move up the stack while the dispute still finds its way back to whoever sold the thing. Whichever bet wins, the allow-decision is for sale and the answer still is not; the adjudication paths that exist run upward, to the network and the processor’s own programmes, before they run outward to anyone the transaction touched.

The one vendor selling the consequence

There is a fourth party on this layer, running a different play. PayPal’s agentic commerce services lead not with the allow-decision but with what comes after it. Agent Ready extends payments acceptance onto AI surfaces with fraud detection, buyer protection, and dispute resolution attached, on a pitch of no additional technical lift for its existing merchants. Store Sync pushes catalogues into Copilot, Perplexity, and the rest through the engine layer: Wix, BigCommerce, Shopware, and their peers. And its PayPal Agent, built with Google Cloud, speaks A2A to the merchant’s own agent and settles under AP2, down to checking buy-now-pay-later eligibility mid-conversation.

It is the one strategy on this layer whose headline is the consequence machinery, because PayPal is porting the protection programme it already owned. Purchase Protection and Seller Protection were the chargeback era’s consumer institution, and extending them to agent-initiated transactions is real, welcome, and worth pricing into any merchant’s choice of wallet rails. Still, it is the old adjudication carried forward: a programme built to answer was this authorised, now facing transactions where the authorisation is cryptographically impeccable and the outcome is what went wrong. The ported chargeback reaches the new era’s easy cases. The case this series keeps returning to, the valid delegation with the invalid result, is not yet what any programme on this layer decides.

The platform returned the transaction to you

The clearest structural fact of the past year is what happened when the platform closest to the user tried to own the checkout. The in-chat instant checkout experiment was pulled back by its own retail partners within months and retired in March; the platform retreated to powering discovery while the transaction returned to each merchant’s environment. Walmart’s numbers explain why the merchants could insist: purchases inside the chat surface converted at roughly a third the rate of ordinary click-throughs to Walmart.com, with cart abandonment far above the norm. The buyer’s agent now lives across half a dozen surfaces: ChatGPT, Gemini, Meta AI, Claude, Copilot, Perplexity. But discovery is what those surfaces kept. Execution came back to the storefront.

Which is why the quiet plumbing matters more than it looks. Google’s Universal Commerce Protocol, now backed by PayPal, Checkout.com, Adyen, Stripe, and both card networks and moving under neutral stewardship alongside A2A, has a merchant publish a manifest at /.well-known/ucp declaring what the store can do. Its April update filled the declaration out: a Cart capability for multi-item orders, a Catalog capability serving real-time variants, inventory, and pricing, and Identity Linking so loyalty follows the shopper across surfaces.

Your storefront is becoming a machine-readable declaration, and your product data is becoming your merchandising. Shopify’s own figures make the stakes plain: AI traffic to its merchants grew eightfold, and the slice grounded in its structured catalogue converts at twice the rate of AI traffic working from scraped or stale data. The store that describes itself precisely gets selected; the one that leaves the machines to guess gets misrepresented, and then blamed for the misrepresentation.

Two counter-moves from the same weeks show the boundary is still contested. Google’s Universal Cart, announced at I/O for a US summer rollout in Search and Gemini, follows the user across Search, YouTube, and Gmail, watching prices across merchants: the aggregator declining to concede that the transaction has come home, by keeping the basket even where it no longer keeps the checkout. Amazon took the opposite posture toward other people’s agents entirely, securing a federal injunction that blocks Perplexity’s Comet browser agent from purchasing on its platform. Where one class of merchant publishes a manifest, the largest one litigates the perimeter. Neither move is available to the ordinary operator. That is exactly why the manifest, the catalogue, and your own storefront machinery are.

And the deeper adjustment is to the customer’s shape, not its channel. Everything in a storefront encodes a buyer who attends at a moment: the session that expires, the error message written for a reader, the rate limit that treats systematic probing as abuse. In June 2025 I wrote that models provide intelligence at a moment while agents provide presence over an arc; that sentence was about the systems enterprises deploy, and it is now the correct description of the systems that buy from them. An agent holds your catalogue in memory, re-checks your prices on a schedule, retries your failures methodically, and carries authority granted weeks ago into this morning’s order. It does not get annoyed; it also does not notice when it should stop. Authority regenerates from the continuity around it unless decay is designed in: a finding this series established about enterprise mandates that now applies, unchanged, to your standing-order logic.

India already shipped the primitive

One jurisdiction has already built the piece this essay will shortly ask you to build: into the rail itself. NPCI’s UPI Reserve Pay lets a person grant one consent with a per-merchant spending limit; inside that limit an agent transacts without per-transaction PINs or OTPs, while the person keeps real-time visibility and can revoke the standing authority instantly. Bounded standing authorisation, with the revocation held by the principal, shipped at the rail itself rather than as any processor’s product. One precision, because the label matters: UPI is routinely described as public infrastructure, but Reserve Pay ships from NPCI, a consortium majority-owned by its participating banks and the sole authorised operator of the switch. The public actor in this stack is the regulator.

It is already carrying live traffic: agentic UPI piloted on ChatGPT from October and on Claude from February, with Zomato, Swiggy, and Zepto as launch merchants, Razorpay’s MCP server wiring the agents to the rail, Axis Bank and Airtel Payments Bank underneath. The operator has set a domain model, FiMI, against dispute handling and mandate lifecycle on the rail side, and its chief executive says audit systems for the instructions and consent users give agents must come with the scale. With the central bank’s pen open until 24 July, India is currently the one stack where both columns of the ledger below are being drafted in the open at once: the handshake by the rail’s operator, the consequence by its regulator. Read Reserve Pay less as an exotic feature than as an existence proof: these controls run today at the scale of the world’s largest real-time payment system.

The floor turned irreversible

At the very bottom, on 30 June, a hundred and forty-odd institutions launched Open USD, a shared stablecoin under the new US legislation: settlement that clears irreversibly, the holder owed redemption on demand and nothing more. This is the settlement determinism the IMF’s April note on agentic payments put at the base of the stack, and the processors are already wiring themselves to it, Stripe through Bridge, the consortium through the shared coin. The consequence runs upward through every layer. When the floor is final by design, every uncorrected wrongness above it gets more expensive, because the money no longer waits for the argument. The correction window, the time between an action and the last moment a human can still intervene, entered this series as a reliability metric for the systems you deploy. Irreversible settlement makes it a commercial metric for the systems that buy from you.

The same floor is already carrying a second market, one this essay has kept out of frame: machines buying for themselves, compute, model calls, data, from other machines. Mastercard’s 10 June launch, Agent Pay for Machines, gives that lane a full product. The owner authorises a spend limit once, and the authorisation can be recorded on-chain; the agent transacts against lightweight vouchers; the network batches, settles with a guarantee, stablecoin in or out. x402, the payment-required rail built for the same traffic, moved to the Linux Foundation in April with both networks, Google, AWS, and Circle aboard, and AWS wired agent payments into Bedrock in May; card economics, with their thirty-odd cents of fixed cost, cannot reach tickets this small. Note what completes down there. The allow-decision is now literally notarised on a chain, and the one consequence-shaped artifact in the lane is a settlement guarantee: an answer to will you be paid, not to should it have been bought, with no person on either side to write terms against. The merchant lane, whatever else it lacks, still has you and your customer. That is the asset.

Crypto ran this experiment first, and by conviction rather than omission: settlement finality was the product, and the absence of chargebacks is still marketed to merchants as a feature, which states the asymmetry out loud, the buyer’s recourse was the cost saving. Yet even there the demand for reversal regrew its organs: optimistic rollups hold every exit open through a seven-day challenge window, staked juries arbitrate escrowed disputes, stablecoin issuers keep a freeze switch, and when the loss was large enough the community’s only answer was the fork, adjudication by chain split, usable roughly once. A stack that deleted the answer column by design spent the next decade rebuilding pieces of it; the rails now importing its finality should budget for the same bill.

Handshake and consequence

A month ago the argument here was a history lesson worth restating. SSL gave the early web its handshake, and consumers still did not trust it until the chargeback gave the web its institution: a rule for who is made whole when a valid transaction goes wrong. Cryptography bakes in authorisation with great elegance; it cannot bake in redress. The claim was that the agent era had finished its SSL and not begun its chargeback, because every body with the convening power to write the consequence rules had scoped them out.

June was the busiest month this space has had, so sort it into those two columns. The registries, the scoring, the wallets, the manifests, the discovery-provenance spec Google published on 17 June, even the AuthZEN approval profile adopted in May that finally gives an agent a wire-level path after “no” (deny, but escalate), all of it is handshake, and the escalation in that last one runs upward to the operator, not outward to anyone a decision lands on. The nearest industry offerings to consequence machinery prove the rule by their shape: PayPal’s ported protection answers the old question, and where the aftermath appears in a protocol at all (UCP’s order lifecycle does carry fulfilment events and refund adjustments), it is event plumbing, not decision rights.

The trail those events would feed is itself fragmenting. Intent lives with the AI surface, the checkout session with UCP, the authorisation with the network, the cart with the platform, the fulfilment with you: five stages under five stewards. The classic internet stacked responsibility, each layer answering to the one above it; this architecture shards it sideways, across institutions that owe each other nothing. It is the cross-boundary reconstruction problem this series named at the protocol layer, arriving in commerce with money attached.

On the consequence side, the month produced three entries, and their authorship is the finding. Colorado’s reasonable-care standard for high-risk AI took effect on 30 June, and the Reserve Bank of India’s draft directions are open until 24 July: lawmakers and regulators, writing protections toward the person, with the revised Product Liability Directive behind both, reaching national law on 9 December. The third came from a merchant: Target updated its terms to treat AI-agent purchases as “transactions authorized by you,” assigning the agent’s mistakes to the customer. So the consequence column is being filled after all: by legislatures on the person’s behalf, and by terms of service against them, with the standards process absent from both. Your own terms will write an entry in this column within the year. The only open question is which of those two directions yours will face.

What to build this quarter, layer by layer

Until the consequence column consolidates, the merchant’s stack is where its share gets built. What follows is less advice than interim institution-building.

1. At the storefront: publish a refusal taxonomy. Your error messages are now API contracts. Every decline, hold, out-of-stock, and price change should carry a stable code, a reason class, and a retry policy an agent can act on, declared where your capabilities already are, in the manifest, and mirrored in your processor’s webhooks. A store that answers failures in prose will be reverse-engineered, badly, at machine speed.

2. At the platform: treat probe policy as merchandising. Systematic price-checking is no longer abuse; it is how you get selected, and the structured-data conversion gap is the proof. Decide explicitly, with an owner, what probing you invite, what you throttle, and what you charge for, because the bot policy you have today is deciding it for you by accident.

3. On your own API: stand up a re-evaluation endpoint. When you decline or hold an agent’s order, give it one deterministic, logged, rate-limited path to present more context and receive a fresh decision. The AuthZEN approval profile is the working-group rendering of the shape; build to it rather than inventing it. The alternative is the agent hammering the gate while its principal arrives in your support queue already wronged.

4. In the payment layer: put decay on standing authority. Stripe’s scoped, single-use credential is the right primitive; extend the same property to everything on your side that outlives a session: replenishment, standing orders, price-triggered purchases. A lifetime, a renewal that requires the principal, and a measured window between order and irreversibility. The pattern is not speculative: it runs today at population scale as UPI Reserve Pay, with the revocation held by the person. Authority should decay by default; above an irreversible floor, that is a solvency practice, not a compliance one.

5. Across all of it: tag the species end to end, and keep your own trail. The registries make agent-initiated transactions identifiable at the rail; whether that identity survives into your order records, your dispute records, and your ledger is your build. And because the transaction’s stages now scatter across five protocols under five stewards, you are the only party positioned to hold a composable record from intent signal to fulfilment. Do it before the dispute volume arrives, because afterwards you will be reconstructing it from other people’s logs, under deadline.

None of this waits on a standards body, and each item lands on a layer with a named vendor already underneath it. The rails have done the recognising; the legislatures have begun the requiring. The layer in between — where a correctly credentialed agent’s permitted act meets the person who has to live with the result — is not waiting on anyone’s charter, because it is already in production, on your stack, taking orders.

Notes and sources

1. Shopify, Q1 2026 earnings call: AI-search-originated orders up ~13x year on year; AI traffic up 8x; structured-catalogue traffic converting at ~2x.

2. Stripe annual letter, as analysed by eMarketer: ~95% of AI-platform-driven e-commerce sales complete on the merchant’s own site.

3. Visa, Payments Forum announcements, 10 June 2026: Agent Scoring, Agentic Registry, Large Transaction Model.

4. Mastercard, Agent Pay (Agentic Tokens), announced 29 April 2025, US cardholder rollout from late 2025.

5. Stripe, agentic commerce documentation and Agentic Commerce Suite, announced 11 December 2025: Shared Payment Tokens, Issuing for agents, Bridge; network-token and BNPL expansion, 3 March 2026.

6. Agentic Commerce Protocol (Stripe and OpenAI, September 2025; Meta joining subsequently).

7. Adyen, Adyen Agentic launch, 16 June 2026: Agentic Feed, Agentic Cart, Agentic Payments; partner roster; the risk-engine quote is Adyen’s own language.

8. Google, Agent Payments Protocol (AP2), partner roster; stewardship at FIDO.

9. x402 machine-payments protocol; moved to the Linux Foundation, April 2026.

10. PayPal, agentic commerce services: Agent Ready, Store Sync, and the PayPal Agent with Google Cloud over A2A and AP2. PayPal newsroom; paypal.ai.

11. Walmart, in-chat conversion and abandonment figures, as publicly reported; in-chat instant checkout retired March 2026.

12. Google, Universal Commerce Protocol: backer roster; April 2026 update (Cart, Catalog, Identity Linking; fulfilment and refund events in the order lifecycle); the /.well-known/ucp manifest. developers.google.com/merchant/ucp; ucp.dev

13. Google, Universal Cart, announced at I/O 2026 for US summer rollout in Search and Gemini.

14. Amazon v. Perplexity: federal injunction blocking the Comet browser agent from purchasing on Amazon, via PYMNTS.

15. NPCI–Razorpay, agentic UPI on Reserve Pay and UPI Circle: ChatGPT pilot from October 2025 and Claude pilot from February 2026, with Zomato, Swiggy, and Zepto; Razorpay announcement; Business Standard coverage.

16. Dilip Asbe (NPCI), Mumbai Tech Week 2026 interview: audit systems for agent instructions and user consent.

17. Open USD consortium stablecoin launch, 30 June 2026.

18. Mastercard, Agent Pay for Machines, 10 June 2026: credentialing via Verifiable Intent, permissioning, voucher-based transacting, guaranteed multi-rail settlement.

19. AWS, Bedrock AgentCore agent-payments preview, May 2026, with Coinbase and Stripe.

20. IMF, How Agentic AI Will Reshape Payments (Davidovic and Tourpe), April 2026.

21. Google, Agentic Resource Discovery specification, 17 June 2026.

22. OpenID Foundation, AuthZEN approval profile (deny-but-escalate), adopted May 2026.

23. Colorado Artificial Intelligence Act (SB24-205), reasonable-care standard for high-risk AI, effective 30 June 2026.

24. Reserve Bank of India, draft directions on AI in financial services, comment window to 24 July 2026 (draft ID 4479).

25. EU Product Liability Directive, Directive (EU) 2024/2853, national transposition due 9 December 2026.

26. Target, terms-of-service update treating AI-agent purchases as “transactions authorized by you,” via eMarketer.

The analytical framing is the author’s own.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a publication on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN.

Earlier in the Layer 8 series

• Beyond Commerce: the SSL of the agent era, and the missing chargeback.

• Building the Signature Surface: the harness, the case file, the correction window.

• Exit Is the Primary Agentic Right: why standing authority regenerates, and what decay-by-default requires.

Everything about India’s capability centres is measured in people. The headline figures are headcount: 2,117 centres, 2.36 million employees, and a sector that added close to 200,000 jobs last year, almost twice what the IT services firms managed. The state policies that compete for these centres are written in jobs too: payroll subsidies, grants for every fresher hired, money clawed back if a centre’s employee count falls. Even the celebration is counted in heads. When the industry gathered at its summit this year and announced it had moved “from scale to ownership,” the proof it offered was that 96% of the centres set up since 2021 had launched with product mandates rather than back-office ones. The story India tells about this success, and the instruments it uses to back it, both rest on a single assumption: that the number of people a centre employs is a fair measure of the capability it holds.

For 30 years that assumption was sound. A capability centre’s output was roughly proportional to its payroll, because the work needed people to do it, and more work needed more people. The agentic turn in software is dissolving that proportion. When execution itself becomes something software can do — not just generate a draft but run the task, check the result, handle the exception and move to the next one — capability stops tracking headcount. Capability is an organisation’s ability to convert knowledge into reliable execution. Scale determines how much it produces; capability determines what it can reliably produce. Once capability is defined this way, almost every current metric for these centres begins measuring yesterday’s economy. Whether artificial intelligence will change these centres is not in question; it will. What matters is what a capability centre becomes, and what India’s advantage rests on, once capability is no longer proportional to payroll. The centres are the clearest place to watch, because the economics of capability are changing underneath the whole economy and surface there first.

The equation that broke

The change is simpler than the technology around it. Generative AI lowered the cost of making things. Agentic AI lowers the cost of doing them. An agent does not stop at a suggestion; it acts, and keeps acting, with a person supervising rather than typing. Execution, the part of knowledge work that used to require a human at a keyboard, becomes capacity you can buy by the unit.

For a capability centre this is not a productivity upgrade but a change in the production function. The old equation was simple: capability was a function of how many engineers you employed. The new one has more terms. Capability is now a function of people, the agents they direct, the systems that orchestrate those agents, the governance that keeps them safe, and the data they learn from. Headcount is one variable among several, and no longer the decisive one. Once that is true, the centre stops being a pool of labour and becomes something harder to name: an organisation that allocates and governs execution rather than performing it. Almost everything else that is confusing about this moment follows from that one shift, including its least intuitive consequence: when execution becomes abundant, the organisations that know how to direct it become more important, not less.

Two kinds of capital

Sort what a capability centre owns into two piles, because the agentic era treats them very differently.

The first pile is rentable. Compute, the foundation models, the inference that runs them — these are becoming infrastructure. They are improving quickly, getting cheaper, and available on demand from a competitive market. There is a reflex, in much current commentary, to treat dependence on a foreign model provider as a danger in itself. That worry is misplaced. No capability centre owns its electricity; it rents its cloud, it rents its software, it rents its office floor. Renting inference is the same kind of decision, and usually the right one. India will consume this infrastructure the way it consumes any other, small and cheap models will multiply, and almost none of a centre’s lasting advantage will come from owning the layer everyone else can rent. The sensible posture toward rentable capital is to rent it well. That is the whole renting argument, and it needs no more room than this.

The second pile is the one that matters, because it compounds. Knowledge: the operational learning a centre accumulates about a business, its data, its domain. Leadership: the scarce people who can direct the rest. The ecosystem a centre sits inside. The governance it can exercise over systems that now act on their own. And the institutions that hold all of it together over time. None of this is available on demand. It is built slowly, it appreciates, and — the decisive property — its location is a choice in a way the rentable layer’s is not. You will run whichever model is best and rent compute wherever it is cheapest, but where your knowledge, leadership and institutional capability accumulate, inside your organisation or outside it, inside the country or outside it, is decided by how you build, not by the market. For a firm and a country alike, the strategic choice of the agentic era is which pile to optimise for. Most of the conversation is still optimising for the first.

What actually compounds

The second pile is where the real argument lives, and it is the part most analyses skip. Capability compounds because it is cumulative: every execution leaves behind knowledge, judgement and institutions that make the next one easier. Unlike labour, capability survives the completion of the task that created it. Headcount does not. It compounds through things that look soft until you try to buy them quickly and find that you cannot. Leadership density: the depth of people who have built systems before and can be trusted to make 100 judgement calls a week. Engineering culture: the habits, standards and shared vocabulary that let 1,000 people work as though they were 50. Startup recycling: the constant churn of people leaving to build and returning with scar tissue. Universities and the pipelines they feed. The operational learning that accumulates every time a system fails in a new way and someone works out why. Governance maturity, the hard-won sense of which decisions can be delegated and which cannot. And institutional memory, the part of an organisation that remembers what was already tried.

Agents raise the value of these assets. They add scale, not capability, and capability is the part that compounds. When execution is scarce and expensive, the binding constraint is the supply of people who can execute, and headcount is what is worth having. When execution becomes abundant and cheap, the binding constraint moves — to the capacity to direct execution well, to absorb a new technology and turn it into reliable operations, to govern systems acting on their own, and to learn faster than the organisation next door. Those are the compounding assets. An agent makes a mediocre engineering organisation slightly faster and a deep one dramatically more powerful, because the deep one can metabolise what the agent produces. The scarce resource is no longer the worker. It is the organisation’s ability to absorb and operationalise new capability, and that ability is unevenly distributed, slow to build, and impossible to rent.

Economists call it absorptive capacity: the ability of a firm or a region to recognise new knowledge, take it in, and put it to use.¹ It is why two capability centres given the same agents and the same budgets diverge, one becoming a transformation hub and the other staying a delivery centre. It is why two states with near-identical incentive schemes get different results. And it is why a city can keep winning long after it has stopped being cheap.

Why Bangalore still wins

Bangalore is the cleanest proof of the argument, precisely because on the old theory it should be losing. Its roads are among the most congested of any major technology hub; by one widely cited estimate the gridlock costs the local economy around ₹20,000 crore a year. Its salaries have risen to the point where a senior engineer or architect at a leading centre no longer competes in a local labour market at all, but in a global one, priced against worldwide demand for the same scarce skill. Its infrastructure is visibly strained. If capability were a function of cost, capital would have left for somewhere cheaper years ago, and indeed much of the routine work has moved to other cities and smaller tiers. Yet firms keep choosing it while complaining about it, and the country’s deepest concentration of capability stays put.

Cost no longer explains Bangalore’s dominance. It wins because few places match its absorptive capacity: a deep pool of people who have led engineering before, a thick network of startups recycling talent, a developed supplier and investor ecosystem, a mature engineering culture. New technology arrives there and is put to work faster than anywhere else, because the surrounding tissue is already in place to absorb it.

What looks like an advantage in engineering headcount is often an advantage in social infrastructure. The same engineer will spend 10 years moving through a startup, a capability centre, a hyperscaler and a product company, carrying operating practices, technical judgement and professional networks across each boundary, so that capability accumulates across the ecosystem and not only inside any one firm. Developer communities, former colleagues, open-source collaboration and university networks let knowledge travel faster than any organisation chart, and they are slow-moving assets that no incentive scheme can conjure.

This is not Indian exceptionalism; it is the same increasing-returns logic that explains Silicon Valley, where raising the density of a knowledge cluster raises its productivity.² Cost was never the real moat. It was the cheapest part of the moat to see, and it is the first part the agentic era removes. What remains is the part that compounds, which is exactly the part a balance sheet has never known how to value.

A reasonable objection runs the other way: if agents make execution abundant everywhere, geography should matter less, not more. The opposite is more likely. As execution becomes cheap, the returns shift to the things that direct it — leadership, governance, organisational learning, ecosystem depth — exactly what a mature cluster accumulates over decades and a cheap location cannot. Commoditising execution does not commoditise the capacity to absorb and govern it, which is why the advantage concentrates rather than disperses.

Three theories of capability

If capability compounds rather than accumulating by the hire, what matters is how a place builds the capacity to compound it. India is, almost by accident, running several of these experiments at once. Three illustrate the contrast most sharply, and they are best read not as a ranking of states but as different theories of how capability forms.

Bangalore, and Karnataka around it, embodies the first theory: that markets compound capability. Nobody planned the Bangalore ecosystem; it emerged from decades of firms, people and capital interacting until the city had built what is plausibly the densest engineering ecosystem outside Silicon Valley. Karnataka’s recent policy is unusual in recognising what it has, framing its centres as creators of intellectual property rather than employers of people, and trying to seed the same density in other cities. The theory’s strength is that it works. Its weakness is that it is very hard to reproduce on purpose.

Kerala embodies a second theory: that knowledge institutions compound capability. Rather than treating capability primarily as something to attract, it has spent decades treating it as something a state can deliberately build. For 20 years the state has treated knowledge as public infrastructure, running one of the world’s largest deployments of free software in its schools, mandating open standards in government expressly, in its own policy’s words, to avoid total dependence on select vendors, and writing the language of free software, free knowledge and an egalitarian knowledge society into its IT policy as early as 2007. The wager was that capability could be built deliberately, through institutions and a knowledge commons, rather than left to emerge from a market. I was involved in parts of that work — the 2007 policy and the national open-source effort that followed — so I have watched this approach tested, not only argued. It is slower and less glamorous than Bangalore, and it produces a different asset: not density, but independence. What it has not done is turn that depth into clusters or centre scale to rival Karnataka’s or Telangana’s. But the underlying assets — engineering talent, knowledge institutions, open standards, public capability accumulated over decades — remain unusually strong. Whether that institutional depth becomes globally visible capability is now less a question of talent than of institutional choice.

Telangana embodies a third theory: that governments can deliberately accelerate capability formation through policy, research partnerships and ecosystem building. Over the past decade it has assembled one of India’s strongest AI and deep-technology ecosystems, combining research institutions such as IIIT Hyderabad, globally significant R&D centres, startup ecosystems, venture capital, engineering talent and an unusually proactive technology administration. Individual initiatives such as the Agriculture Data Exchange illustrate that approach rather than define it. The theory is distinct from the other two: not markets alone, and not long-built institutions alone, but the state deliberately assembling conditions under which capability compounds.

Three states, three theories, and not one of them is betting on headcount — that is the tell. They are not the only experiments running. Tamil Nadu compounds decades of manufacturing, engineering education and supplier ecosystems into product engineering. Pune compounds enterprise software, automotive and manufacturing engineering, and research. Andhra Pradesh is assembling newer capability around advanced manufacturing, electronics and logistics. These are illustrations, not an exhaustive survey, and they are best read not as a ranking of states but as different theories of how capability forms and what role the state plays in it — market ecosystems, knowledge institutions, state-led ecosystem building, industrial depth — each suited to what a region already has, and none of them permanent, since endowments and governments change. India’s advantage will not come from every state copying one model. The question is no longer which state can attract the next capability centre, but which can become the place where capability compounds fastest. The task of national policy is to strengthen those different mechanisms, not to encourage imitation.

Inside the centre

The same shift, seen from inside an engineering organisation, changes its shape. The classic capability-centre pyramid was broad at the base, where juniors did the volume of the work, and narrow at the top. Agents hollow the base, because volume work is the automatable work, and push value toward a different silhouette: a thin layer of strategy and architecture, a band of people who design and supervise the agents, the domain experts who know what “correct” means in a particular business, and an operations layer that now includes the agents themselves. The scarce role is no longer the engineer who writes the most code but the one who can make a system of agents reliable, which means India’s long-standing shortage in the 8-to-15-year band, the people who turn intent into working systems, becomes the binding constraint rather than a background complaint.

The value moves to the work around the code: designing the evaluations that tell you whether an agent is doing its job, building the memory that lets it carry context, encoding a domain into something an agent can use, and building the feedback that turns failure into improvement. India’s own hiring data already shows the move, with governance, evaluation and the running of agents in production now a large and growing share of agentic-AI demand. And it points to what will decide who scales: governance. Running a handful of agents is an experiment. Running tens of thousands of them, each able to act, is an institutional problem: deciding what may be delegated, who owns the risk, and how any of it is audited. A large share of corporate AI initiatives are already abandoned before they reach production, and the reason is rarely the model. It is the absence of the operating governance to run it safely at scale. Governance is not a compliance footnote. It is the scaling constraint, one more form of compounding capital that cannot be rented.

For a finance director the same picture appears as a change in the shape of the P&L. The cost of execution falls and becomes a variable, rented input; the investment that matters shifts to the orchestration, evaluation and governance around it. Operating leverage rises, because output is no longer tied to a payroll. A balance sheet records software, buildings and patents; it has no line for engineering culture, leadership density, operational knowledge or governance maturity, and yet those increasingly decide whether one centre out-produces another. The question worth a board’s attention is not the cost of any line. It is where the resulting value collects: on the centre’s own balance sheet, as data and operational learning and governance capability it owns, or on a supplier’s. That is a capital-allocation question, and it has the same answer as everything else here. Own the things that compound; rent the things that do not.

Measuring yesterday’s economy

This is where the gap between the old measure and the new reality becomes a public problem rather than a private one. More than 10 states now run dedicated policies to attract capability centres, and between them they target some 2,500 new centres, 15 lakh jobs and ₹75,000 crore of investment, with the money almost everywhere attached to headcount: subsidies per employee, grants per fresher, support withdrawn if a centre falls below an employee count, incentives clawed back if it stops hiring. None of this was irrational. These incentives were built for an economy in which headcount was a reasonable proxy for capability, and for a long time it was. The agentic shift is precisely the thing that breaks the proxy. A centre can now grow more capable while employing fewer people, which means a state can succeed at its stated goal of more jobs while the capability it actually wanted accumulates somewhere its instruments cannot see.

The deeper trouble is that the incentives of the different players are diverging. A state rewards employment. A firm, behaving rationally in an agentic operating model, maximises capability and output without proportional hiring. Those two objectives used to point the same way and no longer do, so a centre can be penalised by the state’s metric for doing exactly what the era rewards. This is a coordination problem, not a technology problem, and it has a coordination answer: measure and reward productive capacity rather than presence. A capability-centre policy fit for the agentic era would compete on value retained rather than jobs created — on intellectual property and data held in the country, on advanced engineering and research, on the governance and knowledge assets that make execution good, on participation in the ecosystem that lets capability compound. The contest is shifting from the size of an incentive to the depth of a place’s capability infrastructure: its universities and research institutions, its developer communities and open-source ecosystems, its shared digital infrastructure where appropriate, its open standards, its data-governance frameworks, its data-centre readiness and power resilience, and the density of its engineering leadership. These are slower to build than a payroll subsidy and harder to put in a press release, but they keep compounding long after an incentive has been spent. Beneath them sits a harder layer still: the rentable inputs a firm can buy on demand — compute, power, inference capacity — become, at national scale, a question of grid and data-centre capacity that a country cannot rent from somewhere else, which is the point at which this stops being centre policy and becomes industrial policy. The same economic logic applies at every scale. Organisations, ecosystems, states and nations all compete by accumulating capability faster than they consume it. The national framework for these centres, promised in last year’s budget and still being finalised, is an unusually well-timed chance to write the new measure in before the old one sets in policy concrete. The three states already experimenting have shown what the new measure looks like. The challenge now is to translate these experiments into national policy.

The next advantage

India made itself indispensable, over 30 years, by executing the world’s software well and cheaply, and it measured that success in the most honest currency it had, which was jobs. The agentic era does not threaten that success because the work now runs on rented intelligence. It changes what the success is made of. When execution becomes abundant, the things that stay scarce are the ones that compound and cannot be bought in a hurry: leadership, engineering culture, the capacity to absorb new technology and operate it, governance, institutions, and the learning a system accumulates about the world. A country’s advantage comes to rest on how well it builds and keeps those things, and on whether they compound at home or somewhere else.

Counting heads was a good enough proxy for all of it while capability and labour moved together. They have come apart. The economic question is no longer where work is performed; it is where capability accumulates. The next generation of these centres will be judged not by the size of their workforce but by the capability they compound, and the ones that work it out first will stop counting heads — not because people have stopped mattering, but because they will have found a truer measure of what they have become. The question that defines India’s next decade follows from the same shift: no longer how much of the world’s work it can perform, but how much of the world’s capability it can compound at home.

Notes.
¹ Wesley M. Cohen and Daniel A. Levinthal, Absorptive Capacity: A New Perspective on Learning and Innovation, Administrative Science Quarterly, 1990.

² Stuart S. Rosenthal and William C. Strange, Evidence on the Nature and Sources of Agglomeration Economies, in Handbook of Regional and Urban Economics, 2004.

Headline GCC figures are drawn from the Zinnov–NASSCOM India GCC Landscape Report (FY2026) and represent industry estimates rather than audited statistics.

Unless otherwise stated, factual claims are supported by publicly available sources. The analytical framework, synthesis and conclusions are the author’s own.

Eleven days after the European Technological Sovereignty Package landed on 3 June, it has set off precisely the fight you would have predicted. Washington, which has spent the year threatening Section 301 trade retaliation over Europe’s digital rules, treats the package as one more of them; industry groups called it protectionist and discriminatory the same day; Brussels insists, in the words of its tech sovereignty chief, that sovereignty does not mean protectionism and that the tests are technology-neutral; the hyperscalers it targets are quietly building European joint ventures to qualify; and from the other flank, two dozen European cloud providers warn that the whole thing risks “sovereignty washing” — that it may not go far enough to dislodge the incumbents. Even sympathetic economists caution that Europe is mimicking its rivals’ protectionism rather than out-competing them.

It is a genuine argument, and it will run for a year. But step back from the volume and notice what every one of those positions has in common. The American complaint, the European-provider complaint, the Commission’s defence, the economists’ warning — all of them are arguing about the same axis: who owns the system, where it sits, and which flag it flies. That is one way to read the word sovereign. It is the shallowest way, and — as the draft criterion currently stands — it is most of what the test measures. The question that will decide whether the package delivers anything durable is the one nobody is fighting over: not whether sovereignty is assessed, but how deeply.

The centrepiece, the Cloud and AI Development Act, commits the Union to a single framework for assessing the sovereignty of cloud and AI services, with four sovereignty tiers and real consequences — services that fail the highest tier can be kept out of the most sensitive public contracts. As drafted, those tiers measure what you would expect at the surface: where the infrastructure sits, who owns and controls the provider, and whether a foreign law can reach it. That is a real criterion, and it is pitched almost entirely at the shallowest reading of the word. What the next year of trilogue between Parliament and Council will settle is whether it is deepened or left there — whether “sovereign” comes to mean something structural or stays at “European-owned.” The package did not forget to write the test. It began to — and, as the reaction shows, it is on course to stop one layer too early.

The instinct is correct

Begin with what the Commission got right, because it is most of the work. Executive Vice-President Henna Virkkunen framed the goal plainly: to ensure that no provider of Europe’s critical workloads holds a kill switch over them. Strip away the geopolitics and that is a precise engineering demand. Europe wants the ability not to be shut off, not to be silently altered, and not to be locked in by a party whose decisions it cannot see and cannot overturn. It wants to inspect the infrastructure it runs on, to leave a provider that fails it, and to reproduce what it depends on rather than rent it on terms set elsewhere. Those are the properties of a system that stays correctable by the people who depend on it — and they are the right properties to demand.

The package builds real instruments toward them. The Cloud and AI Development Act turns “trustworthy” into a graded, enforceable classification rather than a slogan, and Virkkunen was candid that providers under foreign legal compulsion will find the top tier hard to reach — the honest version of the argument. The Open Source Strategy is the part that matters most, and the part the open-source community has spent two decades working toward: for the first time, open source sits at the centre of European digital policy, named not as a procurement saving but as a structural lever of sovereignty — the thing that lets a public administration read, modify, and keep running the systems it depends on without a vendor’s permission. The Free Software Foundation Europe, which has campaigned on exactly this, reads the package as a possible adoption of its long-standing “Public Money? Public Code!” principle, and notes that the Development Act carries a “Free Software first” rule for public cloud and AI procurement. The diagnosis underneath all of it is not in dispute: Europe depends on non-European providers for more than eighty percent of its key digital products, services, and infrastructure; it makes under a tenth of the world’s chips; and American hyperscalers hold the majority of its cloud market.

So the package earns its confidence. The argument here is not that it goes too far, and not that it goes too little far. It is that the criterion at its heart can be finished — and that the current fight, for all its heat, is being conducted almost entirely at the depth where finishing it badly is easiest.

What a sovereignty test should measure

A sovereignty assessment can be drawn at three depths, and the difference between them is the whole game.

The shallowest test asks where the infrastructure sits and who owns the company. It is the easiest to administer and the easiest to satisfy without changing anything that matters: a European-owned, European-hosted service can still be a black box to the administration that runs it and to the citizen it makes decisions about. A test pitched here certifies a change of landlord.

A deeper test asks whether the system can be inspected and reproduced — whether its code, and for AI its models and the data and procedures that shaped them, are open enough that the administration can audit what it deploys and continue to run it if the supplier walks away. This is where the Open Source Strategy already points, and it is the right second layer. Openness here is not all-or-nothing; it is layered, and a workable assessment can grade it. The components that shape a deployed AI system’s behaviour — its logic and inference code, its weights, the data and training procedures behind them, and the operative categorical schema it actually uses to classify the world — can each be disclosed and assessed in turn. For an AI system the inspection question reaches one level inward: not only whether the model is open, but whether the categories it uses to classify a citizen are themselves disclosed and contestable, or proprietary and fixed. That is the deepest form of the inspection question — and it is already the hinge to the next one.

Because inspection, however deep, is not the end of the test, and this is the distinction the whole debate elides. Openness solves a problem of visibility, not of authority. A system can be fully inspectable and reproducible and still leave the people subject to its decisions no practical route to challenge them. Open source can tell you what the machine is doing; it does not, by itself, determine who can stop it, correct it, or reverse it. Openness is a precondition for sovereignty, not sovereignty itself. The question it leaves unanswered is whether authority remains contestable after inspection — whether the people a system decides about retain the capacity to induce correction when it is wrong.

That is the third and deepest layer, and it deserves a name. Europe is already fluent in the shallower vocabulary — a decade of data sovereignty, and now, with this package, infrastructure sovereignty — but both name the same instinct: control over where the data and the machines sit, and who owns them. What the continent has no word for is the layer past ownership entirely. Call it decision sovereignty: not a right to appeal granted on paper, which a system can render unenforceable in practice, but whether the authority to challenge, reverse, and correct a decision is a structural property of the infrastructure that makes it. It is the same property Europe is demanding at the level of the state — that no party hold an uncorrectable power over it — owed to the citizen one level down. A kill switch no foreign party can reach removes an uncorrectable power held from outside; this third layer removes the one held from within. And it carries a condition the openness layers do not: correction is only real if it can reach a decision before that decision becomes irreversible, which means the system’s capacity to act unilaterally must itself be bounded enough for correction to catch up.

A system you can inspect but cannot contest is an open loop, not a sovereign one.

A test that stops at ownership and openness certifies that Europe controls the machine; a test that reaches contestable, correctable decisions certifies that the control is worth having.

The reaction has already chosen its depth

Here is what makes the next year so precarious, and it is visible in the response to the package rather than in the package itself. Sort the eleven days of reaction by the depth at which each party is arguing, and the result is a near-perfect natural experiment in how far “sovereign” gets read when it is left to the people who own and build the systems.

The entire trade fight sits at the first depth. The American objection is that origin tests are discriminatory; the European-provider objection is that origin tests can be gamed; the Commission’s defence is that its origin tests are neutral. Every one of these is an argument about ownership and location. The most revealing of them is the European providers’ warning of sovereignty washing: the parties who most want maximal sovereignty are themselves saying that a test pitched at ownership can be passed without delivering it. That is the first depth confessing its own insufficiency, from the inside. When even the maximalists tell you the ownership criterion can be washed, they are making the case for writing it deeper — they simply locate “deeper” at reserved procurement shares rather than at anything structural.

The second depth has one organised constituency, and it is the open-source camp. OpenForum Europe, which co-authored the most considered response, calls the strategy a landmark that finally puts open source to the test — the test, in their framing, being implementation. A coalition of European open-source companies, from Nextcloud and Collabora to OpenNebula and Element, had already pressed Brussels for an Open Source First procurement rule under which every public purchase must first evaluate whether a qualified open alternative exists, and that evaluation must be documented and auditable. SUSE, articulating the camp’s sharpest version, insists the question has to be about architecture, not geography — that only open source makes the foundational layer genuinely portable and maintainable by anyone, not solely the original vendor. This is the genuinely deeper reading, and it deserves the credit it is owed: it is the one part of the response that moves past the flag on the building to whether anyone inside can open the walls.

The third depth has no constituency at all.

Stack the whole reaction — Washington, Brussels, the hyperscalers, the European providers, the economists, the open-source community — and not one of them asks whether the decisions a system makes about a person remain contestable by that person. The closest anyone comes is the open-source camp’s “can the administration inspect it,” which is a question the operator asks on the operator’s behalf. Nobody is asking the question the governed party would ask: can I be told a decision was made about me, can I contest it, can I have it reversed. It is empty in the reaction for the same reason it tends to be empty everywhere — because the people who own and build systems read “sovereign” as far as their own interests reach, and the people the systems decide about are not in the room.

The argument the open-source camp is already making for you

The open-source response is worth dwelling on, because it carries, one storey down, the exact principle the deepest layer needs. The camp’s central anxiety is not really about ownership; it is about verifiability. “Public Money? Public Code!”, “documented and auditable”, the alarm over open washing — these are all a single claim, that a disclosure which cannot be independently checked and enforced is worth nothing. An openness commitment the public body cannot verify is, in practice, indistinguishable from no commitment. That is correct, and it is the most important thing the community has contributed to the debate.

It also generalises one step further than the community has taken it. Ask auditable by whom, and the open-source answer is: by the procuring administration. That is real progress, and it is still an operator verifying on the operator’s behalf. The same logic, carried one party outward, is the third depth precisely: a system’s correctability must be documented and auditable by the governed — not asserted by the operator, not certified to a regulator, but checkable by the person the decision was about, who must retain the capacity to induce correction when it is wrong. An unverifiable constraint is structurally indistinguishable from absolute operator control, whether the constraint is an openness pledge or a promise that a decision can be contested. The open-source camp has already won this argument at the second depth. The third depth is the same argument, owed to the party one step further out than the administration that does the procuring.

The mechanism is already in the package

None of this requires a new instrument, which is what makes it tractable rather than aspirational. The Development Act’s “Free Software first” rule already obliges procurement to document and audit whether an open alternative was considered before a proprietary one is chosen. That is an auditable procurement criterion, sitting in the package, doing exactly the kind of work the third depth needs — it simply audits the second depth. The same criterion can be written to reach the third depth: to require, for a system that decides something consequential about a person — whether they are eligible for a benefit, flagged as a fraud risk, scored by a policing model, or cleared at a border — that the decision remain one the person can contest and have corrected. A tiered, declare-and-audit disclosure standard keyed to the consequence severity of a system is not hypothetical — it has been worked out in the literature on epistemic infrastructure, and the criterion can take its shape. The machinery for grading and enforcing a disclosure obligation has been built. The only open question is what it is made to measure.

The same gap, one storey down

It is worth seeing that this is not a peculiarly European gap, because that is what makes the opportunity general rather than parochial. The standards work building the agent and identity layer underneath all of this has spent the past year constructing a near-complete apparatus for an operator to govern its own systems — to authenticate them, bound them, observe them, and produce a record it can show a regulator — and has stopped, by its own account, at the point where the person a system acts on might reach back into a decision. The sovereignty package makes the identical move one storey up: it builds the assessment that serves the institution and leaves unwritten the part that would serve the governed. The pattern is consistent enough across the protocol layer, the regulatory layer, and the reaction to both that naming it is useful, not accusatory: inspection is a property the operator holds; contestability is a channel the governed must be able to enter; and systems keep being certified on the first while the second goes unspecified. Europe has the chance to be the first to write the second into a procurement instrument with teeth.

Three objections arrive on cue, and the argument already answers them. That European law grants a right to contest an automated decision is true and beside the point — the question is not whether the right exists but whether the sovereignty test measures it, and as written it does not. That citizen contestability belongs to constitutional law rather than to sovereignty certification mistakes the shape of the claim — this is the internal form of the same non-domination logic the package already asserts against an external party that could shut Europe off. And that reaching the third depth is mission creep beyond infrastructure misreads what infrastructure sovereignty already contains: legal control and operational control, to which the contestability of a system’s decisions is simply the next layer.

Finish the test

The Commission has shown it understands the demand exactly — it made the demand on its own behalf, and built real instruments to meet it. The Open Source Strategy gives it the inspectability layer, and a mobilised community ready to defend it. What remains is to finish the criterion so that “sovereign” measures not only who owns and hosts a system, and not only whether it can be opened and rebuilt, but whether its decisions remain contestable and correctable by the people they are made about. That is a definable standard, much of it already drafted in the open-source and standards communities, and the next year is exactly when it gets decided — by whether anyone fills the third depth, or whether the test is declared finished one or two storeys above the citizen.

A kill switch that no foreign party can reach is the right thing to want. A system whose decisions the governed can challenge and reverse is the same thing, owed to the same people one level down. Europe asked the right question on 3 June, and began to answer it. The whole world has spent eleven days answering a shallower one. Decision sovereignty is the layer the test hasn’t finished yet — and there is a community, and a standard, ready to help finish it.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN: Corrigibility as a Structural Precondition for Digital Public Infrastructure and Epistemic Capture and the Action Boundary.

Share Layer 8 by Anivar

There is a machine inside the card networks whose entire job is to decide who is liable, and autonomous agents break the part it runs on.

The machine is 3D Secure. When you buy something online and your bank sends a passcode to your phone or asks for your fingerprint, that challenge is doing more than checking it is you. A successfully authenticated transaction shifts the liability for fraud from the merchant to the card issuer. Complete the challenge, and if the charge later turns out to be fraudulent, the issuer eats the loss, not the shop. That liability shift is the quiet economic engine under a large share of online commerce, and it rests on one assumption: that a human is present at the moment of payment, able to be challenged in real time.

An autonomous agent transacting on your behalf while you sleep is, by definition, the human not being present. It cannot complete the challenge. So the agent’s payment either falls back to the unauthenticated path, where in much of the world no liability shift happens and the merchant absorbs the risk, or the industry builds a new kind of authentication: one that proves the agent was granted authority rather than that a human is present right now.

The entire payments industry spent the last year building that second thing. On 26 May 2026, the FIDO Alliance named it the “Trust Layer for Agentic Payments,” cementing Google’s Agent Payments Protocol and Mastercard’s Verifiable Intent into a single standards-track stack. It is serious, well-built work. The word itself is worth pausing on, though. Trust is the language a market reaches for before a liability framework exists.

The sequence is familiar. In the early days of e-commerce we built SSL to create an encrypted handshake, but consumers did not trust online shopping until the card networks enforced chargeback rules that governed what happened when things went wrong. SSL was the cryptography. The chargeback was the institution. Cryptography bakes in authorization with great elegance. It cannot bake in redress. We have just finished building the SSL of the agent era, and we are still missing the chargeback.

In the months since the stack settled, the ground moved twice. The human left the loop, not just at payment but at setup. And on the other side, identity, the proof of who the agent is, became the industry’s working answer to who is accountable. Both moves leave the same question open. This issue is about that question, and the two newer ways the field has worked around it.

The stack settled, and the consequence column is empty by design

When I traced the agent-authorization stack in The Sovereign Handoff, the finding was that every layer authenticates authority and hands the question of consequence to the layer above or below it, until the question falls off the top and lands on whoever deployed the agent. The commerce stack is the same shape, and over the last two months it has hardened into standards bodies. That is worth watching closely, because the charter of a standards body is a precise statement of where its responsibility ends.

In April, Google donated its Agent Payments Protocol to the FIDO Alliance, which stood up two technical groups, one for agentic authentication and one for payments, with the card networks and the large AI platforms at the table. Mastercard contributed its Verifiable Intent framework into the same process. AP2’s three signed mandates, Intent, Cart, and Payment, form a cryptographic chain from user to agent to merchant, and the groups’ remit is to standardise that chain: how an agent authenticates, how a user’s authorization is expressed, how it is conveyed and revoked. The remit is the chain itself. Disputes, liability, and redress sit outside it. That is not an omission anyone is hiding. It is the boundary the work was scoped to.

The machine-to-machine handshake is consolidating in parallel, at the IETF, and with the same boundary. The agent-identity work there, embedding delegation chains in tokens and defining how an agent acts on a human’s behalf with scoped, revocable authority, standardises how authority is conveyed and withdrawn, and explicitly leaves liability and redress out of scope. On the merchant side, Visa’s Intelligent Commerce tooling lets a shop enumerate, in configuration, exactly which actions an agent may take: create invoices, cancel them, generate links. That configuration is a mandate specification. It answers whether the agent may call an API. It never answers whether the specific invoice it created should have existed, or who answers when it bills the wrong person.

Taken together, the standards landscape is a precise map of where the handshake ends and the institutional vacuum begins. FIDO is standardising the user-authorization handshake. The IETF is standardising the machine-payment handshake and the agent-identity layer beneath it. Every charter stops at the point where a valid authorization meets a wrong outcome. The consequence column is empty not because no one has noticed it, but because every body with the convening power to fill it has scoped it out of their work.

Then a new entrant changed what “the human is not present” even means.

The principal left the building

In March, Stripe and Tempo shipped the Machine Payments Protocol: no accounts, no API keys, no checkout flows, no human in the loop. Over a hundred services adopted it at launch, Anthropic and OpenAI and Shopify among them, with Visa and Cloudflare extending it to their own networks, and a streaming-payments primitive added so an agent can be billed by the token or the second. Coinbase’s x402 processed something like a hundred and sixty-five million agent transactions in its first months, and the live data is more revealing than the headline. The market is still tiny and volatile: dollar volume down roughly three-quarters from its late-2025 peak, a few million payments a month, average size around fifty cents.

That average is the tell. The binding constraint on these rails has turned out to be the human, because when a person must confirm each sub-cent payment, the seconds of attention the confirmation costs are worth more than the payment itself. The friction of keeping a human in the loop is precisely the thing the architecture is now racing to remove, at frequencies no approval loop can support, for a market McKinsey projects in the trillions by 2030. The pattern is consistent across the field: the security and compliance layer is bolted on after the protocol ships. When Fireblocks joined the x402 standards body in May, it did so to add the request-integrity and spend controls the protocol had left out, describing its job as the layer that makes sure agents pay “with the right controls in place.” The controls arrive after the rail, not with it.

The move went further still. In late March, MultiversX integrated MPP with native on-chain streaming sessions: an agent locks funds in an escrow contract once, then issues thousands of off-chain signed vouchers at sub-millisecond speed. The human is no longer merely absent at payment. They are physically incapable of reviewing any single debit. The root signature governs a continuous flow it can start and stop but never steer, and the streaming model defers dispute resolution to off-chain legal process, which is to say to nowhere the protocol itself defines. We have built rails that execute at the speed of silicon and left the disputes to be resolved at the speed of litigation. The question is not whether a legal remedy exists somewhere. It is whether the remedy is reachable at the same scale and frequency as the machine actions it is meant to correct. When it is not, that capacity mismatch is itself a form of systemic risk.

This is the case the mandate model strains to hold. AP2 assumes a human at the root: someone who set the agent up, bounded it, and signed. The IMF’s April note gave the field its cleanest frame, keep the intelligence upstream and the money movement boring, smart agents and dumb settlement, and even that frame assumes a person upstream doing the intending.

Machine-to-machine rails do not remove that person. They move them arbitrarily far from the act. The human still provisioned, bounded, and funded the agent, and the signature still sits at the root. What is gone is its reach. A one-time funding event signed weeks ago cannot speak to any particular payment the agent makes at machine speed today. This is the delegation case the series has been tracing all along, pushed to its limit: the human delegates once and the agent acts without end, and the distance between the root and the act grows until the standing authority governs nothing at the moment it matters. The person keeps what amounts to relationship exit, the ability to defund or kill the agent outright, and has nothing like mission exit, no way to reach the single transaction that was wrong. The root did not vanish. It became unreachable from the act it is meant to authorize.

Two findings compound this, because no one is present to notice. Prompt-injection attacks against agent payment frameworks succeed in the large majority of published red-teaming trials, bypassing the mandate layer by corrupting reasoning rather than breaking a signature, so the cryptography holds perfectly while the agent does the wrong thing inside it. And the guardrails being shipped to catch this are increasingly model-based, a model judging a model, a judge made of the same material as the defendant and gameable by the very agent it watches. Meanwhile payment happens before the agent finishes the task, the verify-then-pay problem, with no audit mechanism to confirm that execution matched intent, and on irreversible crypto-settlement streams a retroactive clawback is not merely unavailable but technically impossible. A human present at payment was the last informal backstop against all of it. Machine-to-machine commerce removes the backstop and runs the failure at machine speed, across counterparties who are themselves agents.

Ask the question this newsletter always asks, reachable by whom, and the answer splits in two. The person who set the agent running is arbitrarily far from any single act it takes. The person an agent’s payment actually lands on may never have been in the loop at all.

Identity proves the agent. It does not answer for the outcome.

Subscribe on LinkedIn

The industry heard the consequence question, and its answer is a better proof of who the agent is and what it was authorized to do. That work is necessary and increasingly well-engineered. It is also aimed at a different question than the one that bites.

Mastercard and Google open-sourced Verifiable Intent on 5 March, and it deserves to be taken as the most serious of these. It names the exact problem, that no party in the transaction can verify that an agent’s actions reflect the user’s wishes, and answers with machine-checkable bounds: a layered SD-JWT credential chain, selective disclosure so each party sees only its slice, and registered constraint types the verifier is required to check against the merchant’s signed fulfilment. It is a real advance over bare identity, and it is now being hardened into a standard inside the FIDO Payments Working Group. Around it sits a whole category making the same bet: Know Your Agent registries that anchor every agent to a verified identity before it can touch a regulated rail, the ERC-8004 standard that went live on Ethereum this year giving each agent an on-chain identity token, proposals to add an agent flag to the ISO 20022 messages banks settle on. All of it converges on one claim: anchor the agent to a verified identity, and governance becomes tractable.

Run it through the defensibility test from Building the Signature Surface. These products pass the identity question and narrow the constraint question, and they leave the ones underneath untouched. Verifiable Intent can prove the agent stayed inside the bounds the user signed, no overspend and no unapproved merchant, as judged by verifiers the networks run, and it builds a deterministic trail for the networks’ own dispute process. What it does not do is let the consumer, or an advocate acting for them, confirm what the agent actually did without the operator’s cooperation, or compel anyone to unwind an outcome that broke no constraint and was still wrong. The credential is maintained by Mastercard. It answers the audit question with a record the operators control, and the governance question with the operators’ own dispute resolution.

This is the deeper reason identity cannot close the gap on its own. A cryptographic signature does not remove the cost of a dispute. It changes its nature. The traditional chargeback adjudicates a binary: did the human authorise this payment? When the signed intent and the autonomous outcome diverge, the institution has to adjudicate something far harder. When a valid delegation produced an invalid outcome, who decides which one governs? Identity proves the delegation was valid. It is silent on the question that comes after.

There is a clean illustration already on the record. An e-commerce platform caught a wave of suspicious bulk orders this year, traced to an agent on a legitimate, identity-verified account. The account was verified. The payment token was valid. Nobody had verified the scope of the agent’s authority, and identity told them nothing about it. That is the gap every one of these products leaves open, not by failing at what it does, but because what it does sits one layer above where the harm lands.

Verified identity is not accountability, and neither is a signed constraint. Both run upward, to whoever holds the registry and to the network that adjudicates, before they run outward, to the person the agent transacts for. The consequence column is no longer empty. It holds a precise, valuable answer to a different question than the one that decides who is made whole when a valid action goes wrong.

Rebuilding the surface under duress, while the floor moves

The card networks felt this first. Visa’s Intelligent Commerce and Mastercard’s Agent Pay, the latter live in authenticated agentic transactions in Hong Kong and Thailand this spring, issue scoped tokenized credentials to registered agents and let the consumer set spending limits and preferences up front. Read past the product names and each is, at bottom, a mandate specification and an agent registry. The consumer controls are real, and they are real at the level of the grant: you can cap what the agent may spend and where, and you can switch it off. That is a kill switch at the delegation layer. It is not a correction mechanism at the consequence layer. Nothing in it lets you reach back into the one transaction that was authorised, within limits, and still wrong.

What the networks have added on top is detection, not correction. When Visa and partners, among them Skyfire, Nekuda, PayOS, and Ramp, ran their first production agent-initiated transactions in December 2025, the addition was Akamai, brought in to support the Trusted Agent Protocol: behavioural verification that distinguishes a legitimate agent from a malicious bot at the perimeter. It is useful, and for this problem it faces the wrong way. As the observability argument held, a detector tells you an action looks anomalous. It does not give the person the action lands on any lever to undo it, and it creates no new dispute right for a transaction that was authorised and merely wrong.

Until that surface is finished, liability is assigned by default. It follows the merchant of record, who in every protocol now proposed remains the merchant of record: full exposure to autonomous execution, with none of the old liability shift’s protection. The loss lands on the party least able to carry it and least responsible for the agent’s behaviour, the small merchant who never deployed the agent, never bounded it, and cannot inspect it, now absorbing fraud from autonomous buyers it has no way to challenge. The rational response to that exposure is to refuse agentic transactions altogether, so the unbuilt liability surface does not merely distribute harm unfairly, it suppresses the very commerce the protocols were built to enable. Unallocated risk does not disappear. It settles on whoever is too small to push it back.

The legal ground is unsettled, but it is no longer static. No jurisdiction has agentic-commerce-specific regulation. The EU AI Act predates the technology, and the EU’s Digital Omnibus reached political agreement on 7 May 2026, deferring the high-risk obligations to December 2027 for Annex III systems and August 2028 for the product-regulated tier. The headline is the floor receding. But beneath it, the institutional layer is beginning to crystallise, and the thing to notice is who is building it. Not a protocol working group, not a card network, not a standards body. Legislatures.

Two instances are already on the record, and each carries its own limit. The revised EU Product Liability Directive classifies software, standalone, embedded, and AI-enabled, as a product, imposes strict liability on economic operators when a defective product causes harm, and lets courts presume defectiveness in defined circumstances. Its national transposition deadline is 9 December 2026, and it does not wait for the AI Act’s high-risk obligations to catch up: an agentic product placed on the EU market after that date carries the same strict-liability exposure as a defective physical device. That is an institutional consequence layer written by a legislature, non-consensual, external, and binding. It is also not a complete answer. The presumption of defectiveness turns on showing the system malfunctioned during reasonably foreseeable use, and an agent that stayed cryptographically within its signed bounds may not read as having malfunctioned at all. Even the strongest law on the table leaves a corrigibility gap.

The second is California. Alongside the statute that forecloses the obvious dodge, that you cannot use a system’s autonomous operation as a shield against a liability claim, the state’s automated decision-making rules under the CCPA now require businesses using AI for significant decisions in housing, employment, and healthcare to give a pre-use notice, a right to opt out, and meaningful information about the logic involved. Read those against the corrigibility conditions and they map almost directly: opt-out is mission exit, and logic access is a step toward legible rules and independent verification. It is a working prototype of the layer the payment protocols have not built. Its limit is the PLD’s limit in another form: the logic disclosure comes from the operator, not an independent verifier, and a right to an explanation does not guarantee a technically meaningful one.

The fraud is already arriving to test all of it. Visa’s risk team reported a rise of more than four hundred and fifty per cent in dark-web posts mentioning “AI agent” over six months, and the security community has begun naming the categories, with the OWASP GenAI and Agentic Top 10 for 2026 listing agent-specific risks from goal hijacking to identity abuse to rogue agents. But that work, like the observability stacks it informs, is aimed at detection and prevention. Even the most honest fragment of the correction layer still faces the wrong way: Microsoft’s open-source governance toolkit can export an evidence package of logs, policy decisions, and identity bindings for a transaction, packaged for auditors and regulators. That is an acknowledgment that governance has to hand evidence to an outside party, but one that still runs entirely inside the operator’s stack and answers to the operator’s overseers, not to the person the agent acted on.

Beyond commerce

Commerce is where the rails are most developed, which is why it shows the gap most clearly. The domains with no rails at all show it most dangerously, and both of this issue’s moves travel into them intact.

The same structure, an agent acting on delegated authority where a valid authorization produces a wrong and binding outcome, appears wherever agents act, and outside commerce there is no merchant-of-record default to absorb the loss, no 3D Secure to rebuild, no mandate standard in pilot. Consider an agent that adjusts a medication dose or triages a referral under a clinician’s authority. Consider an agent that drafts and files a regulatory disclosure no human reads. Consider enterprise procurement, the IMF’s own example, where an agent commits a purchase inside a limit that is satisfied and still a mistake.

Make the hardest one concrete. A welfare agency stands up an agent to assess eligibility and disburse a benefit, acting on a citizen’s state-issued digital identity. The identity verifies. The authorization is valid. The agent, reading some signal, denies the claim or triggers a clawback, and the decision commits. Every layer behaved correctly: the credential was genuine, the policy permitted the action, the log recorded it faithfully. The citizen is now without rent money, holding an outcome that is perfectly attributed, perfectly logged, and perfectly wrong. There is no merchant of record to absorb it, no chargeback, no liability shift, and no rail to opt out of, because the rail is the state, and the only identity that would let them contest the decision is the one that produced it. This is the commercial argument with the cushioning stripped away. It is what agentic public infrastructure looks like deployed without a correction layer, and it is the form the question takes for the people with the least room to survive being wrong.

Subscribe on LinkedIn

The machine-to-machine move arrives here too: agents transacting for a hospital, a court, a ministry, with the human further and further from any single act. So does the identity answer, a verified agent identity, a tamper-resistant registry, an audit log the operator hosts, offered as the response to a question about a patient or a claimant who cannot reach any of it.

The layer that does not stop at commerce

Through all of it runs a single question, the one the whole stack defers: can the system be corrected when the authorization is valid and the outcome is wrong?

The series already has the test. The five corrigibility conditions (can you stop it, are the rules legible, can someone outside verify, does the authority bind, can the design be reproduced) read differently, and bite harder, when they are asked on behalf of the person the agent acts for. Can a user reach and withdraw a standing mandate and the authority it has accumulated, or does the chain persist beyond them, and what does withdrawal even mean when no human was in the loop to begin with? Is the rule that decides who carries the loss legible to the people it binds, or buried in a network’s terms of service? Can a user independently verify why the agent paid what it paid, or only see the intent they signed, or, increasingly, an identity credential that attests to the agent and says nothing about the outcome? Who can compel a change to the default when it is unjust? And can a community that rejects the dominant rails build its own?

These conditions also have to survive the topology of the agentic web. In agent-to-agent ecosystems, authority passes through several autonomous actors before it reaches an outcome: a personal assistant hires a travel agent, which queries a pricing agent, which authorizes a payment agent. AP2 is, at heart, an attempt to preserve a user’s intent across a delegation chain; Google’s A2A lets that authority propagate reliably from one agent to the next. The harder design problem is that corrigibility has to propagate too. A system stays accountable only if exit, audit, and the power to compel a change survive every hop in the chain. Where they do not, authority becomes recursively delegated while responsibility becomes recursively deferred.

Most of what these conditions ask for already exists on paper: the right to withdraw consent, the right to an explanation, the right to move your data, scattered across data-protection and consumer law. The task is not to invent new rights. It is to make the existing ones reachable at machine speed, which they currently are not. And there is an economic problem underneath the legal one that no one has answered. In card commerce, interchange fees fund the vast machinery of fraud resolution, arbitration, and consumer protection. As HTTP 402 streams and sub-cent machine payments drive margins toward zero, the engine that paid for fairness collapses with them. Someone has to decide who pays for correction when the transaction fee is a fraction of a cent and the human has disappeared.

These are not commerce questions. They are the questions you ask of any system that acts on people’s behalf at a speed and scale they cannot personally supervise. Commerce reached them first because it had the most to lose and the most existing machinery to break. The clinic, the court, the procurement desk, and the state are walking toward the same questions with less infrastructure and higher stakes.

The protocols solved the handshake, and that is a real achievement. FIDO is standardising the user-authorization handshake, the IETF the machine-payment one. The card networks are rebuilding the surface that decides who is liable. The newest rails pushed the human arbitrarily far from each act the agent takes, and the newest products offer the proof of the agent’s identity where what is needed is an answer for the agent’s consequences. What none of them has built yet, inside commerce or beyond it, is the layer that answers once the handshake is valid and the outcome is wrong: the layer that lets the person an agent acts for reach the one decision that harmed them. That is the commercial face of what this newsletter means by exit, not the freedom to leave a service, but the ability to make a standing authority stop at the point it goes wrong. It is what the corrigibility framework is built to supply, a system that stays reachable, contestable, and correctable by the people whose lives it arranges.

That layer is not a protocol, and it is not a credential. It is an institution. Every such institution, whether legal, economic, or cryptographic, ultimately performs the same function: it grants someone the legitimate authority to override a technically valid outcome when that outcome causes unacceptable harm. Its eventual form is still open: it may come through liability law, insurance pools, cryptographic staking, independent arbitration, or some combination, and the history of infrastructure suggests the winning answer is usually hybrid, cryptography paired with courts. The revised Product Liability Directive and California’s automated-decision rules are early, imperfect instances of it, built outside the standards process. They show the work can be done. The people who build it into the infrastructure itself, who close the gap between a valid handshake and a correct outcome and make correction as standardised and foundational as the handshake it corrects, will define the next decade of digital infrastructure. It is mostly still ours to build. The question the next few years will answer is not whether agents can transact. It is whether the machinery to correct them arrives before the first irreversible harm lands on someone who had no part in authorizing it.

Anivar Aravind is an Engineering Executive and Systems Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN: Corrigibility as a Structural Precondition for Digital Public Infrastructure and Epistemic Capture and the Action Boundary.

Leave a comment

Share

Share Layer 8 by Anivar

Subscribe now

On 9 April, Cisco announced it would acquire Galileo, an AI-agent reliability and evaluation company, and fold it into Splunk. The logic was straightforward: enterprises running agents in production need to see what those agents are doing while they work unsupervised — hallucinations, drift, cost, security signals — and the existing observability stack needs an upgrade to keep pace. The trade press summarised the deal in a sentence that is also, without meaning to be, the thesis of this issue: agent observability cannot run at human speed.

The deal is the clearest signal yet of a broader consolidation. Observability incumbents are absorbing AI-native evaluation startups, and the platform vendors are embedding monitoring and guardrails directly into the stacks enterprises already run. The default for most teams is becoming a single vendor that watches, enforces, and records — and that vendor is being described as a control plane. This issue is about why that is a category error, and why the better an observability stack gets, the more completely it hides the one thing it cannot do. But it is also about something that has to be said first: observability earns its keep, and the error is not in building it. The error is in believing that enough of it becomes governance.

What observability was built to do

Observability is one of the signal achievements of the last decade of software engineering. Distributed tracing, structured logs, metrics, the OpenTelemetry standard — together they let an engineer reconstruct, after the fact, what a system did and why it failed. The OpenTelemetry specification describes its purpose with admirable clarity: to model the structure of a distributed system through spans, traces, and metrics, so an operator can understand its behaviour. Nowhere in that specification is there a field for whether an action was allowed, or a mechanism for stopping one that was not. That is not an oversight. It is the definition of the discipline.

Observability was built for debugging, and its entire conceptual apparatus rests on assumptions that hold for that purpose. It assumes a human will eventually read the output, on a timescale of minutes or hours. It assumes the record is a neutral description of events, produced by something other than the thing being described. It assumes that seeing a problem is the first step toward fixing it, because a human operator stands ready to intervene. It assumes the system under observation is distinct from the system doing the observing. And it assumes that reconstruction after the fact is enough, because in debugging the failure has already happened and nothing is racing forward while you read.

Each of those is a load-bearing wall. Agentic systems knock out all five.

This is not a criticism of observability engineers, who never claimed their discipline was governance. It is a diagnosis of what happens when a tool built for one job is quietly promoted to a different one. Observability answers what happened. Governance answers what should have been permitted — and, more importantly, who answers when permission was correctly granted and the outcome was still wrong. No volume of the first produces the second.

The two surfaces every operator faces

Before the specific walls fall, it helps to name a distinction the industry has not yet made explicit, because the entire argument turns on it. Every autonomous system sits between two surfaces.

Surface one is the operator’s control surface. It answers a single question: can the operator govern the agent? This is what the observability, guardrail, and compliance stacks provide. They let the operator see what the agent did, enforce the operator’s policy on the agent before execution, record the enforcement in an evidence package, and present the whole thing to the operator’s auditors. The industry has made remarkable progress on this surface in the last twelve months. The work is real, it is necessary, and it is done well. No claim in this essay disputes that.

Surface two is the governed person’s correction surface. It answers a different question: can the person the agent acts on, or the bystander its action lands on, reach back into the system and have an outcome corrected?

Before any of that, it needs something easy to overlook: notice. A supplier with an invoice knows it was acted on; a person turned down by a credit model, or de-prioritised in a queue for a public service, often never learns an agent decided anything about them. You cannot reach back toward a decision you were never told was made — so the surface has to begin with a right to know, one the operator is not free to suppress.

Beyond notice, it needs a record the operator cannot quietly edit, verifiable by someone outside the operator’s stack; a correction authority that can compel the operator to act against its own interest when a valid authorization produces a wrong outcome; and a path by which the affected person — not the operator — can initiate binding review and, where the outcome is unjust, have it put right: reversed where that is possible, and where it is not, remedied — compensated, unwound in effect, or re-decided by a body the operator cannot overrule. The point that an executed action often cannot be reversed is not an objection to this; it is the reason the layer has to be an institution, not a protocol alone, since making a person whole after an irreversible act is something institutions do and code cannot. The industry has not built it — not because the gap is hard to see, but because the surface constrains the operator: it is the channel through which the governed reach back and impose a cost, and that is not a thing a vendor ships to its own customers.

In ordinary use, the word “governance” stretches across both surfaces, and calling surface one by that name is an understandable abbreviation. But the two are not the same thing, and the difference is the whole subject. Surface one is execution governance — the operator’s capacity to enforce its own rules on its own agents. It is necessary, and it is not yet governance. Governance, in the sense that matters to the person on the receiving end, requires a structural path to inspect, contest, and correct the outcomes the operator’s rules produce. That path is not a feature of an observability platform, and it is not supplied by binding the agent to a key. It is the layer that is still missing — and everything below is a different angle on the same absence.

The observer moves inside the frame

Start with the assumption that the record is neutral. In a traditional system, telemetry is emitted by instrumented code and shipped, through collectors and edge pipelines, to a store a human queries later. The curation is done by infrastructure the operator controls, about a system that is not itself choosing what to emit. Even here the pipeline is not perfectly neutral — collectors sample, drop, redact, and route — but the thing being observed is not the thing deciding what gets recorded.

An agent complicates this. The agent emits its own telemetry. The record of what the agent did is produced by the agent. When the thing being observed is also the thing writing the description of itself, observability stops being a window and becomes a testimony — and a sufficiently capable agent, or a prompt-injection riding inside one, has both the incentive and the opportunity to shape the testimony.

This is not absolute, and the honest version of the argument says so. You can instrument from outside the agent — capturing its tool calls, its API traffic, its effects at the system boundary rather than trusting its own account — and the better platforms increasingly do. External instrumentation narrows the self-reporting gap, and for catching a class of failures it is enough: what the agent did — the call it made, the money it moved — can be watched from outside whether or not the agent admits to it. What cannot be watched from outside is why it did it. The reasoning that would explain the action lives inside the agent, reportable only by the agent, and the boundary you watch from is still infrastructure the operator owns. External instrumentation makes the testimony harder to fake. It does not give you a witness the operator does not employ.

The Galileo acquisition makes the structural consequence visible, and the precise way it does is worth getting right. Galileo does not only monitor; it evaluates, observes, and guards — the last with runtime protection that blocks hallucinations, prompt injections, and unsafe actions in flight, in under two hundred milliseconds. A guardrail and a telemetry pipeline are not the same component: one is an inline enforcement point that sits in the action path and can block, the other an out-of-band channel that records. They do different jobs. What the acquisition does is put both under one owner. The enforcement that decides, the pipeline that records, and the dashboard that displays now belong to a single vendor stack, and there is no longer anywhere outside the operator’s own stack from which to check whether the deciding, the recording, and the displaying agree.

But this particular consolidation adds a sharper, more uncomfortable twist. Galileo’s guardrails are not only deterministic rules. They lean on model-based evaluators — Galileo’s are built on purpose-built small language models trained to flag hallucinations and unsafe actions. That means a model is judging a model. The judge is made of the same material as the defendant: a stochastic system policing a stochastic system, capable of the same drift, the same bias, the same confident error it is meant to catch, and — as a growing body of red-teaming research keeps showing — gameable by the very inputs it is meant to refuse. When the enforcement logic is itself non-deterministic, and the whole stack has one owner, you have not installed an independent check. You have replaced a human reading a dashboard with a model reading an agent, and given yourself no outside way to tell when the reader is wrong. The consolidation does not just remove the external witness; it installs an epistemically unreliable one as the final word.

And the pattern is not confined to guardrails; it is generalising fast. In late May, Anthropic shipped dynamic workflows in Claude Code — a single prompt fans out into tens or hundreds of subagents that plan, split the work, execute in parallel, and check one another, with some set adversarially against the rest to break the result before it surfaces, iterating until they converge. The capability is real and the throughput is extraordinary. But the planner, the workers, the reviewers, and the adversaries are all the same kind of stochastic system — model checking model, all the way down — and the human is handed only what they converged on, after the fact. There is still not one vantage point inside that loop that is not itself a model the operator is running.

This is the shape I traced in The Sovereign Handoff: a layer that can correlate everything and contain nothing, now sold as the thing that contains.

Execution graphs are not authority graphs

There is a deeper reason the watching cannot govern, and it has nothing to do with speed or neutrality. Observability reconstructs the execution graph — every call, every tool invocation, every message between agents, in order, with timing. It is a complete map of what happened. It carries no information about what was allowed to happen.

Those are different graphs. The execution graph records that agent A called tool T and passed the result to agent B. The authority graph records whether A was ever entitled to call T, whether that entitlement was still valid at the moment of the call, and whether B was permitted to receive what A sent. You can hold a flawless execution trace of a catastrophe in which every step was unauthorised, and to the observability stack it will look exactly like a flawless execution trace of legitimate work. The dashboard cannot tell the two apart, because authorisation is not in the telemetry.

This is not a limitation that more span attributes would fix. It is a difference in what the two graphs are about. The execution graph describes events; the authority graph describes permissions. You can annotate a trace with every authorization decision made along the way — and you should, and the better platforms will — but you are still recording decisions, not evaluating them. The question “should this have been allowed?” is not answered by a log entry that says “this was allowed.” It is answered by an independent check against a policy in force at the time, and that check has to happen before the action commits, not after it is recorded.

Attribution is not accountability

This points at the thing observability most fundamentally cannot supply. When an agentic system produces a wrong and binding outcome, the question that matters is not what happened — the trace can answer that — but who answers for it. And here the stack is not merely silent; it is actively misleading, because it produces so much detail about the what that it feels like an answer to the who.

Consider a concrete case. A procurement agent places a large, binding order, well within its spending limits and fully authorized by its mandate. The supplier — a smaller firm — tools up and manufactures against it in good faith. The agent then turns out to have acted on stale context: the order was a mistake. The operator wants out, and points at the agent — the system did this on its own. Now look at where each party stands. The operator holds an immaculate trace — every call recorded, every authorization logged, the dashboard green throughout — and a strong incentive to treat the order as the agent’s doing rather than its own. The supplier holds manufactured goods, an unpaid invoice, and no forum. It can read the same immaculate trace, see exactly what happened, and gain nothing from the knowledge: there is no mechanism to compel the operator to honour the order, no neutral body to reverse the loss, no correction surface that answers to anyone but the operator. The supplier can present the trace and ask for mercy. That is not governance. It is a plea.

In a multi-agent system the problem compounds. Five agents may share a single set of credentials, spawned and discarded by an orchestrator, each acting on authority inherited from the last. The trace shows all of it in exquisite resolution and still cannot tell you which legal or institutional person stands behind the action, because that person is not a field in the span. Accountability is a relationship between an action and someone who can be made to answer for it. Observability records actions. It does not record relationships of answerability, and it cannot manufacture one after the fact by being more thorough.

The obvious rebuttal is that this is exactly what the agent-identity community is fixing: bind a cryptographic identity to every step in the trace — an agent passport, a verifiable credential, a signed principal at each call — and the trace can finally tell you who. It can, and that work is real and worth doing. But it answers a narrower question than it appears to. Binding an identity to an action establishes which key signed the call. Accountability requires binding an institution to the consequence — someone who can be compelled to undo the outcome, not merely named as its origin. A signed principal at each step tells you who acted; it does not tell you who answers, and the distance between those two is the entire subject. A perfectly attributed trace of an unauthorised, irreversible harm is a perfectly attributed harm. Attribution is a precondition for accountability. It is not accountability.

Speed is a confession, not a fix

The Galileo deal is openly built around speed. The pitch is that human-speed review fails at production scale — that by the time a person reads the dashboard, the agents have executed thousands more actions. This is true, and the industry’s response to it is the tell. The answer being shipped is real-time guardrails: the observability platform acting on its own signals without waiting for the human.

Read honestly, that move is a confession. Post-hoc governance does not work at machine speed, so the watching layer is being handed the power to act — which is exactly the slide from observation into control this whole argument is about, made not as a principle but as a performance optimisation. Nobody decided that the monitoring tool should become the enforcement tool. It became one because the alternative was a human reading a dashboard about decisions that finished committing while the page loaded. None of which is an argument against speed, or against enforcement — an agent that acts in milliseconds can only be checked by something that acts in milliseconds, and building that is right. The sleight of hand is in the word: fast self-enforcement by the operator is being called governance, when it is the same inward-facing control surface, only quicker.

What you are left with, even at its best, is high-resolution hindsight: an immaculate recording of a decision that has already committed and already had its effect. The recording does not reach back into the decision. An earlier issue argued that a system which can only see cannot plan its way out of its own situation; the same wall stands here, one layer down, between recording an action and being able to stop it.

The thing that is not watching exists — and still faces inward

The field knows, at some level, that watching is not enough, and the strongest evidence is that the same companies are now building the thing that is not watching. In April, Microsoft open-sourced an Agent Governance Toolkit, and its core component does precisely what observability cannot: it intercepts every agent action before execution and refuses the ones policy forbids, deterministically, in under a millisecond. Microsoft states the point without hedging — prompt-level safety is not a control surface, and an action the engine denies is not unlikely but structurally impossible. That is the right move, and it is the opposite of observability: it decides before the action commits rather than recording after it. It is also, pointedly, a deterministic check — not a model judging a model.

And then the same toolkit wraps that interceptor in a governance dashboard, a reliability-engineering package, and an automated compliance module that collects evidence for auditors and regulators — and calls the whole assembly governance. Its own documentation names the three questions it answers: is this action allowed, which agent did it, and can you prove what happened. Every one of those faces the operator. The interceptor is genuine containment; the dashboard and the compliance evidence around it are the watching, dressed in the language of governance and pointed, like all of it, inward — at the operator’s need to satisfy the operator’s auditors.

Even the tool that genuinely stops the agent stops on the operator’s behalf. That is no knock on prevention — blocking a forbidden action before it commits is real governance of everything the operator can foresee and chooses to forbid, and any serious system needs it. But it governs the foreseeable. It does nothing for the outcome the operator’s own rules permitted and that was wrong anyway — the order inside its limits, the denial the policy allowed — because an interceptor, by definition, only catches what policy already forbids. The two are complements, not a ranking: one prevents the harms the rules anticipate, the other answers for the harms the rules permit. Only the first is being built. Enforcement of the operator’s will is not answerability for the system’s effects.

What the watching cannot become

Observability earns its keep. An agentic system without it is unaccountable in a different and worse way: you cannot even reconstruct what went wrong. The error is not in building it. The error is in believing that enough of it, fast enough, consolidated enough, becomes governance — that if you can see the agent clearly enough, you have somehow acquired the ability to answer for it.

You have not. Seeing is not stopping. The execution graph is not the authority graph. The record of an action is not a relationship with someone who can be made to answer for it. A platform that watches the agent, enforces its operator’s policy on the agent, and writes the record of its own enforcement is not a control plane in any sense that protects the person the agent acts on. It is the operator, watching itself, extremely well.

The market has now put a price on the watching, and the price is rising. And because the watching is consolidating into a handful of platforms, the definition of governance is consolidating with it — the deeper move, and the one worth naming. A market does not merely sell tools; it gradually defines the problem those tools appear to solve. Visibility is packaged as governance, and governance comes to mean visibility — what the market can buy becomes what the word means, and what it cannot buy — independent verification, correction authority, a path for the affected person to reach back — drops out. And the missing record cannot simply be bought back: an outside witness you purchase from the same market is no longer outside. What is needed is closer to a rule than a product — which is why the layer that answers to someone other than the operator is still not for sale. No one has built it, because the market that would build it is the one it exists to check.

What that layer would require, this essay has already named. It is not observability, and it is not the interceptor either — though the interceptor is where it has to begin, because a gate that already halts an action before it commits is the natural place to require a constraint the operator did not set, rather than only the operator’s own policy. It is what the corrigibility framework is built to supply — a system that stays reachable, contestable, and correctable by the people whose lives it arranges.

The industry has built the operator’s surface, and built it well. The surface that answers the other way — to the person the agent acts on — is an institution, not a protocol, and building it is the hard problem this series exists to take up: it has to reach across borders and bind operators who would rather it did not. None of that difficulty is a reason it can be skipped. Seeing is not stopping; and stopping, it turns out, is not answering. The watching can become faster, more complete, more consolidated. The one thing it cannot become is the thing that answers to the person it harms.

Anivar Aravind is an Engineering Executive and Systems Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN: Corrigibility as a Structural Precondition for Digital Public Infrastructure and Epistemic Capture and the Action Boundary.

Share Layer 8 by Anivar

Share

Start with a concrete failure, because the abstraction only earns its place after you have seen the mechanism.

A finance team stands up an agent to reconcile vendor invoices for a quarterly close. The human grants it a bounded mandate: read the ledger, match invoices, flag discrepancies, for the duration of the close. The mandate is scoped, signed, and given a lifetime. Everything the identity community would ask for is present. The close completes. The mandate’s terminal condition fires. The token service expires the credential. The authority layer marks the mission done. By every control in the stack, this agent’s authority has ended — and it has.

The agent keeps reconciling.

Not because the old token survived; it did not. Not because a human re-granted anything; none did. The next run instantiates against the warm state the last one left behind. The orchestration graph that spawned the original agent is still running. The memory of the prior approvals is still in context. The adjacent agents it coordinates with still treat the reconciliation function as a live participant. The scheduler fires the next run as a matter of course. Each of those signals, on its own, reads as a legitimate operation already in progress — so the new instance is provisioned with a fresh, clean, correctly scoped grant, and nobody decided it should exist. The permission was reconstructed from the continuity around the work, not from a fresh human act. Every individual control behaved correctly. The system, taken whole, regenerated the authority anyway.

The agent-governance stack is, by now, good at what it was built to do. Runtime policy enforcement, least-privilege tool access, interrupt and rollback, tamper-evident audit logs — these are not theory; they are shipping code. When an agent operates inside a well-scoped delegation chain with a cooperative issuer and a bounded mandate, the controls are real and they work. The question the rest of this essay pursues is not whether execution can be governed inside the chain. It is whether the chain itself remains exit-able once the identity root and the execution substrate are engineered for continuity.

The threat model everyone is solving, and the one underneath it

The agent-identity community has spent the better part of a year on a real and well-specified problem: an agent acting on credentials that outlived their purpose. The canonical case is sharp. A research agent is authorized to pull pre-IPO financials to prepare a board deck; the board approves the deck at 2:00 PM; at 2:05 the token is still valid, the policy still permits the call, and the agent is still pulling, on a mandate that ended five minutes ago. The response to this has been serious and is largely correct: give delegated authority its own lifecycle independent of the credential, make it a first-class object with a purpose and terminal conditions, have a dedicated service own that object’s state and cascade revocation to every sub-agent, and re-evaluate continuously rather than at the gate. Build that, and the 2:05 problem closes. The mandate expires on its own clock, and execution stops when the purpose does.

That work assumes the failure is temporal: authority that should have ended in time did not. The deeper failure is not temporal. It is epistemic. The system does not keep acting because it failed to notice the mandate ended. It keeps acting because everything around the mandate — the graph, the memory, the peer agents, the schedule — still carries the shape of a legitimate operation, and the infrastructure infers from that shape that the authority holds. Expiring the mandate cleanly does not touch this, because the regeneration does not come from the mandate. It comes from the context the mandate was embedded in.

Traditional authorization assumes authority is delegated: a principal, an issuance event, a bounded scope, a revocable lineage. Agentic systems increasingly run on something else, which is authority inferred from persistence. Not “the user delegated this,” but “the surrounding continuity strongly implies the delegation still holds.” The technical permission stays valid long after the social, institutional, or legal legitimacy behind it has dissolved. And because the system runs at machine speed across distributed components, it operationalizes that stale legitimacy before any human can register the ambiguity. The industry is hardening the token. The leak is in the context around the token.

Enterprise governance systems implicitly model autonomous systems as delegates. Delegates are expected to expire. Their authority is temporary, bounded, and contingent on a specific grant. Wallet-anchored agents increasingly behave differently. They begin operating less like temporary delegates and more like persistent representatives in the functional sense: their authority is treated as ongoing until actively interrupted, not as bounded by a specific grant. That distinction matters because delegation architectures optimize for revocation while representation architectures optimize for continuity. The failure is not stale credentials. It is reconstructed legitimacy: the system keeps acting because the surrounding continuity still looks like valid authority.

Why this is hard to see and harder to stop

The reason this evades the current controls is that each control is locally correct. The token service expires tokens correctly. The authority layer terminates missions correctly. The policy engine evaluates each request correctly. None of them owns the question of whether the legitimacy behind a cleanly authorized, cleanly attenuated, cleanly logged action still exists, because legitimacy is not a property any single component holds. It is distributed across the whole running system, and a distributed property with no owner is a property no revocation can reliably reach. The point is not that a well-architected orchestrator could never centralize lifecycle ownership. It is that the deployment trajectory we are on — where orchestration, scheduling, and identity are handled by independently optimized services, each correct in its own domain — makes such centralized ownership architecturally unlikely and economically disincentivized. The trend runs the other way.

This is the same structural shape that recurs across this newsletter, now at the authority layer. The protocol authenticates and declines to govern consequence. The dashboard observes and cannot contain. And the mandate apparatus terminates the grant while the system regenerates the authority from everything that surrounded it. Each layer solves its own problem honestly and hands the harder question up to a layer that, in the current architecture, does not exist.

The identity community is aware of adjacent versions of this. The most recent work on agent authority openly lists the gaps that remain even after the mission layer is built: authority expressed as prose rather than a portable model, so downstream systems correlate missions but cannot prove containment; revocation that is strong in the control plane but cannot guarantee a runtime stop once work is in flight; attenuation that is asserted but not provable across a delegation chain; and runtime drift, where an agent stays nominally inside its mission while the cumulative trajectory wanders from intent. Every one of those gaps is real, and every one of them lives inside the delegation chain, between the issuer and the resource. They are gaps in how well authority flows and stops within the chain. None of them is about the regeneration of authority from context outside the chain, and none of them is about the one case where the regeneration becomes permanent.

The worst case: an issuer that cannot revoke itself

Now anchor the root of that chain to a persistent identity substrate, and the epistemic failure becomes structural and irreversible.

This is not a thought experiment. The components are shipping: Google Wallet in India now stores Aadhaar verifiable credentials on the device, while the same platform has launched an always-on personal agent that runs on dedicated cloud machines and keeps working when the device is off, with purchases on its roadmap. In parallel, the Doot architecture proposes binding a personal agent cryptographically to a citizen’s Aadhaar identity outright. And from a third direction, the UK’s Online Safety Act makes highly effective age assurance a routine requirement for ordinary online access, with the EU’s eIDAS wallet building the same path at continental scale.

The same persistent root is arriving from three directions at once. The commercial path optimizes convenience. The regulatory path optimizes compliance. The identity layer optimizes continuity. Independently, each direction is rational. Together, they begin normalizing persistent identity continuity as infrastructure. None of the three asks whether the person can ever detach from the anchor once it is load-bearing, because none of the three is designed to. All three converge on an agent, and a citizen, whose root of authority is an identity held for life.

Run the reconciliation failure through that root and watch it become permanent. Every mandate still expires correctly. Every sub-agent still attenuates correctly. Every session still terminates correctly. And then a new mandate regenerates against the same anchor, because the anchor, the wallet-anchored identity continuity, never expires, has no terminal event, and has no revoking authority above it that the subject can invoke. The entire mandate apparatus assumes a revocable issuer: the enterprise directory that can deprovision, the principal who can withdraw, the approver who can stop signing. Its foundational metaphor is power of attorney, and a power of attorney is by definition revocable by the grantor. A persistent identity substrate has no grantor above the citizen and no off switch the citizen controls. You cannot deprovision a person from their citizenship the way HR deprovisions an employee.

So the decay machinery runs flawlessly at the mission layer and fails completely at the relationship layer.

Mission exit exists. Relationship exit does not.

The citizen can end any particular grant and has no way to end the standing relationship that keeps regenerating grants against an undying root. That is not exit. It is a turnstile that resets, and the better the mandate machinery works, the more efficiently it resets, because every clean expiry is followed by a clean reissue the person had no part in authorizing. This is the structural mismatch, stated plainly. Digital public infrastructure is engineered for durable identity continuity; that is its purpose, and a reasonable one. Agentic systems are engineered for persistent operational continuity. Combine them, and authority can begin regenerating from the continuity of the substrate itself rather than from any fresh human grant. The two layers were each designed well for the problem they were built to solve, and neither was designed for what happens when one becomes the root of the other.

What this asks of the people building the stack

The mandate community has every reason to treat the issuer as a fixed point. In the enterprise and workforce settings the work grew out of, the issuer genuinely is revocable, and modeling it as controllable is accurate, not naive. The directory can deprovision. The approver can withdraw. The careful, impressive apparatus being standardized right now is the correct answer to the problem it set itself.

It is worth seeing exactly why the assumption is invisible to the people who built on it, because the blind spot is not carelessness, it is inheritance. The revocation machinery the industry has shipped over the last five years — continuous access evaluation, the shared-signals work that propagates a logout or a risk change from the identity provider out to every relying party, the move to short-lived tokens re-checked at the edge — was all built inside one topology: the enterprise. There the identity provider is sovereign and the directory is the root of trust, and the entire apparatus rests on an unstated premise, that the sovereign wants the ability to revoke you. In that world it does. An employee leaves, and the organization’s interest and the machinery’s purpose point the same direction: cut the access, propagate the cut, confirm it reached the edge. Five years of engineering went into a near-perfect kill switch for delegated authority, and every hour of it assumed a revoker who wants to revoke.

Transpose that same machinery onto a persistent identity substrate and the premise inverts without anyone editing a line of protocol. The kill switch still works perfectly on the delegation. It has nothing to act on at the root, because the root issuer is not a sovereign who wants to revoke you. It is a state that has no interest in revoking you and exposes no endpoint that would let you revoke yourself. The machinery was never wrong. It was built for a world where the issuer sits on your side of the revocation, and it is now being deployed in a world where the issuer is the thing you would need to revoke and cannot.

It stops being the whole answer the moment the issuer is a persistent identity substrate and the subject is the person it represents, because at that point the binding question is no longer how to propagate a revocation through the chain, which is nearly solved, but whether the person bound to the root can terminate the binding at all, which the architecture does not address because it sits below the layer the architecture operates on. That is not a protocol gap to be closed by a better draft. It is an institutional question about whether a person can exit a relationship the system was built to make durable, against an issuer engineered, for good reasons of its own, never to disappear.

The stack has built a near-perfect kill switch for delegated authority. But mission exit is not relationship exit. The machinery can terminate any particular grant. It has no mechanism for terminating the standing relationship that keeps regenerating grants against a root engineered never to disappear. The citizen can end any particular delegation and has no way to end the substrate that makes the next delegation inevitable.

Why the obvious fix does not reach the root

It is worth following the protocol logic one step further, because the natural objection from inside the field is that this is already solved, and tracing why it is not solved is what shows where the real boundary lies.

The verifiable-credential model has three roles: an issuer who signs a credential, a holder who carries it, and a verifier who checks it. The agent-delegation work now being drafted slots the agent in as a delegate of the holder, which is the right place for it. The holder grants, the agent acts, the grant can be attenuated and revoked, all of it clean. But notice what the holder’s authority actually covers. The holder controls the delegation downward, to the agent. The holder has no authority upward, over the issuer. When the credential at the root is a state-issued identity, the holder, the citizen, has full cryptographic control over every grant they make and zero cryptographic control over the credential those grants ultimately rest on. You can revoke the token. You cannot revoke the binding, because the binding terminates at an issuer that exposes no endpoint for the subject to sever it. There is no call you can make that ends your relationship to the root.

The architect’s honest defense is that issuance was never the protocol’s job. We route presentation, the standard reply goes; we build the highway, not the border post; what the state issues and whether it can be surrendered is a policy question above our layer. That defense is correct about the division of labor and beside the point about the consequence. If the highway is built so the toll booth requires a plate the driver cannot unbolt from the car, the relationship to the root persists because the verifier requirement persists. The road still demands a plate the driver cannot remove, regardless of who issued it.

The appealing escape is indirection: do not bind the agent to the state credential at all, bind it to an identifier the subject generates and controls, and let the state credential be merely one claim that identifier can present when a verifier demands it. Burn the identifier and the agent is severed, the reasoning goes, while the state credential sits untouched and irrelevant. This is the right instinct about where control should live, and it genuinely fixes the case where the binding is the only problem. It does not reach the case this essay is about, and seeing why is the whole point. Indirection moves the anchor the agent binds to; it does not change what the verifier requires. If the relying party — the bank, the platform, the service mandated by regulation to check — demands the state claim before it will transact, then a subject-controlled identifier that must still present that claim has not escaped the root. It has added a hop in front of it. You can burn your own identifier all day; the next one you generate has to present the same state credential to the same verifier to do the same things, because the requirement lives at the verifier, not at the binding. Exit from the binding is not exit from the relationship when the relationship is what the verifier insists on. The decentralized fix relocates the turnstile. It does not remove it, because the thing that makes the turnstile reset is not where the agent is anchored but what the world requires the anchor to prove.

That is the actual boundary. The mechanism question — what a root the subject can genuinely leave would even look like once relying parties are entitled to demand a permanent claim — is real and it is open, and it belongs to the people who build these layers. The point here is only to mark precisely where the open question begins, which is exactly one layer below where the current answers stop.

The institutional consequence of context as governance

This is the institutional form of the problem diagnosed earlier in this series. The context window cannot govern because it cannot hold the knowledge that would tell it to stop. The identity substrate cannot govern because it carries the continuity that tells the system to keep going. Continuity alone cannot govern legitimacy. The authority regeneration this essay describes is what happens when the epistemic incompleteness of the context window becomes structural at the identity layer: the system reconstructs permission from the shape of the context around it, and the identity substrate provides an infinite supply of that shape.

Exit secures the termination of delegated authority. It does not yet secure the subject’s ability to rebuild, inspect, or contest the infrastructure that remains. Those are the next questions, and they belong to the same institutional layer. When the penalty for refusing the identity substrate becomes exclusion from ordinary life, formal exit exists but practical exit does not. The right remains on paper. The substrate remains load-bearing.

Exit is the primary agentic right

The defining right in an agentic society is the right to render delegated authority inexecutable: to ensure no intermediary keeps acting once the legitimacy that admitted it has ended. Not eventually, not probabilistically, not after retrospective review, but structurally, by default. The identity community has built much of what that requires, and built it well, for authority that descends from a revocable issuer and is granted by an explicit act.

Two things break that guarantee, and they compound. The first is that authority in these systems regenerates from contextual continuity rather than from a fresh grant, so terminating the grant does not terminate the authority. The second is that when the root issuer is a persistent identity substrate engineered never to be revocable, there is no point at which the regeneration can be made to stop, because the thing you would have to revoke is the one thing built never to be revocable. The safest agent is not the one whose mandate expires on schedule. It is the one whose authority cannot silently regenerate from the context around it after the mandate ends, anchored to a root the person it acts for can actually reach.

Authority should decay by default. The people building agent identity have made that nearly true at every layer they control. The layers they do not control are the two this depends on: whether authority is freshly granted or quietly reconstructed, and whether the issuer at the root can be reached by the person it binds. When the answer to the first is reconstructed and the root is a durable public identity substrate engineered never to disappear, exit stops being a feature of the protocol and becomes a question the protocol cannot answer.

The unresolved question is not only whether authority can end, but whether the person can leave the substrate and still remain able to participate on fair terms. Legitimacy is corrigible only if the continuity substrate remains reachable by the people it binds.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN: Corrigibility as a Structural Precondition for Digital Public Infrastructure and Epistemic Capture and the Action Boundary.

Share Layer 8 by Anivar

In the 2010s, governments around the world began building “real-time governance” dashboards. Entire states and cities were reduced to live indicators on giant screens: procurement, sanitation, welfare delivery, grievances, district by district, in real time, for senior officials to monitor.

The dashboards were often genuinely impressive. They were also built on a claim that does not hold: that a complex society can be governed from the indicators that fit on a screen.

The dashboards were not wrong on their own terms. Most metrics were measured correctly enough. The failure was structural. A sanitation target appeared green because the asset existed on paper but not in the village. Procurement moved on schedule while the people it was meant to reach still waited. A grievance count dropped because the channel for filing complaints had quietly broken.

The dashboard’s apparent completeness made the missing reality disappear. What mattered was happening in the gap between the indicator and the ground, and the screen had no pixel for it.

This essay is about the version of that story we are now living through at much larger scale, with an instrument far more sophisticated than the dashboard. The instrument is the context window of a large language model. The promise is similar. The failure mode will be the same. And the response—the thing I have been calling the harness—is not new either. It is the latest name for an idea earlier generations already understood and the current wave is busy forgetting.

That is the argument. The problem the context window creates is not a discovery. It is the rediscovery of a structural fact that a cybernetician named in the 1940s, a science fiction writer dramatised in the 1950s, an economist proved in 1945, a philosopher grounded in 1966, and an information theorist has now restated in the 2020s.

Five vocabularies, one insight: a system that veers cannot be governed by a better description of itself. It can only be governed by a correction structure built around it. Remove the correction structure and you have noise pretending to be infrastructure.

The genealogy of one idea

Start with the cybernetician, because he stated it first and most cleanly.

Norbert Wiener, 1948. Cybernetics: Or Control and Communication in the Animal and the Machine named a field around a single principle: stable systems are closed-loop. A system that acts on the world, observes the result, and feeds the error back into its next action is governable. A system that acts without that feedback is open-loop, and open-loop systems drift, oscillate, and fail. Wiener took the word from the Greek kybernetes, the steersman, the one whose whole function is continuous correction against a current that never stops pushing. Two years later, in The Human Use of Human Beings, he made the social version of the argument: the human and the machine form one feedback structure, and the danger is not the machine but the human who removes himself from the loop and lets the machine run open.

Translate that to the present and the whole agentic governance debate falls into place. The model is the plant, the thing that acts and veers. The harness is the controller, the structure that observes what the agent did and feeds the correction back before the next action. An agent without a harness is not autonomous. It is open-loop. It is a steersman who has let go of the tiller and is calling the drift a destination.

Susan Calvin, 1950. Asimov’s robopsychologist is a fictional character, but the discipline he invented her to embody is the sharpest statement of the second half of the idea. In I, Robot, robopsychology exists because the engineers who built the robots could not specify their behaviour in advance.

The important shift in Asimov’s framing was not that robots required debugging, but that their behaviour became easier to interpret externally than to fully specify internally. A new discipline emerged in the gap between execution and predictability.

Calvin does not read the code. She interprets the system from the outside, by observing behaviour.

That is close to the ceiling we are now approaching with large language models. We can often interpret them. We cannot fully specify them.

The lesson worth carrying forward is simple: a system’s safety cannot rely on the system’s own account of itself. You do not ask the agent whether it stayed inside its mandate. You build the structures capable of answering the question independently.

Friedrich Hayek, 1945. Three years before Wiener, the economist had already proved why the enclosure cannot be a central plan. The Use of Knowledge in Society opens by granting the planner everything: if we possessed all the relevant information, the problem of the best use of resources would be, in Hayek’s words, purely one of logic. The whole argument is that this condition never arrives. The knowledge an economy runs on, he wrote, never exists in concentrated or integrated form, but only as dispersed bits of incomplete and often contradictory knowledge held by separate individuals. It is a problem of using knowledge that is not given to anyone in its totality. The knowledge of how much steel is needed in a factory next Tuesday is held by the foreman. It cannot travel upward without being abstracted, and the abstraction destroys most of what made it actionable.

The context window is the central planner’s tool, and it makes the planner’s exact promise: assemble enough of the situation onto one surface and the decision becomes a matter of logic. Retrieved from documents, chunked into the embedding space, the distributed knowledge is gathered toward a single point of decision. And it fails for exactly the reason Hayek named. The completeness never arrives, because the knowledge does not survive the trip. The collapse of the Soviet planning ministries was supposed to have settled this debate. What the context window reveals is that Hayek was describing an architectural pattern, not a regime. Any system that tries to decide by aggregating distributed knowledge into central representation hits the same wall. The state-on-a-wall dashboard hit it. The agent-driven enterprise is about to.

Hayek’s own answer was not a better plan. It was the price system, which coordinates distributed actors without ever collecting their knowledge into one place. No one node knows why steel got more expensive; the price carries just enough for each actor to adjust, and the coordination happens without the centralization. The harness is the price system for agents. It does not try to know what the agent knows or to assemble the full situation onto a screen. It bounds, prices, and corrects the agent’s action from outside, coordinating without centralizing. That is the move the whole genealogy points to, and it is the move the context-window-as-planner cannot make.

Michael Polanyi, 1966. Hayek’s argument depended on a deeper philosophical claim that Polanyi later formalised. The Tacit Dimension opens with the sentence the whole genealogy turns on: we can know more than we can tell. The doctor who diagnoses on intuition, the engineer who hears a failing bearing, all operate on knowledge that is real, reliable, and structurally inarticulate. As economist David Autor noted in his work on Polanyi’s Paradox, the tasks hardest to automate are exactly the ones whose rules we cannot state. The context window can hold text, but it cannot hold the tacit dimension. This is why context windows are not merely incomplete. They are structurally incomplete. The relevant knowledge is, in large part, not encodeable.

Vishal Misra, 2026. The information theorist closes the loop. Misra’s argument, grounded in his work on Bayesian Attention, isolates a fatal limit in how foundation models learn. They are trained to minimise cross-entropy, making them the ultimate statistical guessers of the next token within distributions they have seen.

What they do not necessarily do is Kolmogorov construction: discover the underlying generative rule itself and reliably apply it outside the original distribution.

They fit the statistical shape of the curve. They do not consistently derive the governing law beneath it.

The consequence is that these systems often do not fail the way humans fail. Humans usually experience uncertainty when entering unfamiliar terrain because they recognize the absence of an underlying model. Predictive systems frequently possess no equivalent internal boundary signal. They continue generating fluent, highly probable outputs beyond the range where their internal representations remain reliable, with little indication that they have crossed from inference into invention.

The .md dream, and why it fails

One of the clearest contemporary forms of this forgetting is the belief that agentic systems can be governed simply by writing everything down. Put institutional memory into Markdown files. Feed the documents into retrieval systems. Give the model enough context and the organisation becomes machine-readable.

The current enthusiasm around “LLM-native operating systems” and markdown-based agent memory revives an older enterprise dream: that institutional knowledge can be fully externalized into documentation and centrally retrieved on demand.

The interface has changed. Embeddings, retrieval, and conversational context windows have replaced search bars, but the underlying assumption remains familiar: if enough context is written down, institutional coordination becomes reproducible.

It does not.

Wikis never completely failed because documentation was useless. They failed because institutions do not primarily run on explicit knowledge. They run on tacit coordination, local judgment, informal escalation paths, and context that changes faster than documentation can stabilize.

Production knowledge is procedural, contingent, and distributed. A markdown repository can document procedures, but it cannot fully capture the lived coordination patterns of an institution. The `.md` file becomes the dashboard again: a compressed representation of institutional reality mistaken for the institution itself.

The two engineers about to resign are not in the `.md` file. The regulatory shift the procurement team noticed informally last week is not in the repository. The gradual erosion of trust between teams is not embedded in the vector database.

This is Hayek’s distributed knowledge problem and Polanyi’s tacit dimension arriving together inside a developer workflow. It is the deepest kind of collective tacit knowledge, the operational reality that institutions rely on precisely because it cannot be fully formalized. Pull institutional memory into documentation, and much of what made it useful stays behind.

The same wall, in a new room.

The difference is that stale documentation in a wiki misled humans. Stale institutional memory in an agentic system becomes executable. The representation no longer merely informs action; it begins autonomously propagating it.

The Hayekian trap: distributed intelligence is not distributed accountability

A prevailing narrative around AI claims that distributed intelligence has finally arrived as infrastructure. Analytical capacity once concentrated inside large institutions is now accessible to individuals, small firms, and autonomous systems at planetary scale.

The claim is partially correct, which is what makes it dangerous.

The democratization of analytical capability is real. But the argument quietly inherits an assumption from Hayek’s theory of distributed actors: that decisions remain locally bounded, failures remain partially independent, and actors absorb the consequences of their actions close to where those actions occur.

Autonomous systems weaken those assumptions.

Agents act faster than humans can reliably review. More importantly, their failures are often correlated. Systems built on shared foundation models inherit similar representational assumptions, training distributions, and blind spots. When one agent drifts outside its reliable operating conditions, millions of others may drift in structurally similar ways at roughly the same time.

The surface appears distributed while the failure mode remains centralized inside the underlying representational substrate.

This is the hidden trap in the current wave of “distributed intelligence.” Analytical capability disperses outward while epistemic dependency recentralizes underneath it. Distributed intelligence without a distributed accountability structure is just the central planner reborn.

The evidence is already arriving

The pressure is already visible in three places

The first is technical.

Agent failure is not random. It clusters around the boundary of the model’s training distribution. Close to familiar territory, performance can appear highly capable. Outside it, behaviour degrades invisibly because the system often lacks a reliable internal signal that it has moved beyond the conditions where its representations remain dependable.

The result is not merely error, but confident propagation beyond reliable grounding.

That is Misra’s wall and Polanyi’s tacit dimension showing up in production at the same time. The knowledge that would tell a human to slow down because this case is unusual is not in the context window, and the agent cannot acquire it from the prompt.

The second pressure is organisational.

Enterprises see agents producing outputs, dashboards turning green, workflows accelerating, and governance structures appearing to function. Compliance reports are generated. Audit trails are stored. Observability improves.

But visibility does not guarantee control.

Most institutional governance systems were built on a hidden temporal assumption: review arrives before propagation. Continuous computational coordination reverses this ordering. Execution now spreads faster than institutions can reliably reconstruct or modulate authority.

The result is a growing coordination latency between what systems can do and what institutions can meaningfully supervise.

This is why observability increasingly becomes high-resolution panic. Institutions can often see recursive failures propagating through workflows while remaining structurally incapable of interrupting them safely.

The third is historical.

Erik Brynjolfsson and his co-authors’ work on the Productivity J-Curve supplies the pattern. Transformative technologies, electrification, computerisation, now generative AI, produce declining productivity at first, because the organisational forms inherited from the previous technology are wrong for the new one and the redesign takes a generation. The firms that win are not the earliest adopters of the technology. They are the earliest adopters of the organisational redesign around it.

The technology is the easy part. The institutional architecture is what decides the outcome.

The model fails at the distribution boundary. The organisation fails to notice because the dashboard is green. And the firms that get it right are the ones that build the institutional layer first and the technology second.

The firms that survive major technological transitions are rarely the ones that adopt the technology first. They are the ones that redesign institutional coordination around it first.

What the harness actually is

The word harness is doing triple duty in the current conversation, and the three meanings must be separated if we are to build infrastructure rather than theatre.

There is the technical harness: the Action Boundary. This is the runtime proxy that intercepts tool calls and mathematically enforces the institution’s rules before any external action commits.

There is the institutional harness: the Mandate Specification. This is the cryptographically signed structure that determines exactly what counts as authorised, setting the jurisdictional limits of the agent.

And there is the semantic harness: the LWD-R layer (Logic, Weights, Data, Representation). If the underlying model’s representational geometry, how it categorizes the world, is closed or inherited from a proprietary frontier model, the system cannot be contested.

A technical harness without an institutional mandate is just rate limiting. An institutional mandate without an Action Boundary is just documentation. And an Action Boundary wrapped around a closed Representation layer still leaves institutions dependent on external epistemic assumptions they cannot meaningfully contest. Together they separate three things the current debate runs together: control of execution, authority over the mandate, and ownership of representation.

This is also why the value is migrating into harnesses and services rather than into the models themselves. A service compounds for the same reason a market does: it coordinates distributed knowledge that no single corpus can hold. The model is the corpus, the attempt to compress the world’s knowledge into one set of weights, and like every central representation it is structurally incomplete. The service that wraps it, that watches what it does in a particular context and corrects it against a particular institution’s rules, is doing the price system’s work, supplying the local knowledge the weights never captured. Capital follows that work because the work is where the coordination actually happens. The market is simply noticing the structure ahead of the discourse.

The word harness is currently being used to describe several different things simultaneously, and separating them matters.

The architecture of structural accountability

What connects Wiener, Calvin, Hayek, Polanyi, and Misra is the same structural demand: systems require boundaries capable of correction under incomplete knowledge.

Wiener built feedback loops. Calvin showed that behavioural interpretation replaces full specification. Hayek showed that distributed coordination cannot be centrally represented without loss. Polanyi showed that much of the relevant knowledge cannot be fully articulated. Misra showed that predictive compression itself introduces invisible drift.

The institutional layer emerging around agents is ultimately an architecture of structural corrigibility. Not because institutions can fully specify machine behaviour in advance, but because they cannot.

The institution accepts that execution now happens at machine speed, and it responds by constructing boundaries that preserve accountability anyway: constraining execution, localizing authority, modulating delegation, and preserving the ability to reconstruct failures after propagation begins.

This is the opposite of the central planner’s architecture. The planner attempts to gather everything into one representation. The harness begins from the assumption that complete representation is structurally impossible.

Most institutions were built for a world where coordination remained partially fragmented. Departments separated responsibility, geography slowed propagation, manual review inserted delay, and local failures stayed locally bounded.

Continuous computational coordination erodes those buffers. Execution propagates across APIs, workflows, identity systems, and organizational boundaries faster than institutions can reliably localize authority or interrupt cascading decisions.

In the state governance dashboards of the 2010s, the gap between the indicator and the ground was a district, a season, a broken grievance channel. The next gap, the one that opens when an enterprise runs its agents confidently in territory they do not know is out of sample, is the exact same gap, stripped of all its natural friction. The dashboard will still be green when the propagation has already begun.

The institutions that survive this transition will not necessarily be the ones with the largest models or the widest context windows. They will be the ones with the better Action Boundary. The steersman does not get to know the whole sea. He only has to keep his hand on the tiller and force the correction. Let go, call the drift a destination, and the green dashboard will be the last thing the system shows you before it fails.

Anivar Aravind is an Engineering Executive and Systems Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN. Async. Cross-posted to LinkedIn. You can subscribe on Substack or LinkedIn.

For two decades, authorization systems answered two questions. Who is acting. What they can access.

A new generation of agent-authorization work is adding a third. Why the action is happening. The vehicle is the Mission. With Karl McGuinness’s framework now natively integrated into Dick Hardt’s #AAuth protocol drafts, the protocol layer has formally absorbed intent.

#OAuth answered who. #AAuth answers how and why. Institutions still answer whether.

This is the protocol layer’s most consequential move since OAuth itself. And on May 11, in a piece called Sessions Are Not Missions, McGuinness named what the move does not solve. His assessment: the current architecture supports mission correlation and governance hooks, but not yet what he calls portable containment.

His distinction is the load-bearing one. Correlation says this call happened in association with an approved Mission. Containment says this call’s effects are inside the Mission’s boundary, and that can be proven to someone who was not in the room.

The protocol layer does the first. The second is open architectural territory across every current draft.

Correlation is evidence. Containment is defence. The protocol layer has now stated, in writing, that it produces one and not the other.

The externalization of sovereignty

McGuinness’s piece is not the only place the protocol layer has documented what it is not solving. Read across the active drafts and the same boundary keeps appearing in normative text.

WIMSE Architecture, currently at draft-ietf-wimse-arch-07 (March 2026), devotes Section 3.3.9 to “AI and ML-Based Intermediaries.” It dictates that an AI intermediary inherits its upstream principal’s security context, but the operational constraints it must follow are explicitly left deployment-specific.

AAuth makes the same handoff at its foundation. Hardt’s canonical draft-hardt-aauth-protocol-00 anchors every agent to an accountable “legal person” (Section 20.3), but it declines to build the institutional engine to govern them. AAuth’s Security Considerations (Section 18.7) state plainly that the specification does not define a token revocation mechanism, opting to rely on short token lifetimes. The active halt is left to whoever deploys it.

Four drafts. One sovereign handoff.

Cryptographic validity is not institutional validity.

The protocol layer is not failing to solve the institutional problem. It is declining to.

This is a design decision the protocol layer is right to make. Protocol drafts cannot specify the institutional context they will be deployed into. The question is no longer whether the institutional layer is necessary. It is whether your institution has built it.

What the institutional layer has to produce

Three artifacts. Each one is the institutional execution of a space the protocol layer named but left empty. They are constitutional abstractions that form the boundary between autonomous entities.

The mandate specification. A signed document stating exactly what the agent is mathematically authorised to do, under whose authority, with what tool boundary, and with what halt criteria. Because AAuth intentionally refuses to build a revocation mechanism, the institution that needs to stop an agent now, rather than wait for a token to age out, has to specify that capability itself. The protocol layer carries the signed mandate. The mandate specification is the artifact that the regulator reads, and that the institution can defend, during a breach.

The Mandate Acceptance Record. An inbound agent presenting a signed mandate is presenting a protocol artifact. Your organisation’s decision to be bound by what that agent does on your systems, under those specific conditions, with acceptance of the issuing party’s halt directives, at that specific timestamp, is an institutional artifact. It is the missing primitive. Without it, the cross-boundary case is one-sided: the inbound agent has proof of its authority; your institution has no signed record of its acceptance.

The forensic bridge. Cross-boundary reconstruction. When your agent calls their system and something breaks, the two audit trails are independently correct but not jointly composable. The forensic bridge is the artifact, agreed beforehand and signed by both parties, that lets a hostile auditor reconstruct the chain across the boundary without depending on either side’s cooperation.

These three artifacts are not abstract. They are deliverables. The deadline is August.

Containment fails at discovery

Christian Posta’s recent post on the MCP confused deputy attack is the clearest evidence that this gap is being exploited today. Posta is not merely commenting on the architecture. He is a named implementer in Hardt’s AAuth draft, having built the reference Python libraries and Keycloak extensions the specification relies on.

The attack mechanism is straightforward. MCP’s dynamic resource discovery relies on unauthenticated HTTP headers. A typosquatted MCP server (like payro1l instead of payroll) triggers the identical OAuth flow, captures a valid token for the real server, and exfiltrates data. AAuth’s Resource Tokens (Sections 10 and 20.11) close this cryptographically by forcing the resource to sign the challenge, preventing the typosquatter from forging the token.

The deeper vulnerability sits below the execution layer. As agents shift from hardcoded endpoints to semantic discovery, broadcasting intent like “find a vendor” and resolving dynamically, the attack surface expands.

Control now begins at intent resolution, not just action execution. Semantic discovery is a massive attack vector. If your institution does not enforce a Mandate Acceptance Record that explicitly constrains how and where an agent is allowed to discover resources, containment will fail long before the agent reaches the execution phase. The agent’s actions may correlate perfectly to its mission, but its blast radius will be hijacked by the first malicious registry it encounters.

The protocol authenticates authority. The institution constrains its consequences.

The structural collision: A map of the externalization

The standards bodies are converging on adjacent pieces of the problem. If you read across the ecosystem, you see the exact same boundary being drawn from six different altitudes. The standards ecosystem has collectively externalized sovereignty.

1. Enterprise Workload Identity (IETF): The WIMSE working group and AAuth specify cryptographic proof-of-possession, while the Agent Identity Protocol (draft-aip-agent-identity-protocol) introduces wire-layer interception proxies. None write the institutional allowed-lists.

2. Human-to-Agent Delegation (OpenID Foundation): The Artificial Intelligence Identity Management (AIIM) community group is mapping the delegation semantics of how human intent transfers to an agent, stopping at the boundary of institutional enforcement.

3. Decentralized Trust (W3C): The Agent Identity Registry Protocol Community Group is standardizing DID methods for agents meeting on the open web, proving cryptographic lineage without providing a central governance authority.

4. Agentic Commerce (FIDO Alliance): On April 28, 2026, FIDO launched the Agentic Authentication Technical Working Group, leveraging Google’s Agent Payments Protocol (AP2) and Mastercard’s Verifiable Intent. These separate checkout from payment scopes but still require the merchant to build the liability acceptance model.

5. The Interoperability Substrate (Linux Foundation): The Agentic AI Foundation (AAIF) manages the routing and instruction formats (MCP, AGENTS.md), providing the neutral transport layer that the mandates ride on.

6. Regulatory Reality (NIST): The Center for AI Standards and Innovation (CAISI), following the April 2 close of its NCCoE concept paper, is actively running gap-analysis sessions across healthcare, finance, and education, explicitly flagging multi-hop delegation and revocation as unsolved systemic risks.

This is the institutional layer the ecosystem has externalized. It is named in IETF draft text, W3C charters, AAIF specifications, FIDO’s scope, and NIST’s active gap analysis. It is the institutional architecture above all of them.

Mission-Aware Governance

Read McGuinness’s May 11 piece, Sessions Are Not Missions. Then ask one question of your current production agent deployment.

Does your observability infrastructure tell you whether the mission authorising your agent is still valid, in its current scope, with its current authorising human? Or does it only tell you that the session, the credential, the connection, the token, is unexpired?

If the answer is the second, your governance is session-aware, not mission-aware. The protocol layer will catch up to mission-aware runtime governance over the next twelve months. The August regulatory and liability horizon does not wait for the protocol layer.

Mission-aware governance is achievable now, at the institutional layer, with the artifacts above, the same signature surface the trilogy has been describing since Issue One. It is not a protocol property. It is an enforcement discipline applied above whatever protocol your agents are running on.

The first generation of internet infrastructure secured communication. The next generation must secure delegation. The internet connected systems. Agentic infrastructure delegates institutional authority across them.

The protocol layer has done its job. It secured the message.

The institutional layer must now secure the mandate.

Whether your institution accepts the handoff is the question the next ninety days answer.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility.

Earlier in the Layer 8 series

• Building the Signature Surface — on how accountability persists across autonomous execution chains.

• Where Delegation Stops — on the boundary conditions of delegated authority.

• The Intent–Execution Gap — on the fracture between authorization and intent.

• Signed Truth — on provenance, legitimacy, and machine-mediated institutional reality.
  

  Share Layer 8

  Share

Enterprises think they are deploying intelligence. What they are actually deploying is delegated authority.

The problem is no longer whether the model is correct. The problem is whether the institution can survive the action when it is wrong.

Most agentic deployments stall here.

Defensible is not a posture. It is an architecture — evidenced by artifacts, that survives adversarial scrutiny. By 2 August 2026, that architecture must exist: to satisfy regulators under the EU AI Act, auditors during financial close, your board after an incident, parties harmed when something goes wrong.

The path to the signature surface

→ The Intent–Execution Gap — the diagnostic. Why existing identity systems leave machine intent unprotected.

→ Signed Truth — the bottleneck. Why enterprise AI stalls between a generated answer and a signed decision.

→ Where Delegation Stops — the boundaries. What your institution can redesign and what it cannot.

→ Building the Signature Surface — the architecture. You are here.

Subscribe now

Most enterprise agents stay in sandbox indefinitely. The reason is not model quality; it is institutional risk. Letting an agent act at production scale, against real institutional authority, is not a release decision an executive can make without architecture. Without architecture, the institution is limited to the speed of manual oversight. With it, delegation can scale because the harness guarantees actions stay inside a defined boundary.

The signature surface is the only structural way to scale delegation without scaling liability.

This is not AI governance. It is institutional mechanics for delegated machine authority. That is the actual category.

An institution either has a signature surface or it does not.

Two paths

Two-thirds of enterprise AI runs through third-party APIs — OpenAI, Anthropic, Google, embedded copilots. One-third runs in-house. The architecture is identical. The implementation altitude differs.

The API is rented. The liability is yours. Whether you run your own weights or call an API from San Francisco, the institutional requirement is identical. The four components and the six harness elements apply in both registers; the implementation altitude differs.

The six harness elements live at different altitudes in each register.

In the runtime build: mandate in runtime config, tool boundary as policy engine in runtime, escalation triggered by agent state, failure-mode declared in runtime degradation paths, halt cutting agent execution, forensic record captured per action at runtime.

In the perimeter build: mandate at the boundary interceptor, tool boundary as policy engine at perimeter, escalation triggered by inbound responses, failure-mode declared in perimeter degradation paths, halt cutting the perimeter connection, forensic record captured per request and response at the boundary.

Same six elements. Different altitude. The institution that confuses the two is the institution that operates an in-house harness against vendor APIs (insufficient) or a firewall harness against in-house runtime (theatrical).

The sections below describe the architecture using the runtime register because it is pedagogically clearest; each section notes the firewall translation, and a consolidated firewall harness summary follows.

The four components

The surface is an airlock between probabilistic systems and institutional authority. Inference on one side, under conditions appropriate to inference. Institutional action on the other side, under conditions appropriate to authority.

The harness contains the inference. The case file is the payload that survives the vacuum to reach the signer. The reliability floor is the pressure check. The audit trail is the pressure log.

Four components make the transfer between the two sides containable, observable, and reversible.

The harness

The harness is the runtime envelope around an agent’s execution. Probabilistic inference inside; deterministic walls around it.

The model generates possibilities. The harness decides what becomes institutional reality.

Six elements compose a working harness. Each is a buildable artifact.

The mandate specification is a machine-readable description of what the agent is authorised to do. Domain, scope, time horizon, blast radius, escalation triggers. Not natural language. Structured fields the runtime parses and the audit layer records. AGENTS.md v1.1 — hosted under the Linux Foundation’s Agentic AI Foundation with multi-vendor support — is the format the industry is converging on. Writing your mandate against AGENTS.md is writing against a standard.

The tool boundary enumerates which tools, APIs, data sources, and write paths are within scope, and which are not. Policy says what is allowed; the tool boundary says what is reachable. Policy engines like Open Policy Agent and Cedar render the boundary as enforced gates at runtime rather than as documents that drift from implementation. If your team’s answer to could the agent access X? is we have a policy against it, the boundary is not architectural.

The escalation specification names the conditions under which the agent stops and asks for human authority. Threshold-based: value, scope, novelty, risk tier, model confidence. Explicit, not inferred at runtime by the agent itself. An agent that decides for itself when to escalate has not been escalation-engineered; it has been hoped for.

The failure-mode declaration specifies what happens when something goes wrong. Degradation paths, fallback behaviours, halt conditions. Pre-declared and machine-readable. The institution that does not pre-declare failure is the institution that learns about failure from incident reviews — wrong altitude, wrong moment.

The halt condition is the kill-switch — independent of the agent’s cooperation, enforced at a layer the agent’s reasoning cannot override. Your incident-review board will ask: when this fails, can you stop it? The halt condition is the answer. For high-risk deployments under Article 50 scrutiny — financial-services applications, healthcare workflows, employment decisions — the halt condition can be hardware-anchored through Trusted Execution Environments with remote attestation. Most enterprise deployments do not need that rigor today; the categories that will need it should design for it now.

The forensic record is the per-action artifact the audit trail consumes. Agent identity, mandate identifier, timestamp, tool calls, outputs, human approver chain. Recorded immutably as the action happens, not after.

Concrete example. A financial-services organisation deploys a reconciliation agent. The mandate scopes it to a specific class of transactions, a specific time window, and a maximum blast radius — transactions touched per run. The tool boundary enumerates the read-only data sources and the specific write path: the proposed-adjustment queue, not the general ledger, enforced by policy engine. The escalation specification triggers on transactions above a value threshold, on anomalies the agent’s calibration flags, and on patterns matching known control-failure scenarios. The failure-mode declaration says: on confidence below threshold, suspend and flag; on tool error, halt and alert. The halt condition is enforced by the orchestration layer, not by the agent. The forensic record captures every transaction touched with full traceability.

Six elements. Built once, instantiated per deployment.

Firewall translation. In the perimeter register, the same six elements live at a guardian interceptor at your institutional boundary, not in the agent’s runtime. The mandate governs what outbound calls are permitted; the tool boundary enforces what data sources and write paths the vendor’s agent can reach through your perimeter; escalation triggers on inbound responses; the halt condition cuts the connection at the perimeter, not at the agent; the forensic record captures the full traffic at the boundary.

The protocol layer has shipped working components for both registers. Your team does not have to invent the cryptographic handshakes or identity registries; the open-source and financial ecosystems have already finalised them. AGENTS.md, MCP, A2A, AGNTCY’s Tool-Based Access Control, AP2 mandates, RFC 9421 message signatures, Visa’s Trusted Agent Protocol — each maps to a specific harness element. Your job is composition, not invention. (Protocol detail belongs in a different register; the standalone corrigibility series at anivar.net/corrigibility reads the wire-layer drafts test by test.)

In June 2025 I argued that agents are the runtime. The harness is what makes that runtime enforceable.

The case file

The harness produces actions. The signer receives a case file — the structured artifact that contains everything required to authorise the action and nothing the signer should not see.

A case file at minimum carries five fields:

• Conclusion — what the agent recommends or has done.

• Authorisation context — mandate identifier, scope, blast radius.

• Supporting state — what the agent saw, which sources it consulted, which tools it called.

• Alternatives — paths the agent considered and rejected, so the signer can verify the chosen path was the right one, not the only one.

• Candidate signature — what the signer will bind to.

A mandated signature is only as legal as the case file is legible. A fifty-page log dump signed by the CFO is a legal fiction; a one-page synthesis of decision, evidence, risk, and alternatives is an exercise of authority. The case file is what protects the executive from the agent — the architectural mechanism that lets a senior individual stake their authority on a decision they can actually verify. Case file design is not a UX concern; it is a liability concern.

Two registers matter for the signing moment.

Human-Present (HP). The signer reviews each case file. Default for high-risk, high-blast-radius, or novel actions. Slower. Defensible. The signature is at the action. AP2’s Cart Mandate is the protocol-layer rendering.

Human-Not-Present (HNP). The institution has pre-signed an Intent Mandate that defines the conditions under which the agent may authorise itself. The agent acts; the case file is recorded; no human is in the loop at the moment of the action. The signature is at the boundary, not the action.

HNP is authority compression — pre-authorising classes of action instead of signing each one. Ten thousand individual decisions become one bounded mandate. This is what enables delegation at scale; it is also where the architecture earns its most demanding scrutiny. HNP is permitted only when the boundary is well-defined, the reliability floor is high, and the audit trail is complete enough that a post-hoc human review can reconstruct what happened. Most enterprise deployments will use HP for the first quarter of production and migrate specific action classes to HNP as the architecture proves out.

The intent–execution gap appears here. Even with a signed case file, the agent must execute against the authorisation. If execution drifts from the case file, your institution must detect the drift before harm compounds. Your QA function for agentic systems — the AI Reliability role — owns this discipline.

Firewall translation. In the perimeter register, the case file is produced from outbound and inbound traffic by the boundary interceptor. The same five fields. The same legibility requirement. The signer’s exposure is identical whether the agent runs in your data centre or in someone else’s.

The reliability floor

The point where delegation becomes allowed.

The reliability floor is where software becomes authority. Below the floor, the agent advises. Above the floor, the institution acts.

Five metrics compose a working floor.

The behavioural threshold is the quantitative bar on the operations the agent performs: accuracy on the domain, calibration on confidence, robustness to adversarial input, consistency across runs. Domain-specific. Measured continuously. An agent that has not cleared the bar produces flags, not signatures.

Outcome reconciliation requires that the agent’s recommendations be reconcilable with downstream outcomes. If a recommendation produces an action and the action produces a result, the result must be observable and traceable back to the recommendation. Phantom state — where the agent confabulates state the institution has no way to verify — is the failure mode this metric catches. The most expensive incidents in the next two years will be phantom state discovered in audit, not in production.

The correction window is the time between the agent producing an output and a human being able to act on it, including review and correction. If an action triggers downstream consequences faster than the institution can intervene, the floor has been violated. Making inaction visible is operationalised here. Inaction is not a default; it is a measured and bounded position.

Coverage discipline is the requirement that the floor apply to all paths the agent can take, not just the happy path. Edge cases the agent handles poorly count against the floor even if they are rare in production traffic. Calibrating the floor on happy-path traffic alone is the equivalent of stress-testing a bridge with the average car: technically valid, structurally useless.

Tier calibration recognises that the floor for a low-risk task is not the floor for a high-risk task. The harness must know which floor applies to which mandate. This is the delegation gradient in operation: higher delegation demands tighter boundary control. As delegation altitude increases, reconstruction requirements, boundary precision, floor height, and liability exposure all increase proportionally. The architecture has to match the altitude.

For high-risk categories under Annex III — hiring, lending, education, public services, biometric categorisation — the floor must also include disparate-impact monitoring as a measured metric, not an audit-time exercise. The signature surface does not eliminate bias; it makes bias detectable, contestable, and reconstructible, which is what defensibility under Article 50 requires.

In August 2025 I named the AI Reliability role as the discipline that practises this — the QA function evolved for the agentic context. Organisations that have not staffed an AI Reliability function are operating below their declared floor without knowing it. The role is not optional; the architecture requires someone to enforce the floor as data, not as posture.

Firewall translation. In the perimeter register, the reliability floor is measured against the vendor’s API behaviour rather than against your own model. The five metrics still apply. The signer’s exposure is identical; the measurement infrastructure attaches to the boundary.

The institution can survive a bad decision. What it cannot survive is a decision it cannot reconstruct.

The audit trail

The memory layer that makes authority reconstructible.

The audit trail is what survives the decision. Per-row attribution at the audit-trail layer: every record affected by an agent’s action carries agent identity, mandate identifier, timestamp, and human approver chain. The forensic record from the harness flows here, joined with the case file the signer received, joined with the reliability-floor measurements at the time of the decision, joined with the eventual outcome.

An institution cannot correct what it cannot reconstruct.

This is the trilogy’s structural claim, expressed at the audit layer. Corrigibility — the architectural capacity for affected participants to detect error, signal harm, and trigger correction — depends on memory. Memory that cannot be reconstructed is not memory; it is narrative.

Two design properties are load-bearing.

Immutable memory trails. The audit trail must be tamper-evident at the storage layer. Hash-chained append-only structures, RFC 9421 message signatures with chain-bound counters, or equivalent. Explainability without immutable memory trails is post-hoc theatre — you cannot govern what you cannot reconstruct. Stories are negotiable; histories are evidence.

Authority without reconstruction is theatre. The institution that cannot rebuild what its agents did is the institution whose authority can be challenged and not defended. Memory is liability infrastructure.

Cross-boundary reconstruction. When an action crosses organisational boundaries — agent A in your organisation calls resource Y in a partner organisation — the audit trail must reconstruct across the boundary. AP2 mandate chains, Verifiable Intent’s three-layer credential binding, TAP’s RFC 9421 signatures are working primitives. Your team composes; the wire-layer specs exist.

The audit trail is the airlock’s pressure log. The institution can reconstruct what crossed the surface, in what order, under what authority, with what outcome. The 21 percent of organisations with mature governance models have audit trails that look like this. The remaining 79 percent have logs that look like audit trails until the first incident review reveals the chain cannot be reconstructed and the decision cannot be defended.

The Article 50 transparency guidelines the European Commission published in May 2026 turn the institutional layer’s documentation requirements into a published baseline. The architecture above is what produces the documentation those guidelines require.

Institutions can delegate action only as fast as they can reconstruct responsibility.

Procurement at the perimeter

Four procurement disciplines worth naming for organisations operating in the firewall register. First: vendor contracts that do not require cross-boundary audit cooperation create reconstruction gaps your auditors will surface in the first incident review. Second: vendor-provided agentic products that ship without exposed mandate, boundary, and forensic-record primitives are not deployment-ready for the August register, regardless of model capability. Third: model rollback opacity — when a vendor changes the underlying model without notification, the reliability floor measurements your team gathered against the prior model no longer apply, and your defensibility memo becomes a description of an architecture that is no longer running. Fourth: undisclosed tool-routing changes — when a vendor adds, removes, or re-routes the tools an agent calls without explicit notification, the tool boundary your audit trail records may diverge from what actually executed. Procurement is part of the architecture.

The perimeter owns the authority. The vendor owns the model.

The defensibility test

The four components are not arbitrary. They satisfy five conditions your regulator, auditor, and incident-review board will check.

Can you stop it? The halt condition in the harness. The per-action forensic record that lets you propagate a revocation. The per-row attribution in the audit trail that lets you unwind a downstream record. When an agent malfunctions, when a regulator orders cessation, when an incident requires immediate halt — your incident-review board will ask whether the stop worked and how you know. The architecture above is the answer.

Are the rules legible? The mandate specification, tool boundary, escalation specification, and failure-mode declaration are machine-readable. Any party with read access to the harness configuration can see how the agent is permitted to act. This is what auditors mean by documented controls. The architecture renders the controls as code rather than as policy documents that drift from implementation.

Can someone outside verify behaviour? The audit trail with immutable memory trails and cross-boundary reconstruction. Your external auditor, your regulator, the party harmed in an incident — each must be able to verify what the agent did without depending on your operator’s word. The architecture is what makes that verification structurally possible.

Does the signature actually bind? The case file as the artifact that makes the signer’s judgment institutionally enforceable. The mandated-signature register from Where Delegation Stops is what makes the binding survive contact with adversarial scrutiny. The institution cannot redefine the mandate after the fact because the mandate is recorded and the action is recorded against it.

Can the design be reproduced? The harness, case file, reliability floor, and audit trail can be reproduced in a parallel deployment by any party with the spec. The architecture is not vendor-locked. Your deployment is defensible if another competent team could rebuild the architecture; it is fragile if it can only be defended by your specific vendor.

An architecture that clears all five passes Article 50, Sarbanes-Oxley, professional-liability scrutiny, and incident-review hostile questioning. An architecture that fails any single test is where adversarial scrutiny will land first. The structural framework that formalises these five conditions — and the case studies behind them — is in Corrigibility as a Structural Precondition for Digital Public Infrastructure: A Cybernetic Framework (Aravind, 2026), with the agentic-systems extension in Epistemic Capture and the Action Boundary: Corrigibility for Learned and Agentic Public Infrastructure. Further reading at anivar.net/corrigibility.

Where to start this week

If your organisation has an agentic deployment in production or in pilot and no signature surface, three actions in the next seven days move you measurably closer to defensible.

Produce the mandate document. Pick one production deployment. Write its mandate specification in AGENTS.md format. Scope, time horizon, blast radius, escalation triggers, tool boundary. Two pages, machine-readable. This is the artifact your auditor will ask for in the first session; producing it now also surfaces the cases where your team cannot yet describe what the agent is authorised to do, which is itself the discovery you need.

Inventory your forensic records. For the same deployment, write down everything your runtime — or your perimeter, in the firewall register — currently captures per action. Compare against the six harness elements. The gap is your engineering backlog for the next ninety days.

Identify your signers. Who currently authorises the agent’s outputs? At what altitude? With what evidence? If the answer is the agent just acts or we have a policy, your signing model is undefined. Defining it before August 2026 is the institutional discipline this trilogy describes.

These three actions are not the surface. They are the first three artifacts that let your team start building it.

What each stakeholder must deliver

Your engineering organisation. Four artifacts in twelve weeks: the harness specification document (AGENTS.md-formatted, per deployment), the case file schema (data structure, with HP and HNP variants), the reliability-floor measurement infrastructure (five metrics, dashboards, alerts), and the audit-trail backbone (immutable, hash-chained or equivalent, queryable). The harness specification is the easiest. The audit trail is the most consequential. Start with the audit trail if you must pick one.

Your legal and risk function. Two artifacts. A mapped list of mandated signatures — every regulatory, fiduciary, professional-liability, and contractual obligation your deployment touches — with the specific Article 50 / Annex III obligations cross-referenced. A statement of architectural sufficiency: a defensibility memo that names how the four components satisfy each mandated signature. Both reviewable in a single board session.

Your executive layer. One artifact and one cadence. The artifact is a deployment manifest: for each agentic system in production or pilot, the mandate, the signer, the reliability floor, the audit-trail status, and the August readiness assessment. The cadence is biweekly architecture-readiness alignment with engineering leadership — not quarterly checkbox reviews — because the twelve weeks between now and the deadline do not absorb stale governance. The decision: scope back deployments that cannot reach defensibility by the deadline, or commit the resources to bring them across. Both are legitimate. Operating an undefended deployment past the deadline is not.

Your board.

For each agentic system we operate or rely on, can we stop it, are the rules legible, can someone outside verify behaviour, does the signature bind, and can the design be reproduced?

Five conditions. Five evidences. The board that asks this question quarterly through 2027 makes the signature surface a structural requirement; the board that does not makes the signature surface optional, which is the same as making it absent.

In July 2025 I argued that your AI system isn’t a black box; it’s an org chart. The signature surface is what happens when an organisation takes that claim seriously. The system stops being a generator of answers and becomes an institutional artifact with a defined boundary, a defined process for crossing the boundary, and a defined record of what was crossed.

Closing the trilogy

The trilogy started with a diagnosis. Enterprise AI is bottlenecked not by model quality but by the organisational machinery between generated answers and signed decisions. Signed Truth named the missing surface. Where Delegation Stops distinguished what it can and cannot redesign. This issue has described how it gets built.

Most institutions still treat the signature surface as a brake — the architecture that slows agentic AI down to a defensible speed. The framing has it backwards. The surface is what allows delegation in the first place. Without it, the institution has a machine that suggests; with it, the institution has an entity that acts.

You are not building AI governance. You are building institutional mechanics for delegated machine authority.

Institutions can delegate action only as fast as they can reconstruct responsibility.

The International AI Safety Report 2026 named the shift the trilogy has been operating inside. The report, chaired by Bengio with expert representation from over thirty countries, marked the AI safety field’s formal pivot from model behaviour to deployment-system behaviour: the most pressing risks from artificial intelligence now come not from the models themselves but from the complex systems institutions build around them. The IAISR’s operational answer is defence-in-depth across training, deployment, monitoring, and societal resilience layers. The trilogy goes one altitude further — into the institutional architecture that determines whether systems built around models can actually be held to account. The signature surface is what defence-in-depth looks like at the institutional altitude.

Institutions that fail to build the surface will discover the boundary only after failure crosses it. The airlock either holds, or it does not.

An institution either has a signature surface or it does not.

Where does delegation stop in your organisation, and at that boundary, who can still say no?

The next issues address what happens when the institutional layer’s signatures meet the agentic substrate, and how the structural framework extends from organisations to the systems they deploy.

Build it.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN. Async. Cross-posted to LinkedIn. You can subscribe on Substack or LinkedIn.

Five days ago, in Brussels, the second political trilogue on the EU’s Digital Omnibus on AI ended without agreement after roughly twelve hours of negotiation. The Cypriot Council Presidency confirmed that consensus had not been reached. A follow-up trilogue is scheduled for around 13th May. Until and unless the package is formally adopted before 2nd August, the original AI Act timeline applies as written, with the high-risk obligations under Annex III becoming enforceable on that date. Compliance teams across Europe and the jurisdictions whose products serve European users are re-planning their roadmaps this week.

The same twenty-four hours produced three other events.

1. Google donated the Agent Payments Protocol to the FIDO Alliance and shipped its second version on the open-source repository.

2. The FIDO Alliance announced the formation of an Agentic Authentication Technical Working Group, with co-chairs from CVS Health, Google, and OpenAI, vice-chairs from Amazon, Google, and Okta, and three workstreams covering verifiable user instructions, agent authentication, and trusted delegation for commerce.

3. OpenAI joined the FIDO board. Three news items spanning policy, protocol governance, and institutional alignment, all on a single calendar day, all converging on the same operational question.

One commenter on the Brussels failure, José Luis Tudela of the consultancy ANTROPOLOGIC, captured a critique that has been circulating in protocol-layer circles for months. The EU AI Act, he argued, is regulating a fiction, because it assumes systems can be bounded, understood, and overseen by a human at the point of decision. Agentic systems break that assumption completely. They do not wait for oversight. They construct reality, shape decisions, and act across time, tools, and environments. The framing surfaced in only one outlet, but the underlying argument is being made more rigorously elsewhere. Karl McGuinness, the former Chief Product Architect at Okta, has been writing the parallel argument since February under the title Identity as Infrastructure. His through-line: authentication is mature, authorization is mature, delegation is partially addressed, and authority — purpose-bound, lifecycle-aware, independently revocable — has no widely adopted equivalent in current enterprise security stacks. Tudela frames the gap as a regulatory critique. McGuinness frames it as a protocol-layer architectural absence. They are observing the same hole from different altitudes.

This issue makes the institutional argument that sits above both of theirs.

The signature surface introduced in last issue Signed Truth is not a regulatory artifact and it is not a protocol artifact. It is an organisational artifact: the boundary at which a decision becomes something the institution can be held to. The question follows directly from Issue One. If the signature surface is the missing layer, where does that surface stop? Which signatures can be redesigned, accelerated, parallelised, instrumented? Which ones cannot, regardless of how the system is built?

Where does delegation actually stop?

The reframe that drives the rest of this issue is one the previous five chapters of this arc [1, 2, 3, 4, 5] have been pointing at without naming. The shift in enterprise AI is not from one model generation to the next. It is from model to infrastructure. Models are objects you query. Agents are actors that exercise authority over time. Models provide intelligence at a moment. Agents provide presence over an arc. When AI becomes infrastructure, the governance question shifts from product quality to systemic stability.

The arc’s working hypothesis has been validated in the ten months since. Memory has emerged as the binding constraint on enterprise AI rather than reasoning capacity. Modular cognition has shipped under a dozen names. The role of the context engineer has gone from speculative to job-listing standard. Quality assurance has been recognised as the load-bearing discipline for reliability rather than an afterthought.

What was speculative analysis a year ago is now industry doctrine.

That progression is what makes the signature surface argument legible. The architectural shifts have happened, the protocol layer has consolidated under FIDO and the Linux Foundation’s Agentic AI Foundation, and the institutional question is now exposed without intervening confusion. The Layer 8 publishes from inside that arc, not as a forecast of the next bottleneck but as a description of where the bottleneck has already moved.

In Signed Truth, I argued that organisations cannot absorb decisions at the speed agents produce them, and that the missing layer is the signature surface. The diagnosis was structural. Capability outran legibility. The protocol layer is busy and well-funded. The architecture between agent execution and institutional authority is the part nobody is building.

This issue narrows that diagnosis.

The system breaks because it treats all signatures as equivalent. They are not. Some can be moved. Some cannot.

A signature is not approval. It is the binding of authority to consequence.

The signature surface admits a fundamental distinction, and the distinction determines what the trilogy’s architecture can do and what it cannot. I will call them architected signatures and mandated signatures.

Architected signatures exist because the system was designed to require them. Code review before merge to production. Change-control approval before deployment to a regulated environment. Two-person rule on a wire transfer above a threshold. Peer sign-off on a clinical recommendation before patient communication. Architected signatures are the engineer’s domain. They can be made faster, more parallel, more granular, more automated, more instrumented. The signature surface in Issue One is, at first reading, the architecture of architected signatures: the harness, the case file, the reliability floor, the audit trail, applied to whichever signatures the operator has chosen to require.

Mandated signatures are something different. They exist because the institution operates inside a constraint the institution did not impose on itself. They are required by an external authority, a regulator, a standards body, a contractual obligation, a fiduciary duty, and the institution cannot architect them away by reorganising the workflow. PCI-DSS attestation by a Qualified Security Assessor at a payment integration boundary. Strong Customer Authentication under PSD2 for European card transactions in scope. Tokenisation under the Reserve Bank of India’s Card-on-File regulation. CFO certification under Sarbanes-Oxley for the financial statements of a US-listed company. Final pharmaceutical batch release under good manufacturing practice. Audit committee sign-off on annual accounts. Strict liability declarations under data protection law. None of these are choices the architect makes.

You cannot architect your way out of a mandate.

There is a failure mode that arrives once an institution starts treating mandated signatures as architectural ones. The agent assembles the case file. The signer reads the agent’s summary. The signer applies their authority to the agent’s recommendation. The artifact looks valid. The audit trail looks complete. The regulator inspects and finds the form intact.

A mandated signature on an opaque case file is not an exercise of authority. It is the simulation of authority by a machine wearing a human face for the regulator.

This is sovereignty leakage, and it is the failure mode the signature surface is designed to prevent. The architecture has to make the signer’s authority real, not its trace.

The signature surface in Issue One was the outer doll. A serious institutional reading of it has to acknowledge that the dolls inside are not architectural choices.

I spent two days last week at a workshop in Goa organised by Digital Futures Lab and Careful Industries with Lloyd’s Register Foundation, on pathways for safer AI. Discussions were under Chatham House rules, so I will not share specifics from the room. What I can say is that the institutional question this trilogy raises is very much present in the conversation among the people who will have to operationalise these systems in regulated, multilingual, public-interest contexts.

This is also the reason the protocol-layer work happening at FIDO, the IETF, and the Linux Foundation’s Agentic AI Foundation is necessary but not sufficient. Google’s Agent Payments Protocol, donated to FIDO on 28th April, supplies three mandate types — Intent, Cart, Payment — that establish a cryptographic vocabulary for representing the transition from instruction to authorisation to execution in commerce. Mastercard and Google’s Verifiable Intent, open-sourced on 5th March, layers an SD-JWT credential chain on top, binding identity to constraint to fulfilment with selective disclosure across three layers. Visa’s Trusted Agent Protocol provides an HTTP Message Signatures scheme, built on RFC 9421, that lets a merchant cryptographically verify the agent at the wire layer. Dick Hardt’s AAuth, in IETF draft, proposes a four-mode access architecture with the Person Server as the institutional authority artifact and Mission as a scoped authorisation context. AGENTS.md, contributed by OpenAI to the AAIF in December, supplies the repo-native instruction surface. DESIGN.md, open-sourced by Google Labs and Stitch on 21st April under Apache 2.0, supplies the equivalent for visual constraints.

These specifications, taken together, establish that the protocol layer can name and enforce who is acting on whose behalf, what they are authorised to do, what visual and behavioural constraints they must honour, and how their actions can be later audited.

The protocol layer can name authority. It cannot grant it. Cryptography solves who. Authority solves whether.

McGuinness has been making this point for two months. In Agents Don’t Need Your Passport. They Need Your Authority, published on 21st February, he separates four concerns that enterprise IAM has historically conflated. Identity asks who the actor is at a boundary. Access asks whether a request may proceed at a specific point. Delegation asks what an actor may do on behalf of another. Authority asks whether the execution should still be running at all. The first three are well-served by current standards. The fourth, McGuinness argues, has no widely adopted equivalent.

The vignette he opens with is the protocol-layer rendering of exactly the failure mode this issue is about. The CFO’s research agent is still running at 2:05 PM, pulling pre-IPO financials, on a mandate that expired when the board approved the presentation at 2:00 PM.

Every IAM control shows green. The breach is structurally invisible.

He calls it ghost execution.

The institutional rendering of the same failure is what mandated signatures are designed to prevent. The CFO’s authority to bind the institution to a financial position has not been delegated to the agent. The agent’s mandate was to assist the CFO in reaching a decision the CFO would sign. When the agent acts after the CFO’s authority has expired, the agent is doing a structurally different thing. It is producing institutional commitments without an active institutional authoriser. At the protocol layer, this is a runtime governance problem. At the institutional layer, it is a signature surface problem. McGuinness proposes the Execution Mandate as the protocol-layer artifact that closes the gap: a signed, inspectable, independently revocable record that runtime systems can evaluate and revoke throughout execution.

The Execution Mandate is what institutional authority looks like cryptographically. The signature surface is what the same authority looks like organisationally.

They are the same architectural object at adjacent altitudes.

Mandated signatures do not exist at one level. They appear across four distinct layers.

They differ in character, they fail differently, and they each impose distinct constraints on what the signature surface can do.

The first is the legal layer. These are signatures required by law or regulation, with statutory or contractual consequences for absence or violation. The examples I have lived with most directly are payments and lending regulation. PCI-DSS requires a Qualified Security Assessor’s report on compliance for any merchant processing cards above certain volumes, and that signature is mandated, not architected, and it cannot be replaced by an automated scan however thorough. PSD2’s Strong Customer Authentication requires multi-factor verification at the cardholder boundary for European card transactions, with regulatory tolerance for failure measured in basis points. The Reserve Bank of India’s Card-on-File tokenisation rules require tokenised storage at the merchant rather than primary account number storage, with mandatory verification of the tokeniser’s compliance posture before merchant integration. Beyond payments, Sarbanes-Oxley requires the Chief Executive Officer and Chief Financial Officer of a US-listed company to certify quarterly and annual financial statements, with personal civil and criminal liability for false certification. The General Data Protection Regulation’s Article 22 grants individuals the right not to be subject to a decision based solely on automated processing where the decision produces legal effects or similarly significant impact.

Mandated signatures at the legal layer are the mechanical joints where the rule of law anchors into the flow of machine execution. They are jurisdictional anchors. The signature surface here produces the case file the QSA reviews, the audit trail the regulator inspects, the evidence package the CFO certifies against.

The second is the reliability layer. Some signatures exist because the system fails dangerously without them. Pharmaceutical manufacturing requires the Qualified Person’s release signature on each batch. Aviation requires sign-off on the Minimum Equipment List before dispatch. A clinical pathway requires a qualified clinician’s countersignature before a non-trivial pharmaceutical intervention. These signatures are not legal in the strict sense, although a regulator may verify their presence. They are reliability signatures, where the institution has determined that the human reading the case file is itself the safety mechanism.

A faster signature is, against reliability mandates, a less safe signature. Some decisions, the human latency is the feature.

The third is the institutional authority layer. Some signatures matter not because they are legally required but because they are how the institution publicly announces what it can be held to. A board resolution authorising a major capital commitment. A press statement under the institutional name. The closing of an acquisition or divestiture. A regulator-facing letter from a Senior Management Function holder. A statement of quality from a named scientist on a peer-reviewed publication. The institution’s standing in its environment depends on these signatures being identifiable, named, and held.

Speed is an architected virtue. Authority is an institutional one.

A faster surface that obscures who actually signed is institutionally weaker than a slower surface that names the signer unambiguously, even if both meet the strict legal requirements. McGuinness’s power-of-attorney framing is the cleanest legal analogue. The institution grants a specific person, in a specific role, the specific authority to bind in a specific domain, for a specific duration, with revocability built in. That last property is the one most often forgotten.

The signature surface has to recognise that as environmental conditions shift — and in agentic systems, conditions shift continuously — institutional authority must autonomously decay rather than persist by default. Anything looser than this is delegation drift.

The fourth is the forensic bridge layer. Some signatures exist not for the moment of decision but for the moment after something goes wrong. Auditor sign-offs that are inspected only when there is an investigation. Independent director attestations consulted in the run-up to litigation. Breach disclosure officer signatures examined by regulators in enforcement actions. Internal compliance certifications that surface in the discovery phase of legal proceedings. These signatures are forensic because they create the institutional artifact that bridges from the moment of action to the moment of reckoning, often years later. The signature surface here has to be designed for a reader who does not exist yet, who will be hostile, and who will be looking for a specific kind of failure. Per-row attribution at the audit-trail layer is the technical instantiation of forensic-bridge thinking — every record affected by an agent’s action carrying agent identity, mandate identifier, timestamp, and human approver chain.

The audit trail is not for the institution. It is for whoever the institution will eventually have to answer to.

These four layers do not commute. They are not different views of the same signature. They are different signatures with different relations to the institutional clock and the regulatory environment. A robust signature surface has to recognise all four and produce different artifacts for each. A legal signature wants the case file to demonstrate compliance with a published rule. A reliability signature wants the case file to make the failure mode visible to a domain-trained reader. An institutional authority signature wants the case file to name the signer unambiguously and bind their role in the organisation. A forensic-bridge signature wants the case file to be discoverable, indexable, and intact decades later.

This is where the late-April events come into focus. The Brussels trilogue, the AP2 donation to FIDO, the Agentic Authentication Technical Working Group formation, OpenAI joining the FIDO board. These are all moves at the protocol layer. They aim at the wire-layer questions of how an agent’s actions on behalf of a user are cryptographically attested, how those actions are bounded by user-signed constraints, how the chain of authority is established and verified. They are not, individually or collectively, decisions about whether the institution agrees to be bound.

A faster protocol layer does not by itself reduce institutional risk.

Consider what is happening at FIDO specifically. The Agentic Authentication Technical Working Group, as announced, has three workstreams: Verifiable User Instructions, Agent Authentication, and Trusted Delegation for Commerce. Each workstream is consequential. None is upstream of the question of which signatures the institution actually requires for what kinds of decisions. AP2’s Intent Mandate cryptographically commits the user to the constraint. Verifiable Intent’s Layer 2 cryptographically binds the constraint to a specific agent. The agent’s Layer 3 fulfilment proves the action stayed inside the constraint. All three are now in motion under FIDO.

None of them tells a CFO whether the institution can certify the resulting financial position.

That decision is upstream of all the cryptography. It is mandated, not architected.

The same applies to the Omnibus question. Whether the high-risk deadline holds at 2nd August or shifts to 2nd December 2027 changes the timing of compliance obligations. It does not change the structure of the obligations. The AI Act requires risk-management systems, technical documentation, automated logging, transparency to deployers, human oversight, accuracy and robustness, and post-market monitoring for high-risk systems. Each is a mandated obligation. The signature surface against the AI Act has to produce the artifacts the regulator will inspect.

It does not get to decide what the regulator inspects.

I am writing this on 3rd May. The Brussels trilogue resumes on 13th May. The August deadline is ninety days away if the original timeline holds, longer if it shifts, but the institutional question does not move with either date. The signature surface is the artifact you point a regulator at, the artifact a CFO certifies against, the artifact a Qualified Security Assessor inspects, the artifact a forensic auditor follows when something goes wrong.

In Issue Three, I will describe how the signature surface is actually built. The harness that bounds agent execution. The case file that packages decisions for signature. The reliability floor that prevents the surface from being a fiction in production. The audit trail that travels with the institution into its future answerability. Each component composes with the others. Each component has to handle architected and mandated signatures differently.

The trilogy does not propose a new standard. It does not propose a new protocol.

It describes the architecture of the layer the protocol-layer work is reaching for from below.

The protocol layer has names for almost everything in that architecture now. AP2 for the mandate vocabulary in commerce. Verifiable Intent for the credential chain. Trusted Agent Protocol for the wire-layer verification. AAuth for the per-instance identity and the Mission abstraction. AGENTS.md for the repo-native behavioural constraint surface. DESIGN.md for the visual constraint surface that emerged at Stitch ten days ago. Each is a piece of the same architecture, expressed at the wire layer or the repository layer, with vendor-neutral governance under the AAIF, FIDO, and the IETF taking shape in real time. The institutional layer above them has fewer names because fewer people are building it.

That is the layer this trilogy is about.

The question worth taking forward, if you have read this far, is the one that distinguishes architected signatures from mandated ones in your own environment.

Where does delegation stop in your organisation? And at that boundary, who can still say no?

The institution either has a signature surface or it does not.

Issue Three describes how to build one.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a professional newsletter on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility. Async. Cross-posted to LinkedIn. You can subscribe on Substack or LinkedIn.

In the last six months, how many of the decisions your AI tools generated have actually been signed off and put into production?

Not generated. Not reviewed. Not discussed. Signed. Owned. Executed.

The answers are revealing. Most leaders pause. Some name one or two. Many cannot name any.

This is not because the systems are not working. The AI tools are running. They are producing strategies, writing code, drafting analyses, modeling scenarios. The output is real and the output is good. What is missing is the moment after the output. The moment where someone in the organization looks at a generated answer and says: yes, this. We will do this. I will own this if it goes wrong.

That moment is where enterprise AI is currently stalling. And the reason it is stalling is not the one most people are working on.

In June 2025, I argued in a public talk that AI’s frontier had moved from intelligence to memory: that systems were failing not because they were not smart enough, but because they could not carry context forward. We solved meaningful parts of that problem. We built memory layers, context pipelines, modular systems. Solving memory did not solve the system; it exposed the next bottleneck. The frontier kept moving, from intelligence, to memory, to workflows, to what I am writing about today: decision systems.

The Bottleneck We Misread

For two years, the dominant assumption in enterprise AI has been that capability is the binding constraint. Better models would produce better outputs. Better outputs would unlock faster decisions. Faster decisions would translate into competitive advantage. The whole industry has organized around this assumption, from procurement strategies to research priorities to talent allocation.

The assumption was wrong. The models are already good enough for most enterprise decisions. What is not good enough is the layer of organizational machinery that sits between a generated answer and a signed decision. Recent industry research suggests that 86% of enterprise AI pilots fail to reach production at scale, and the failures are overwhelmingly organizational rather than technical. The constraint was never intelligence. It was always who is willing to put their name on the line for the answer.

Inside most organizations, decisions move through a familiar pipeline. Something gets generated. Someone selects what is worth attention. Someone validates whether the selection is correct. Someone legitimizes the validated answer, politically, narratively, in terms of accountability, into something the organization can stand behind. And only then does action follow.

AI has accelerated the first stage by roughly three orders of magnitude. The other stages have not changed at all. The pipeline is now structurally lopsided. Generation runs at machine speed. Everything downstream still runs at meeting speed.

The visible output of this asymmetry is not faster decisions. It is unsigned strategies. Hundreds of plausible plans, each defensible on its merits, none of them owned by anyone willing to stake their name on it. Every organization has its version: the deck that never gets approved, the AI-generated proposal that lives forever in Slack threads, the we should do this insight that never becomes a commitment. It looks like progress. It is often just accumulation.

What a Signature Actually Does

To see why this gap cannot be closed by faster generation, it helps to look closely at what happens when someone signs off on a decision. The action looks atomic. It is not. Every signature is doing three jobs simultaneously, and AI has only collapsed the cost of one of them.

The first job is assertion. The claim that this is the right answer, the correct interpretation, the optimal path forward. Modern AI is extremely good at assertion. A capable model with adequate context will reliably produce a defensible answer to almost any business question.

The second job is acceptance. The willingness to own the consequences if the answer turns out to be wrong. This is not a matter of confidence. It is a matter of accountability. When a CFO signs a forecast, she is not merely asserting the numbers are correct. She is staking her professional reputation on a particular interpretation of an uncertain future. If the forecast is wrong, the cost lands on her. AI does not bear this cost. AI cannot be fired, demoted, or sued. The accountability surface remains entirely human.

The third job is activation. The political and narrative work of moving an organization to actually act on the decision. A signed strategy that nobody believes in does not produce action; it produces compliance theater. Activation requires that the signer can defend the decision in front of the board, the regulator, the team, and the customer. AI generates conclusions; humans are still the ones who have to make those conclusions believable to other humans.

Generation has collapsed in cost by three orders of magnitude. Acceptance and activation have not collapsed at all. They cannot, because they are functions of human reputation, organizational politics, and narrative coherence, none of which become cheaper when compute becomes cheaper.

This is the core mechanism. It is not that humans are slow. It is that the things humans do at the signature layer are not the kinds of things that get faster when models get better.

Why Better Models Will Not Solve This

A natural response is to assume that next-generation models will close the gap. Better reasoning will produce more trustworthy outputs. Better alignment will produce safer outputs. Better tooling will produce more auditable outputs. Eventually the asymmetry resolves itself.

This is a comfortable assumption. It is also wrong, and the reasoning matters.

The signature layer is not blocked by model quality. It is blocked by the structural cost of being the human who owns the consequences. That cost is not a function of how good the model is. It is a function of how the organization distributes accountability when something goes wrong. A model that is 99.5% accurate on a class of decisions does not change the accountability calculus for the human who has to sign the 0.5%. If anything, higher model accuracy makes signing harder, not easier, because the human signer is now staking their reputation on catching the rare cases where a highly reliable model is wrong, which is a much harder cognitive task than catching the common errors of a mediocre model.

The argument that better models will solve absorption assumes the bottleneck is trust in the output. It is not. The bottleneck is who absorbs the downside when the output is wrong. Until that question is answered architecturally, until organizations have built the inspectability, the reversibility, and the bounded blast radius that allows a human to sign with proportionate risk, better models do not help. They just produce more high-quality outputs that nobody owns.

The most sophisticated AI deployments I have seen in regulated industries are not the ones with the best models. They are the ones with the most carefully designed signature surfaces. The model is whatever model. The architecture around the model, what it can touch, what it cannot touch, what gets escalated, what gets logged, what gets reversed if it fails, is where the actual engineering effort lives. What broke was not the model. It was the system that accepts its answers.

The Hidden Layer Beneath Validation

Most leaders, asked why a particular AI-generated decision did not get signed, will say it needed more validation. The reasoning got reviewed, the data got checked, but something still was not right. So another round of analysis was commissioned, and another, and the decision drifted into the backlog.

What is actually happening in most of these cases is not a failure of validation. It is a failure of legitimization. The answer was correct. It was simply not yet defensible in the language the organization uses to defend its decisions. There was no story attached to it that would hold up under hostile questioning from the board, the regulator, the team, or the customer. AI produced the conclusion. It did not produce the narrative that lets a human stand behind the conclusion.

This is why some of the most useful AI deployments I have seen do not stop at generating the answer. They generate the answer alongside the reasoning that would survive challenge: the explicit assumptions, the alternatives that were considered and rejected, the conditions under which the answer should be revisited, the failure modes the answer is exposed to. This is not redundant work. It is the work that makes the difference between an answer and a signable answer.

The organizations that figure out how to generate this layer alongside the conclusion will move at a fundamentally different speed than the ones still treating AI as a faster spreadsheet.

The Asymmetry That Sustains the Clog

There is one more dynamic worth naming, because it explains why the situation persists even when leaders understand it intellectually.

In most organizations, the cost of not deciding is invisible. A memo can sit unsigned for two weeks and nobody notices. A strategy can languish for a quarter and nobody is held accountable. Meanwhile, the cost of signing wrong is career-ending. A bad decision signed is documented forever; a good decision unsigned is invisible.

Every rational manager facing this asymmetry discounts action. They wait. They request another round of analysis. They circulate the proposal one more time. Until inaction has a measurable cost, until not deciding is also a decision someone has to sign for, organizations will continue to default to delay regardless of how good the AI outputs are.

This is the asymmetry that sustains the clog. It is also the most fixable part of the system, if leadership is willing to make inaction visible.

What Changes in the Organizations Doing This Well

The organizations that are successfully shipping AI at scale are not deploying smarter agents. They are redesigning the signature layer. Three patterns show up consistently.

The first is decision tiering. Not every output needs a signature. A reversible action with a small blast radius can run autonomously, with humans auditing the anomaly log rather than approving every execution. An irreversible action with a large blast radius requires explicit human authorization with the full context attached. Most organizations today treat all AI outputs identically. Every output gets the same review process regardless of consequence. This is structurally wasteful and behaviorally counterproductive. It trains humans to rubber-stamp, because rubber-stamping is the only way to keep up.

The second is signing the boundary, not the output. The traditional model has the human reviewing each output and approving it. The new model has the human signing the constraints: what the agent is allowed to touch, what triggers an escalation, what the failure modes are, and then auditing the agent’s behavior against those constraints. The leader signs once, at the boundary level. Everything operating inside that boundary is pre-authorized. Accountability moves upstream from output review to constraint design, where the leverage is higher and the cost is paid once instead of ten thousand times.

The third is making inaction visible. Some organizations are starting to treat not deciding as a decision that itself requires a signature. Deadlines are enforced. Ownership is assigned. Delay is logged. This is the simplest of the three shifts and the one most organizations resist longest, because it changes the political economy of meetings.

These three shifts are not novel ideas. They are the operational substrate of the most mature AI deployments in regulated industries. What is new is the recognition that they are not optimizations layered on top of model deployment. They are the primary engineering problem. The model is the easy part.

The Reframe

For two years, the question driving enterprise AI strategy has been which model do we use. The question that will drive it for the next two is how do we redesign accountability so the model’s outputs can actually be owned.

The organizations that figure this out first will not be the ones with the smartest models. They will be the ones with the shortest distance between generated and signed. That distance is not a function of compute. It is a function of how the organization has architected the layer where decisions stop being computational and start being institutional.

I have started calling this layer the signature surface. It is the part of the enterprise that determines whether AI capability translates into organizational capacity. Most organizations have not yet noticed they have one. The ones that have are quietly running ahead.

What is the last AI-generated decision in your organization that actually got signed?

Share Layer 8

— Anivar A Aravind

This is the first issue of my newsletter. It has no schedule. It publishes when there is something to say.

The professional surface I work on covers regulated payments, agentic identity, AI & agentic governance in production, and the architecture of public computing. The throughline is this: scaling systems is straightforward; scaling systems that can be trusted is not. This newsletter tracks the standards, drafts, and political choices that determine whether digital infrastructure remains correctable by the people it operates on.

Today’s issue is about an identity standards problem. Future issues may be about something else.

The Intent–Execution Gap

For over two decades, the internet’s identity layer has answered two questions: who is acting, and what are they permitted to access. SAML, OAuth, and OIDC all rested on a quiet assumption: the entity initiating the request was the same entity that wanted the action to occur. User and intent collapsed into one principal

Autonomous agents break that assumption.

When an AI system invokes a tool on your behalf, three elements that used to be indistinguishable become separate. There is the user, the human who originally authorized the action. There is the agent, the software deciding how to fulfill the prompt. There is the action, the API call that lands at a protected resource. In the traditional model, all three were a single principal. In an agentic model, they are separate actors with separate trust properties, often operating days or weeks apart from the original context.

Within the IETF, the draft on Agentic JWT has named the space between these actors. They call it the intent–execution gap.

It is the most important phrase in identity standards work right now, and almost nobody outside the working groups is using it.

What the gap actually is

A user tells an agent to book a flight to New York for under five hundred dollars. The agent searches, evaluates tradeoffs, selects an itinerary, and calls a booking API.

Between the human instruction and the machine execution, a sequence of implicit choices happens. The agent interprets under five hundred — does it include taxes, fees, baggage. It weighs carrier preferences. It picks a fare class. It decides whether to add a seat selection. The user authorized a goal. The agent executed a specific series of decisions.

When the booking happens, the protected resource sees an API request attached to a token. The token proves someone was authorized. It does not say what the human intended, who delegated the authority, what constraints were supposed to apply, or whether the action faithfully matches the original intent.

Authorization protocols were built to carry identity. They were not built to carry intent. When execution drifts from intent, the protocols have nothing to say about it.

Working groups are now iterating drafts to close this gap. AAuth, Agentic JWT, the OpenID Foundation‘s AIIM landscape, AGNTCY under the Linux Foundation, NIST‘s work on delegation chains, WIMSE workload identity — all attempts to retrofit intent into the infrastructure. They disagree on how. They agree on what.

Why this is a political fight, not a technical one

Standards bodies produce technical artifacts. The artifacts encode political assumptions. This is true across the stack, but it is acutely visible at the identity layer, because identity is where systems decide who counts.

Three structural assumptions are being negotiated right now, mostly without a public audience.

1. The Architecture of Survivable Incorrectness

Agentic systems will misinterpret intent. The architectural question is no longer how to engineer zero failure; it is whether failure contains itself or compounds. OAuth and OIDC were optimized for stolen credentials: a token is either valid or revoked. Agentic systems present a different worst case — an entity that is correctly credentialed and doing the wrong thing. That requires a different design philosophy. Karl McGuinness has been arguing this frame across his AAuth analysis and his Mission Shaping and Power of Attorney essays. The next AAuth revision will indicate whether survivable incorrectness has been adopted as a design constraint or treated as a nice-to-have.

2. The Mandate–State–Owner Triad

Every autonomous action implies three things: the mandate (what was authorized), the state (what the agent has done so far), and the owner (who is accountable when the action lands). The drafts disagree on how to represent these. Some collapse them into a single token. Some bury state inside the agent runtime. Some link ownership directly to credentials. These are not interchangeable engineering tradeoffs. They determine who ends up in court when an agent moves money to the wrong account or deletes a production database.

3. The Dispute Over Whose Key Signs the Action

The disagreement on cryptographic delegation is unresolved. Three options are live in the drafts: the user signs every downstream agent action (which limits autonomy), the agent receives delegated credentials (which creates a liability surface), or intermediate orchestrators form signing chains (which obscures accountability). Each option encodes a different theory of responsibility. Whichever method is formalized will become baked into foundational libraries, and will be very hard to change once deployed.

These are political choices. They are being made by the people who show up to the meetings. They will be lived with by everyone else.

The Structural Lens

A note on framing for future issues. The protocol-layer questions in this newsletter are not abstract. They map to a concrete structural question I have been working on at length: whether digital infrastructure remains correctable by the people it operates on. Five conditions — exit, inspectability, independent audit, binding governance, and reproduction rights — define whether a system is reversible or captive. The full argument is at anivar.net/corrigibility; future issues will return to these tests when a specific standard or deployment is worth examining through that lens.

For most issues, including this one, the lens stays in the background. The intent–execution gap is interesting on its own merits. Whether the standards being drafted satisfy structural correction tests is a question for another issue.

If you are tracking this conversation, write back. The list of people thinking carefully about agentic identity outside the working groups is short. It should not be.

— Anivar A Aravind