AI controls architecture

Risk teams know risk. The open problem is designing controls for systems that are non-deterministic, probabilistic, and attackable in natural language.

Every other agentic AI risk has an engineering answer. Prompt injection doesn't. That changes everything about how you design controls.

Four interactions between agentic properties create risks that manual governance cannot address. The category boundary is not AI versus traditional — it is systems that act versus systems that advise.

Agent governance cannot stop at model behavior. Once AI systems use tools, the governed object is the whole workflow.

Finance agents are evidence custody systems before they are model systems.

AI governance keeps choosing between rigorous-but-slow validation and fast-but-unfalsifiable frameworks. The escape is the experiment itself: for any measurable claim, the measurement is the faster path.

The sequel to the calibration gap: some governance claims have no number, and that does not excuse them from evidence. Pre-register the rule, invite the refutation, name the residual, report honestly.

A green result is a true statement about a stand-in. Whether that stand-in resembles the thing you care about is a separate question, and the check cannot answer it.

When agents generate faster than anyone can read, the standard answer is a second model reviewing the first. Aerospace decomposed what makes a check independent decades ago, and a reviewer model fails the hardest of the three tests.

Cerebras published an unusually honest account of their internal knowledge base. The retrieval engineering is solved. The assurance layer gets one sentence. Every enterprise copying this pattern is importing that asymmetry.

Six cell biology mechanisms that reveal what the networking 'control plane' metaphor misses about governing AI agents.

The useful unit in agent systems is not a better instruction. It is a tested capability package: judgment, code, checks, routing, and boundaries.

For many agent workflows, the right abstraction is not another tool call. It is a bounded program over small primitives.

Long-running agents are not defined by the model call. They are defined by the state, rules, tools, failures, and corrections that survive it.

Model risk reviews the model. Application security reviews the application. Neither sits behind the agent at execution time, watching the verbs as they go out.

Once model companies supply the generic agent harness, the valuable work moves into workflow design, human intervention, domain data, and the definition of good work.

Enterprise AI stops being a chatbot when the operating procedure becomes the thing the system can execute, inspect, and improve.

Model revenue is not customer return. The economic and risk unit is the harness that turns model output into accountable work.

Coding agents move the bottleneck from implementation to shared intent.

When execution gets cheap, the scarce work moves to framing, review, and the systems that preserve judgment.