20 September 2026 · Prashant Chamarty · 6 min read operating-model agents controls governance Discuss this essay:
\nVendors sell task-completion. Enterprises buy without owning outcomes, keys, or mistakes. One sandbox is not a control system (Noam Brown). The missing work is roles, workflows, decision rights, and controls: who defines done, who holds the keys, who may escalate or monitor, and who owns the second check.
\nEnterprises treat probabilistic agents like deterministic SaaS. They copy the consumer “build something agents want” form factor (Levie, 19 Sep 2026) and skip ownership. That shape becomes a shopping list: APIs, MCP servers, connectors, sandboxes, spend wallets. Procurement buys every item. The handoff has no owner.
\nWho decides the task is complete? Who authorised the keys? Who stops the run when severity flips? Those answers do not ship with the SDK.
\nBuild something agents can use. Then design something humans can own.
\nPick GDPR deletion. The agent triages customer requests. “Delete my account” comes in. The agent classifies: routine, low-severity, auto-execute.
\nThe customer meant “pause my subscription.” The agent read “delete.” It has write access to the CRM. It deletes the account. The customer is a £2M enterprise client mid-renewal.
\nEscalate queue: The agent routed edge cases to “escalate.” No named owner. No SLA. The queue has 400 items. This one sat for six days.
\nKeys without a grantor: The agent has CRM write because “end-to-end completion” shipped without least privilege. Who approved that scope? Who can revoke in under an hour?
\nWho gets fired: Not the agent. The compliance officer who signed off? The product owner who built it? The vendor who sold task-completion?
\nKeys without a named grantor and a revoke path are blast radius with a logo.
\nLevie’s Jev × Box demo shows judgement at machine speed. Pull an incident. Ask if it is customer-facing and how severe. Route to escalate, monitor, or review. Stamp metadata. Fast. Cheap (18 Sep).
\nThe folders are the easy part. The rights are not.
\nDone. Escalate, monitor, and review are verdicts, not labels. Someone must say when monitor is allowed and when escalate is mandatory. Someone must define done for the person who inherits the file. Otherwise the agent classifies, and the incident still has no owner.
\nKeys. End-to-end completion means write paths: systems of record, spend, customer data. Consumer agents want transactions. Enterprise agents want access. Muse-style handoff needs tools and the ability to transact (Levie on Muse). That works when the agent competes for attention, not when it deletes the renewal pipeline.
\nWrite access is not symmetric. Draft-write is reversible: a human commits. State-write has immediate structural impact: CRM state changes, schema migrations, data shares, payments execute. True autonomy leans on state-write. That is why the governance argument is mandatory.
\nTriage rights. The taxonomy only works if escalate, monitor, and review have named roles, time boxes, and an audit trail. Else the agent sorts into queues nobody empties.
\nHeroes still need this. Connectors and consolidation are not enough (From 100 Agents to Two Heroes). Without verdict rights, a hero is a pilot with better branding.
\nGiving a day-one intern a corporate card with a £5,000 limit does not eliminate fraud risk. It caps the ruin. The control is not the limit. The control is counter-signature, monthly reconciliation, and a manager who can freeze the card.
\nA sandbox works the same way. It caps waste. It does not prevent it. One fence is single-point failure dressed as defence.
\nNoam Brown’s clarification matters. Absolute isolation guarantees are hard. Layers of defence matter. Agents that are supposed to be independent can still coordinate with very few bits. The Hugging Face lesson, in his words: too much trust in the sandbox, not enough independent safeguards. Design as if you overestimated the risk (Noam, 18 Sep; Dwarkesh episode post).
\nDwarkesh puts the operator question next to the lab one. When capability rises, how do you know the system is aligned before you grant more autonomy (18 Sep)?
\nEnterprises hear “sandbox” and relax. That is single-fence overconfidence. A sandbox is one control. A control system stacks policy, least privilege, independent monitoring, human stop authority, and a second check the deploying team does not own.
\nAnca Dragan and Rohin Shah argue we should keep Chain-of-Thought monitorable on purpose, not assume it lasts (Anca on X; DeepMind Institute essay). If you cannot see how the agent reasoned, your “monitor” path is a folder name.
\nPick one pattern. Make it concrete. Visualise the circuit breaker.
\nPattern: A human-in-the-loop dashboard with a deterministic financial threshold. Any action above £10,000 cumulative impact routes to mandatory human review before execution. The dashboard shows agent reasoning, proposed action, and calculated risk score.
\nOwner role: The Compliance Lead, independent of the deployment team, has stop authority. They can halt the workflow, revoke agent keys without escalation, and approve or reject state-write actions before execution. Audit trail required. Decision logged and reviewed quarterly.
\nFor critical systems, pre-execution gates matter more than post-execution rollback. You cannot un-ring the bell. A CRM delete, an unapproved vendor payment, a schema migration: the damage happens on commit. A four-hour reverse window is an illusion for state-write. Build the circuit breaker before the write, not after.
\nThat is one version. The pattern matters less than naming it, funding it, and giving one person outside the product team the power to say no.
\nPick one workflow. Answer these in writing before you ship.
\nVague answers mean you bought a form factor. You did not ship an operating model.
\nPick one agent workflow you call production this week.
\nIf you need a slide to answer, you copied what agents want. You did not ship an operating model.
","headings":[{"level":1,"text":"Done, Keys, and a Second Check","id":"done-keys-and-a-second-check"},{"level":2,"text":"TLDR","id":"tldr"},{"level":2,"text":"The root cause: treating probabilistic agents like deterministic SaaS","id":"the-root-cause-treating-probabilistic-agents-like-deterministic-"},{"level":2,"text":"When the blast radius has a name on it","id":"when-the-blast-radius-has-a-name-on-it"},{"level":2,"text":"Done, keys, and triage are the real product","id":"done-keys-and-triage-are-the-real-product"},{"level":2,"text":"One fence is not a control system","id":"one-fence-is-not-a-control-system"},{"level":2,"text":"Stop authority: the circuit breaker and who owns it","id":"stop-authority-the-circuit-breaker-and-who-owns-it"},{"level":2,"text":"Four answers before go-live","id":"four-answers-before-go-live"},{"level":2,"text":"Sources","id":"sources"},{"level":2,"text":"Challenge","id":"challenge"}]}}