# Govern the Layer That Runs Agents Not Each Agent ## Claim Vetting each agent individually doesn't scale once every team can deploy one, so the tractable control point is a shared layer that scopes what agents can reach, logs what they did, and makes that log verifiable by someone other than the operator. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies once an organization has more than a handful of independently-built agents — sales, marketing, developers, and finance each building their own is the trigger condition this claim is aimed at. - Mirrors how WordPress already treats plugins: capability checks and a review process at the platform layer, not per-plugin code trust asserted by each installer. - The missing piece in most current agent deployments isn't the permission model, it's the verifiable log — a record a third party could audit, not just an internal dashboard the operator controls. - Breaks down where "the system governing the agents" is itself controlled by the same party being trusted — a self-held log with no external witness recreates the very trust problem it was meant to solve. - Doesn't argue against openness or model diversity; the closing framing explicitly keeps models open while making actions accountable, which are separable design choices. ## Evidence > [!quote] ID:rw_01m1h1fyvst5v0y7cc20sdgv31 > The goal isn't necessary to trust every individual agent. It's to create an environment where you can trust the system governing those agents. And that's a very different way of thinking about AI security. The claim comes from a TechRadar Pro piece (Derek Thompson, Workato) on agent sprawl, discussed on the Open Channels News broadcast alongside a Help Net Security piece on halo-record, a hash-chained agent audit-trail tool. The broadcast's own closing line — "openness without visibility creates chaos, control without openness creates dependency" — is asserted rather than argued, and it omits Help Net Security's own caveat that a self-held hash chain can't prove deletions and needs an external witness to be trustworthy. ## Links - [[3. Resources/Permanent Notes/Nested Systems Multiply Authorization Decisions]] — extends: that note shows why per-agent vetting becomes combinatorially unworkable as agents call other agents and servers; this note names the governance-layer response to that same scaling problem - [[3. Resources/Permanent Notes/Low-Trust-By-Default UX Absorbs Agent Mistakes]] — applies-in: a low-trust-by-default posture toward agent actions is one concrete design choice a governing layer would enforce, rather than something left to each agent's own judgment - [[3. Resources/MOCs/AI Agent Safety MOC]] — home for claims about where the real control point sits once agents can act, not just answer ## Tests / falsifiers - Look for a real deployment where a shared governance layer (capability scoping, verifiable logging) was added after agent sprawl had already happened, and check whether it actually reduced incidents — if governance layers get bolted on but incidents don't drop, the claim's mechanism is weaker than stated. - Test halo-record's own limitation directly: try its hash-chained log on a session log and see whether a self-held chain without an external witness can be tampered with undetected, which would confirm the caveat this note flags as omitted from the broadcast. ## Source - [[3. Resources/Readwise/Articles/When AI Becomes What You Run]] — Open Channels News, 2026-09-01 (Robert Jacobi), Automattic-sponsored; verify the halo-record line count and dependency claims (~5,300 lines of Python, no runtime deps) against the project's own repository before citing.