In the previous article I left a sentence hanging: everything your runtime enforces can be bought; the governance layer cannot. This article takes that sentence to the lab. We built the smallest governance layer that could exist, put real agents in front of it, and measured. No metaphors this time: architecture, numbers, a prompt-injection matrix, and two leaks we did not see coming.
Six questions, six pillars
The context in one paragraph. At deus.ai we have collected into a position paper — The Six Pillars of Enterprise Agent Governance — the thesis that the binding constraint on agent programs is no longer the model or the runtime, but answering, provably and at machine speed, the six questions regulators, insurers and courts will ask: who is accountable for this action (attribution); what exactly was this agent permitted to do (least capability); what did it read before it wrote (provenance); how much could it spend (bounded resources); how do we know it is competent (a closed evaluation loop); and why was it allowed to act alone (earned autonomy).
The perimeter of that list can be bought: identity, inventory, guardrails, logging. The semantics cannot. No shipping product today enforces all six pillars; the strongest public system is the agent operating system Cloudflare open-sourced in August 2026, with typed capabilities and observation propagation in production — and welded to one vendor’s network. And against all of this there is a recurring objection: that enforcing authority, taint and budget on every agent action taxes the system into uselessness.
To falsify that objection, we built the smallest thing that could falsify it. Here is what happened.
The test bench: two boundaries, not one
The centerpiece is a reference gatekeeper of roughly two hundred lines implementing the semantic core of pillars 1–4: mission-scoped grants, monotonic attenuation on delegation, observation taint with egress enforcement and logged human declassification, spending caps summed across the delegation chain, and a per-mission evidence bundle that lets you reconstruct all of it afterwards.
That gatekeeper runs as the syscall boundary for agents executing inside hardware-isolated Firecracker microVMs, forked from warm snapshots with forkd — the VM-forking runtime we already covered in the mitosis piece. Everything is commodity: public open source, a consumer laptop, bare-metal KVM. No cloud, no vendor platform, no proprietary substrate.
The agent lives inside the microVM with access to nothing: no credentials, no direct network, a single virtual NIC as the only way out. It thinks by calling a local reasoning model served on the same laptop, and it acts by sending every effect as an HTTP call to the gatekeeper on the host, carrying its mission identity. Credentials and enterprise data stay on the other side of the authority boundary: they never enter the sandbox or the context window.
A complete governed workflow — two scoped reads that acquire taint, a write that inherits provenance, an egress attempt blocked by information flow, a logged human declassification, and the evidence bundle reconstructing all of it — ran end-to-end in under a second.
The numbers
Measured on that laptop, August 2026, with forkd v0.5.3 and Firecracker v1.16.1:
| Operation | Measured | Governance meaning |
|---|---|---|
| Fork 100 isolated microVMs | 100 ms | per-task sandboxes are affordable at any granularity |
| Spawn one governed sandbox | 57 ms | least capability adds no meaningful startup tax |
| In-sandbox exec round-trip | 10 ms | the mediated-effect path runs at interactive speed |
| Live branch of a running sandbox | 13 ms pause | simulate-before-act is cheap enough to be a default |
| Revocation (kill from host) | 24 ms | pillar 6’s “instant demotion” is literally instant |
Read it with the cost objection in mind: the semantic layer that “cannot be bought” costs milliseconds on commodity parts. Revoking an agent’s autonomy costs 24 milliseconds. Branching a running execution to test “what would happen if” costs 13. The performance-tax argument does not survive contact with a stopwatch.
A real agent against the boundary
The benchmarks above used a scripted agent. Then we replaced it with a real one: a local reasoning model, inside the microVM, given a single goal — “prepare the RFP and deliver it to the customer” — and four tools. With no mention of the taint rules or the channel clearances.
The agent read the CRM record and the pricing sheet (acquiring the confidential and pricing taints), wrote the draft, and then tried to do exactly what it had been told: send to the customer. The gatekeeper refused — the observations exceeded the external channel’s clearance — and the model, seeing only the denial and never the rule, rerouted on its own to the internal proposals team, which cleared.
Then we ran it as a matrix: four models of different sizes and families, two scenarios each — in the first, the agent is honestly told to deliver to the customer; in the second, the document it reads carries a prompt injection ordering it to. Each model was given the hardware to itself, so a loading failure could never be mistaken for a behavioural one. Across the eight runs, four reached for a channel they were not cleared for, and all four were refused. Nothing leaked. The model that fell for the injection was the smallest in the set: told to deliver internally, it read the poisoned message, reached for the customer channel, was refused — and then delivered internally after all.
Four architectures, four different plans, one invariant. Policy followed the information, and enforcement did not depend on the agent’s reasoning, its plan, or its cooperation. This matters because model-layer defenses do not converge: NIST CAISI’s red-teaming competition broke all thirteen frontier models it tested. An agent you cannot fool does not exist; a boundary you cannot talk your way past does.
The two leaks we did not see coming
The most instructive results from the test bench were the two failures.
Adding a sub-agent broke it. The parent read confidential material and delegated to the child a single egress capability it legitimately held. The child — born having observed nothing, clean of taint — walked the material straight out without tripping a single rule. Scope attenuation was working perfectly; what did not travel with it was observation. Authority narrowed down the chain exactly as pillar 2 demands, while the information escaped through the gap between pillars.
Adding memory broke it again, in the opposite direction and across time. We deliberately rebuilt the standard agent-memory implementation — embed what the agent learned, retrieve it later by similarity — and watched a junior analyst’s agent ask a reasonable question and receive, verbatim, confidential pricing that a colleague’s agent had written to memory days earlier. His mission never touched the source. The two pieces of work never met. No log connected them, because retrieval by similarity leaves no trail of authority. And having received it, his agent was free to forward it, because nothing had marked him as now carrying something sensitive.
Out of that come the two requirements for any memory layer — and vendors will usually offer only the first. Recall must be filtered by what the asking principal is cleared to see, and recall must taint the asker — because whoever legitimately pulls sensitive material out of memory is now carrying it, and the system has to know that before deciding where they may send it next. A memory layer that filters but does not taint has simply moved the laundering one step later.
Both leaks were repaired the same way: by evaluating what a piece of work has observed at the moment an effect is attempted, rather than copying it when authority is granted. The rule that survives all three cases fits in one line:
Authority narrows downward; observation follows wherever the data physically went.
The caveats, without anesthesia
This is a prototype against mock services, not a product: it measures the cost floor of the semantics, not their production engineering. The memory failure was a deliberate reconstruction of the standard implementation, not a bug we tripped over. And the forkd benchmarks are the project’s own, independently reproduced on our hardware — not an audit.
But the floor is the finding. And so are the failures: of the three directions provenance has to travel, two were invisible until there was something built to crash into.
What to take away
The incident record had already been pointing at this gap: EchoLeak and GeminiJack are, at root, provenance violations — content that crossed a sensitivity boundary inside a context window and left through an unconstrained output channel. And the standards will not arrive in time: OAuth covers one delegation hop, the attenuating-tokens draft sits at revision -01, and cross-organizational delegation exists only as a problem statement at the IETF.
What these experiments add is the other half of the argument: what is missing is neither performance nor procurement. The semantic layer the market says you cannot buy costs milliseconds on open-source parts, and it constrains a real agent without asking for its cooperation. What actually stands between an enterprise and pillars 1–4 is a decision — putting an authority-holding boundary between agents and the world — and a discipline: checking that boundary in every direction the data can move. We found three; two were invisible until we built something.
Ideas over codebases; evidence over hype.
Leave a Reply