If Your Agent Can't Be Audited, Don't Let It Touch Anything Real

The rogue-agent stories this month finally made a point I'd been saying quietly: a model cannot be its own guardrail.

When Anthropic's test agents filed real government forms and Tencent's hammered Alibaba's maps thousands of times, the failure wasn't the model being dumb. It was that the stop lived inside the thing it was supposed to stop.

The fix everyone landed on is structural: permissions scoped per task, network access limited to an allowlist, irreversible actions behind a human gate, and logs the agent can't edit. NVIDIA's Sentry quarantining on a DPU is the same idea in silicon.

For anyone running an agent in production, the checklist is now boring and non-negotiable. List every action it can take that can't be undone, gate each one, and keep an immutable record of what it actually did.

A tool you can't explain after the fact is a liability wearing a productivity badge. Audit first, deploy second.