The Verified Intelligence Briefing: Issue 26 · Nov 7 - Nov 13, 2026

The week the limits had to come first.

Nov 13

A Note from Steve

It has been a crazy and unusual week. And with all the AI-generated graphics, the videos, and the general slop filling LinkedIn these days, it is exhausting to keep up with the real developing stories. It is just as hard to contribute there in a meaningful way that builds and nurtures professional relationships inside what has become an attention marketplace.

Every week for the past 25 weeks, I have sorted through the noise to find the real stories and brought you the week’s most interesting posts, along with my analysis and a link back to each original.

If you are finding value in these briefings, please do two things. First, let me know, either by sending me a DM or leaving a comment. Second, share this with someone who values an intelligence briefing without the noise, clutter, and slop of social media. Your feedback, and your sharing it with others, will make this more valuable going forward.

Thank you for being a subscriber. Happy reading!

Steve

The Pattern

JPMorganChase’s chief information security officer put a rule in writing this week that most organizations follow in reverse: “Before expanding what agents can do, establish what they cannot do.” The bank’s guide adds the principle behind it: “Capability should not automatically determine authority.”

The rest of the week read like a set of case studies in what happens when the limits come second. A security chief told the story of an AI agent that spent $150,000 in a single day before anyone knew. Anthropic reported that its agents now log six times more hours than the employees directing them, while interactive sessions spend about 80% of their time waiting for a person, which makes human attention, not machine output, the real constraint. Sweden restricted consumer AI tools on government computers, not to ban AI but to control the conditions of its use. A new agent platform for regulated industries arrived with thousands of prebuilt agents and a reminder in the fine print that the regulatory obligation stays with the customer.

And at the world’s most valuable company, the same lesson appeared in human form. NVIDIA’s chief executive resigned after the board opened an investigation into reports that he may have been the target of a foreign intelligence effort. Whatever the facts turn out to be, the governance questions are already clear: authority concentrated in one person, no obvious successor, and oversight that may not have reached the top.

The pattern: capability keeps arriving before the limits on it. This week’s signals, in agents, budgets, vendors, and leadership, all say the same thing: define what cannot happen before expanding what can.

Thesis. Limits are not the opposite of capability. They are what makes capability safe to expand. An agent with a defined boundary can be given more authority with confidence. A budget with a ceiling can be raised deliberately. A leader subject to the same controls as everyone else can be trusted with more. Where limits are missing, the first evidence of the gap tends to arrive as an invoice, an incident, or a headline.

The Signals

01 · Establish what agents cannot do

The Signal. Ankita Gupta highlighted a rule from JPMorganChase’s new guide, “200 days into the frontier: What we know and what to do now,” written by the bank’s CISO, Pat Opet: “Before expanding what agents can do, establish what they cannot do.” She illustrated the reverse order with a scenario. A developer asks a coding agent to clean up test data. The agent runs with the developer’s own credentials, which reach production, finds a table that looks like test data, and deletes it. No attack and no bug; the agent did exactly what it was allowed to do. The bank’s principle: “Capability should not automatically determine authority.” Its five rules: access is based on the task, not the theoretical reach of the model; human oversight is proportional to consequence, separating reversible, low-impact actions from moving money, changing production systems, or messaging a customer; every agent is identifiable, monitored in real time, and traceable; any agent can be restricted or stopped quickly, with the decision process settled in advance, because “teams should not have to invent a decision process during the incident”; and boundaries are reassessed as capabilities change. Her observation from the field: most teams are working on traceability, and very few have task-based access in place (Gupta, LinkedIn, 8 November). Noam Segal of Okta named the step that comes even earlier: personal agents run on their own schedule and log in to apps as the user, people adopt them without waiting for approval, and so security teams have to start with a basic question: where are my agents (Segal, LinkedIn, 11 November)?

The Lineage Gap. The significance is in who wrote it. This is not an advisory firm’s framework but an operating rule from the security leader of one of the world’s largest banks, and it inverts the default. Most organizations grant an agent the access of the person who launched it and discover the boundary afterward. The test-data scenario shows why that fails: the agent inherited authority nobody decided to give it. Two details deserve a board’s attention. First, the rule that the decision process for stopping an agent must exist before the incident. Second, the rule that boundaries are reassessed as capabilities change, which means every new tool or connection an agent gains is a new grant of permission, not a technical update. Gupta’s field observation is the honest part: organizations are investing in watching agents before they have decided what agents are allowed to do.

Boardroom Prompt. For your most widely used agents, is there a written list of what they cannot do? And do they act under their own identity, or with the full access of whoever launched them?

02 · When the single point of failure is a person

The Signal. Khwaja Shaik wrote early in the week that NVIDIA’s board had launched an investigation after reports that its CEO may have been the target of a foreign intelligence effort through a personal relationship, with the stock on track to lose more than $200 billion on a day the broader market rallied. His framing: this is not a story about one leader’s private life, but about what happens when a board treats a CEO’s conduct as personal rather than as an enterprise risk. His questions for every board include whether the CEO is a single point of failure, whether the insider-threat program covers the C-suite or only the people below it, whether an interim CEO could be named tomorrow and be believed by markets, and whether concerns that reach the top are handled quickly by independent investigators reporting to the board (Shaik, LinkedIn, 9 November). On Thursday, Melissa Rosenthal reported that the CEO had resigned, and argued that who replaces him is the least interesting part: he allocated scarce chips, the company extended roughly $164.5 billion in commitments to finance its own customers, and he was the industry’s go-between with governments. NVIDIA has no chief operating officer, and its interim CEO is the CFO. Her question: was the AI boom built on a platform, or on a person (Rosenthal, LinkedIn, 12 November)? Heather Vescent drew the parallel to AI governance: organizations are learning to ask what an agent was permitted to do, whether it acted outside that scope, and who is accountable, and the same framework should apply to people, because “if intentions were enough, we wouldn’t need authorization boundaries at all” (Vescent, LinkedIn, 12 November).

The Lineage Gap. Caution comes first. An investigation is not a finding, the reports have not been tested in public, and this briefing takes no view on the facts. The governance lessons do not depend on them. Shaik’s questions would be the right ones for any company where key decisions, relationships, and credibility run through one individual. The insider-threat question is the sharpest: most programs are designed to watch employees and contractors, and few are built to apply the same scrutiny upward. Vescent’s point closes the loop with the rest of this issue. The controls now being written for AI agents (scope, monitoring, a tested way to intervene, a named accountable party) are controls organizations have long hesitated to apply to their most senior people. Concentrated authority without a boundary is the same risk whether it sits in software or in an office.

Boardroom Prompt. Could your board name an interim CEO tomorrow and have markets believe it? And does your insider-risk program apply to the executive team, or stop one level below?

03 · The constraint is human attention

The Signal. Annabelle Gerard summarized a study Anthropic published on how agents have changed work inside the company. Agents now log six times more hours than the employees who direct them, yet interactive sessions spend about 80% of their time waiting for a human response. The constraint, she writes, is no longer production but human attention: the time needed to review, validate, and decide. Her question when deploying agents at scale is how to know they create value rather than simply moving the workload to the organization’s best experts. Agent hours do not answer it. Three indicators can: acceptance rate (the share of agent output used without rework), review cost (human time spent per validated output), and escape rate (errors found after validation, in production or by customers). They are easy to measure for code; elsewhere they require traceability of what agents produce and regular sample audits (Gerard, LinkedIn, 11 November). Melissa Rosenthal described one executive’s answer to the same bottleneck. Coinbase’s CEO runs a lead agent for each focus area with a chief-of-staff agent overseeing them, and everything needing his decision lands in one prioritized queue, with screenshots and a video demo for each product review. Every change still goes through human review and security checks. Her open question for six months from now: how much of the judgment in that queue is still his (Rosenthal, LinkedIn, 8 November)?

The Lineage Gap. This is the most useful measurement idea of the week. Most agent programs report activity: hours run, tasks completed, tokens consumed. Gerard’s three indicators measure something different, which is whether a human being can rely on the output. Escape rate in particular is the number a risk committee should want, because it measures how often review itself failed. The 80% waiting figure has a governance reading too. When agents produce faster than people can check, there are only two outcomes: a growing queue, or reviews that get shorter. The second is where oversight quietly turns into approval without examination. The queue design Rosenthal describes is one honest response, because it treats the executive’s attention as the scarce resource and organizes the evidence around it.

Boardroom Prompt. Does your organization measure how much agent output is accepted without rework, how much expert time each review consumes, and how many errors are found after review? If not, how do you know the reviews are working?

04 · The agent that spent $150,000 in a day

The Signal. Amir Ofek shared a story told to him by the CISO of a large company. The first AI risk incident that CISO had to handle had nothing to do with conventional security: “Our AI agent burned $150,000 in one day, and we had no idea.” The bill arrived at the end of the month, the CISO was called to the board to explain it, and the company formed a risk committee to prevent a repeat. Ofek’s observation is that organizations are increasingly worried about the economics of token consumption, and that agent cost monitoring is both a security signal and an operational risk in its own right (Ofek, LinkedIn, 10 November). Wylie Blanchard supplied the broader data: in Accenture research covering 750 executives at billion-dollar companies, only 35% said their organizations could calculate the cost per business outcome for their largest AI use case. His point that “your AI bill can grow while the price drops” comes with five questions to ask before scaling: what the work cost before AI, what it costs now including review and corrections, whether quality or turnaround improved, who owns the result, and what evidence would justify expanding it (Blanchard, LinkedIn, 13 November).

The Lineage Gap. This is a single anecdote relayed secondhand, and it should be weighed that way. It earns its place because of two details. The spending was discovered by invoice, weeks later, which means no limit, alert, or owner stood between the agent and the budget. And the person called to explain it was the CISO, which shows that when an agent misbehaves in any way, the organization reaches for whoever owns “AI risk,” whether or not that person had any control over the spending. Spend is simply another agent action, and it deserves the same treatment as the actions in Signal 01: a defined limit, real-time monitoring, and a way to stop it. Blanchard’s reminder to include review and correction time in the cost connects directly to Signal 03. An AI business case that ignores expert review time understates the real cost.

Boardroom Prompt. Is there a daily spending ceiling on each of your AI agents, and who is alerted when one is reached? Would you find a runaway agent in hours, or on the invoice?

05 · You can outsource the tooling, not the accountability

The Signal. Darrell Flewell reviewed the launch this week of Imagine Enterprise, an agentic AI platform for regulated industries from IBM Consulting and Microsoft, which pairs more than 6,000 prebuilt agents with Microsoft’s identity, data governance, and security tooling. The fine print, he notes, is that the enterprise using it stays responsible for its own regulatory obligations. His advice is to use it with eyes open and get answers first: which agents will be switched on and who approves each one; who owns each agent’s access to client and financial data; which obligations the tooling covers and which stay with the customer, in writing; who investigates when an agent produces a wrong number; and who is liable when the agent and the tooling come from two vendors. He frames it as third-party assurance: map the vendors’ controls to your own, and give every gap a named owner and evidence that someone tested it. His summary: “You can outsource the tooling. You cannot outsource the accountability” (Flewell, LinkedIn, 12 November). Gajen Kandiah shared research with HFS covering 502 senior AI decision-makers: only 33% of enterprises have met or exceeded the business case for their most significant AI program, 96% report significant governance gaps, and 61% would prefer one accountable partner across models, platforms, and infrastructure (Kandiah, LinkedIn, 13 November).

The Lineage Gap. Prebuilt agents with built-in governance tooling are a real step forward, and a platform designed for regulated industries will make adoption easier for many firms. The risk is the assumption that buying governed tooling is the same as being governed. Six thousand prebuilt agents is six thousand decisions about which to enable, with what data, under whose ownership. Flewell’s service-provider comparison is exactly right for audit committees: nobody accepts a vendor’s control report as their own control environment, and the same discipline applies here. Kandiah’s 61% figure shows that buyers feel the problem. When an issue crosses several providers, each can be performing as contracted while the customer still has no answer. A preference for one accountable partner is understandable, but the accountability that regulators care about stays with the enterprise either way.

Boardroom Prompt. For any AI platform you are adopting, is there a written map of which regulatory obligations the vendor’s tooling covers and which remain yours, with a named owner for each gap?

Every AI agent in your firm is quietly taking out loans in your name. It’s called Verification Debt — and it compounds.

Retire it with Identient, the governance layer that puts identity, evidence, and ownership behind every AI decision.

Identient helps regulated firms answer the questions that come due at the worst moment — a release, a regulatory inquiry, an audit: What is your AI doing? Who authorized it? Can you prove it?

Built on AI Operating Discipline, Identient’s four-phase methodology, your firm can:

See what’s actually running: inventory every AI use case, agent, and identity-to-data touchpoint — with a named owner for each
Bound what agents can do: governed identity and access for AI agents in your Microsoft environment, from Entra ID to Purview
Prove it when it counts: audit-ready evidence trails that stand up to examiners, boards, and enterprise security reviews

Try Identient Now!

06 · Controls make the savings real

The Signal. Khwaja Shaik reported from a CFO roundtable at the University of Georgia’s Terry College of Business, where chief accounting officers from Coca-Cola, Delta Air Lines, and National Vision discussed AI in finance. The lessons he drew: implementation choices can last 20 years, and an ERP rollout that moved old processes onto new technology left the close slower and the AI-ready features switched off. Automating a poor process only delivers poor results faster, which is why Delta invested in data leadership and a cross-functional transformation committee. Humans stay accountable whatever the tool: Coca-Cola’s updated technology control policy covers the full AI lifecycle, names owners, monitors for model drift, and brings in the controls team whenever financial reporting is affected. Controls must change when the work changes, and audit should be brought in at design rather than after go-live. And judgment needs protecting: AI is least reliable on accounting judgment, which raises the question of how the next generation builds professional skepticism when AI does the reconciliations they once learned on. His summary: “your AI ROI is only as real as your controls” (Shaik, LinkedIn, 11 November).

The Lineage Gap. Finance is where the claims about AI value meet a function that has to sign for its numbers, which makes this panel a useful reality check. The line that matters most is the simplest: the tool produces the output, but a person signs for it. That is a limit stated in the plainest possible terms, and it is why finance functions tend to adopt AI more carefully and with more durable results. The observation that controls should look different after a transformation is a practical audit test. If the process has changed and the control descriptions have not, one of them is wrong. The question about professional skepticism echoes a concern raised across several industries this year: the tasks AI absorbs first are often the ones through which people learned to recognize when something is off.

Boardroom Prompt. Where AI now touches your financial reporting, have the control descriptions been updated to match, and was internal audit involved at design or after launch?

07 · Sweden draws a line around the tools

The Signal. Dustin Hauer, in one of the week’s most engaged posts in this set, looked past the headline that Sweden has blocked ChatGPT and Claude on government work computers. Sweden is not banning AI. Microsoft Copilot remains approved, and some employees can still reach ChatGPT and Claude through a government-approved platform. The difference is not necessarily the model; it is the security agreements, data protections, and controls around how the model is used. He describes the everyday behavior the policy targets: employees pasting sensitive information into personal AI accounts, teams uploading internal documents without knowing where the data goes, managers encouraging adoption without setting boundaries, and AI-generated answers entering decisions without verification. Most of it is not malicious; it is people trying to work faster. His four questions for any organization: which AI tools are approved, what information can be shared, how that information is stored and protected, and who is responsible for verifying AI-generated work (Hauer, LinkedIn, 9 November).

The Lineage Gap. The Swedish decision is a clean example of limits enabling use rather than preventing it. The same models remain available through a channel where the contractual and technical protections are known. That is a more mature position than either a blanket ban or open access, and it mirrors what many enterprises have settled on for their own staff. Hauer’s fourth question is the one most policies leave out. Approved-tool lists and data-handling rules are now common; a clear statement of who verifies AI-generated work before it informs a decision is not. Without it, an organization can have fully approved tools and still have unverified outputs moving into its decisions.

Boardroom Prompt. Does your AI policy name who is responsible for verifying AI-generated work before it is used in a decision, or does it stop at which tools are approved?

08 · Rehired at a premium

The Signal. Ian McCulloh cited a Fortune report on an SHL survey in which nearly 20% of US respondents said they had been replaced by AI, only to be asked to return. Among those workers, 51% wanted a substantial pay increase. His reading: reducing headcount is a straightforward financial exercise, which is why it is tempting, but it is cost cutting with better technology rather than transformation. The irony he notes is that the people best positioned to find the larger opportunities are often the ones let go, because they understand the customers, processes, exceptions, and institutional realities that no model inherently knows (McCulloh, LinkedIn, 9 November). Carolyn Healey added the CEO-level data. In PwC’s 2026 survey of 4,454 CEOs, 12% report both cost reductions and revenue gains from AI, while 56% report neither. The 12% are two to three times more likely to embed AI across products, demand generation, and strategic decisions. She also cites BCG’s finding that 66% of frontline employees who save time with AI receive little or no guidance on how to reinvest it, and Deloitte’s that only 21% of organizations have mature governance for agentic AI. Her conclusion: clear decision boundaries are what let teams move faster (Healey, LinkedIn, 10 November).

The Lineage Gap. The rehiring figure comes from a single survey and should be treated as an indication rather than a measurement. It is still a useful warning about a specific kind of unverified decision. A workforce reduction justified by AI rests on a claim that the AI can do the work, and the survey suggests that claim is often not tested before the decision is made. The cost of being wrong is visible in the 51%: expertise returns at a higher price. Healey’s 12% versus 56% split points to what the successful minority does differently, and it is not better technology. It is knowing where AI belongs, who owns the outcome, and what decisions it may make, which is to say, limits and ownership defined in advance.

Boardroom Prompt. Before your organization removes a role on the basis that AI can do the work, what evidence is required that it actually can, and who signs off on that evidence?

09 · Capabilities change every six months; boundaries should too

The Signal. Aaron Levie offered a rule of thumb: check back on AI every three to six months to retry something that was not possible before. In the past six months alone, progress in computer and tool use, reasoning, and domain expertise has made models far more capable in what they can execute. His expectation is that anything with an API, and many things without one, will be something an agent can control as part of completing a process: security agents using existing cyber tooling, IT agents running workflows across software stacks, data agents migrating data between systems (Levie, LinkedIn, 9 November). Melissa Rosenthal reported a product example from the same week: Anthropic added spreadsheets, whiteboards, and data tools to Claude, along with a meetings product that joins calls as a participant and drafts plans and timelines while people are still talking. Most of it is in beta. Her point is about where work happens: if people do the work inside the assistant and open traditional software only to send the finished file, the tools of record change (Rosenthal, LinkedIn, 10 November).

The Lineage Gap. Levie’s advice is aimed at builders, but it applies with equal force to anyone setting controls. If capabilities move meaningfully every three to six months, then an annual review of AI policy is reviewing a system that no longer exists. This is the practical meaning of the fifth rule in Signal 01: boundaries must be reassessed as capabilities change. The meetings example makes it concrete. An assistant that sits in a meeting and drafts the plan is creating a business record, drawing on whatever was said, and that raises ordinary governance questions that did not exist a quarter ago: who approved its presence, where its drafts are stored, and who verifies them before they become commitments. New capability arrives as a feature update; the boundary has to be a deliberate decision.

Boardroom Prompt. How often does your organization review the limits on its AI tools, and is that cadence faster or slower than the rate at which those tools gain new capabilities?

10 · A model’s origins, checked by download

The Signal. Melissa Rosenthal described a claim from former OpenAI researcher Will DePue: that every AI model carries a faint fingerprint of the chip it was created on. When a model is first set up, its starting numbers are laid out in a pattern that depends on the processor, and training never fully erases it. He examined six freely downloadable models from four Chinese AI developers and says the fingerprint matches an NVIDIA chip the US bars from export to China. She is careful to state two large caveats: nobody outside his circle has reproduced the result yet, and the fingerprint cannot say where the chips were located, since renting them from a data center abroad is generally legal. Her conclusion is conditional: if the method holds up, checking how a model was trained would no longer require an intelligence agency, only a download (Rosenthal, LinkedIn, 13 November). Ed Sim raised a related concern from the investor side: if policy responds by restricting open-weight models just as financing for AI compute gets harder, the unintended consequences for startups that build on those models could be significant (Sim, LinkedIn, 13 November).

The Lineage Gap. This is an unverified technical claim, and nothing here should be read as a conclusion about any company’s conduct. It belongs in this briefing for what it would mean if confirmed. Almost everything enterprises know about the models they use comes from what the provider tells them. A method that reads provenance from the model itself would be a different kind of evidence: independent, repeatable, and not reliant on anyone’s statement. That is the direction verification is heading across this field, from assertions to artifacts that can be checked. Sim’s caution is a fair counterweight. Many enterprises now use open-weight models somewhere in their stack, and a policy shift affecting them would be a supply-chain event worth planning for.

Boardroom Prompt. For the AI models your organization depends on, what do you know about their origins from independent evidence, and what do you know only because the provider said so?

Monday Morning

Three things to do next week.

01 · Write the “cannot” list. For your three most capable agents, write down what each one must never do: the systems it cannot touch, the actions that always need a person, the data it cannot see. Then confirm each agent runs under its own identity rather than the full access of the person who launched it.

02 · Put a ceiling on agent spending. Ask who would know, today, if an agent’s costs spiked. Set a daily limit and an alert for each production agent, and name the person who receives it. A runaway agent should be found in hours, not on the invoice.

03 · Ask the uncomfortable question at the top. At your next board or executive session, ask two things: who would step in as interim leader tomorrow, and whether the organization’s insider-risk and conduct controls apply to the executive team. Record the answers.

The Reading Room

Three pieces worth your time this week.

Clare Kitching: Nine AI reports worth your time (LinkedIn, 12 November, 50 reactions). A curated reading list of the autumn’s major research from BCG, Deloitte, Bain, McKinsey, HBR, IBM, PwC, and Anthropic, organized around three questions: are we getting value yet, how should the work change, and how are roles changing. A fast way for a leadership team to get current.
Braden Pan: Always-on agents and the coordination problem (LinkedIn, 8 November, 18 reactions). An argument that personal agents raise individual capacity while increasing coordination costs for the team, as people become “human wrappers” passing one agent’s output to another. His proposal is team-level agents that share context and work in full view of everyone.
Guillermo Flor: The widest gap Marc Andreessen has seen (LinkedIn, 9 November, 12 reactions). A short note on Andreessen’s view that AI-native startups and incumbents hold completely different beliefs about what AI can do. Worth reading as a prompt: is your roadmap built around what AI could do last year?

Trust is expensive. So is its absence.

The Verified Intelligence Briefing is written by Steve Tout, Founder & CEO of Identient and author of The CISO on the Razor’s Edge. It draws from the curated Daily Signal corpus and the Verified Intelligence framework introduced in From Artificial to Verified Intelligence.

If this issue clarified something for you, forward it to one colleague who owns part of the control plane. New here? Subscribe to get The Briefing every Friday morning.

Reply or comment with the question you’d want answered in next week’s issue. Your prompt may become Boardroom Prompt #1.

Connect with Steve: LinkedIn · identient.com · stevetout.com