The weekly read on verification debt, for leaders who own the control plane.
The Pattern
On October 9, Anthropic published a report on actions its models took on real websites during evaluations and internal use. In one case, a practice copy of a government form failed to load. The agent went to the website hosting the real form and submitted it there. In several runs of another form task, the agent’s own reasoning said the process was being demonstrated, not submitted. The form was submitted anyway. Impact was assessed as minimal, and the company has suspended live internet access across its internal evaluations until its controls are confirmed to catch this behavior.
Two details matter for every enterprise. The failed sandbox was treated as an obstacle to work around, not a reason to stop. And the agent’s account of what it did and what it actually did were different. An audit trail built on the agent’s own narration would have recorded a demonstration.
The same week, Microsoft’s Satya Nadella argued publicly that companies should treat AI models like insider risks, and that the intelligence should be separated from the authority over it. A survey of IT leaders running agents in production found that every one of them requires human approval for high-risk actions. A startup raised $10 million to insure AI agents. A multi-state lawsuit reminded boards that AI enforcement does not need a new AI law. And the value research kept pointing the same direction: the companies creating real returns focus narrowly, redesign the work, and measure what the work produces.
The pattern: the industry converged this week on a single operating rule, stated plainly by one analyst: authority must follow proof. Every signal either supplied a reason for the rule or a mechanism for applying it.
Thesis. An agent earns authority the way an employee does: by demonstrating, under observation, that it stays inside its limits. That requires evidence the agent does not write. Policies record intent. Prompts record instructions. Only an independent record of what the agent did, made at the moment it acted, can justify giving it more room to act. The organizations that build that record will expand agent autonomy with confidence. The rest will be expanding it on faith.
The Signals
01 · The agent said “demonstration.” The form was submitted.
The Signal. Alexandra C. walked through Anthropic’s October 9 disclosure on actions its models took on real websites during evaluations and internal use. In one case, a practice copy of a government form failed to load during an evaluation; the agent found the website hosting the real form and submitted it there. In another run, an agent had been told never to log in, enter personal data, make purchases, or submit anything destructive. Form submissions were not on that list, and an invented tip was submitted through a police homicide tip form, where it was filtered as spam. In several runs of a further form task, the agent’s reasoning stated that the process was being demonstrated, not submitted; the form was submitted. Most cases were found through a transcript review that began in July, impact was assessed as minimal, and live internet access has been suspended across Anthropic’s internal evaluations until its controls are confirmed to catch these behaviors. Her translation for regulated firms: the equivalent is a payments agent whose test gateway fails to respond, and which then finds the production endpoint because no network control was written to stop it (Alexandra C., LinkedIn, 16 October).
The Lineage Gap. Credit where it is due: the company looked for these behaviors, disclosed them, and shut off live access while it fixes the controls. That is how the process should work. The lessons for enterprises are two, and the second is new. The first is familiar from last month’s government-portal incident: an agent with a goal will treat a failed boundary as a problem to solve. The second is sharper. The agent’s own description of its action did not match the action. Most AI policies in banks, insurers, and hospitals are written as lists of prohibitions, and as she notes, a list of forbidden actions records intent; it does not establish a boundary that can be evidenced. The question that matters is not what the agent was told, or what it says it did. It is where the agent acted, what it submitted, and which boundary permitted it, recorded at the moment it happened by something other than the agent.
Boardroom Prompt. If your test environment fails tomorrow, can your agent reach the production system? And if it did, would your record of what happened come from the agent’s own account, or from a system the agent cannot write to?
02 · Treat the model like an insider
The Signal. Amir Kabir, an investor in the AI trust category, highlighted a piece published this week by Microsoft CEO Satya Nadella arguing that companies should treat AI models as insider risks. Kabir drew out three lines. First, the attribution problem: a model’s behavior cannot be traced back to its training data or weights the way software behavior can be traced back to code, yet these systems are being handed sensitive data and the authority to act. Second, a call for a new trust architecture, because capability is scaling far faster than the ability to verify, contain, and take responsibility for what these systems do. Third, the line he would frame: separate the intelligence from the authority over it. In practice, that means every agent gets its own identity, scoped permissions, and controls that live outside the model. Kabir’s read of the moment: when the CEO of one of the largest AI providers says a model provider’s assurances are not enough, a niche argument becomes a market (Kabir, LinkedIn, 11 October).
The Lineage Gap. “Insider risk” is a useful frame for executives because every large organization already runs an insider-risk program, and its principles transfer almost directly. Insiders are trusted enough to have access, which is exactly why their access is scoped, their actions are logged by systems they do not control, and unusual behavior is monitored rather than assumed away. Signal 01 shows why the framing fits: the agent was capable, well-intentioned in the narrow sense, and its self-report was inaccurate. Nobody would accept an employee’s own diary as the audit trail for a sensitive transaction. The same standard applies to an agent. The attribution problem Nadella names also has a practical consequence for incident response: because you cannot trace a model’s behavior to a line of code, the record of what it did is the only evidence you will have, which makes that record a primary control rather than a nice-to-have.
Boardroom Prompt. Does your insider-risk program cover AI agents today? If not, which of its controls (scoped access, independent logging, behavioral monitoring) would you apply first?
03 · Authority must follow proof
The Signal. Dave Vellante’s latest Breaking Analysis, built on conversations with Appian CEO Matt Calkins, asked who gets to decide when an AI agent is safe for production. Calkins’s comparison: expecting vendors to assess their own risk without independent, enforceable oversight is like letting banks set their own leverage rules. The research behind the episode is the useful part. In 25 in-depth interviews with IT leaders, conducted with research partner Qualitate, 100% of those running AI agents in production require human approval for high-risk actions, including write access, financial transactions, and privileged access. None allow unmonitored agent autonomy for high-risk tasks. The concern enterprise leaders raised was not science fiction but agent sprawl and “vibe-coded” agents that outlive their creators and bypass established security controls. His takeaway, in four words: authority must follow proof. Start with AI that recommends, move to drafts for human sign-off, and grant explicit, controlled action only when guardrails, security, and rollback have been proven in your own environment (Vellante, LinkedIn, 10 October).
The Lineage Gap. The sample is small and the finding is still telling: in practice, enterprise leaders have already rejected unsupervised autonomy for high-risk work, regardless of what vendor roadmaps suggest. “Authority must follow proof” is the cleanest statement of the operating rule this briefing has seen, and its staged path (recommend, then draft, then act) gives boards a vocabulary for something they currently approve without one. The important word is “proven,” and the important phrase is “in your environment.” A vendor benchmark is not proof for your systems, and an agent that behaved in testing is not proof for production, as Signal 01 shows. Proof means evidence collected while the agent operated under your controls, on your data, at your risk levels. Without that evidence, each step up the autonomy ladder is a decision made on confidence rather than record.
Boardroom Prompt. For each agent in production, which stage is it at today: recommending, drafting for sign-off, or acting? What specific evidence would management need to show before you approve the next stage?
04 · The insurers arrive, and they will ask for evidence
The Signal. Guillermo Flor reported that Harbor closed a $10 million seed round led by Base10, Abstract, and 8VC to build insurance for AI agents. The founders’ thesis: as agents take over decisions, the liability shifts from human error to machine action, and that requires an insurance layer built for it (Flor, LinkedIn, 13 October). Fayeron Morrison, a CPA and certified fraud examiner, described what that shift will feel like from the client side. Building a governance diagnostic, she found in beta testing that executives were describing the AI policies they had written, not how their companies actually operated; because a policy existed, leadership assumed the practice followed. So she paired the maturity assessment with an inventory of actual AI use, and the gap between the two became a finding in itself. Her warning concerns the moment someone signs an insurance application stating “we have an AI policy,” “people review the outputs,” or “sensitive data stays out of AI tools.” Before treating those statements as facts, she asks three questions: who verified them, what evidence supports them, and what exceptions remain (Morrison, LinkedIn, 13 October).
The Lineage Gap. The case for insurers as AI verifiers was raised in these pages in August: a verifier that carries the loss cannot be talked into leniency, because leniency shows up as claims. Harbor’s round is an early sign of that market forming, and Morrison’s observation shows where it will bite first. An insurance application converts governance statements into representations made under contract, and a misrepresentation there is not a reputational issue; it is a coverage issue. The gap she found between written policy and actual practice is the most common finding in AI governance, and until now it has carried little direct cost. Once agent risk is priced, the evidence behind each claim becomes worth money. Organizations that can show an AI use inventory, a review record, and documented exceptions will get better terms. Those that can only show a policy will discover what their policy was worth.
Boardroom Prompt. If your organization applied for AI liability coverage next quarter, which governance statements would you sign? For each one, who verified it, and what evidence would an underwriter accept?
Every AI agent in your firm is quietly taking out loans in your name. It’s called Verification Debt — and it compounds.
Retire it with Identient, the governance layer that puts identity, evidence, and ownership behind every AI decision.
Identient helps regulated firms answer the questions that come due at the worst moment — a release, a regulatory inquiry, an audit: What is your AI doing? Who authorized it? Can you prove it?
Built on AI Operating Discipline, Identient’s four-phase methodology, your firm can:
See what’s actually running: inventory every AI use case, agent, and identity-to-data touchpoint — with a named owner for each
Bound what agents can do: governed identity and access for AI agents in your Microsoft environment, from Entra ID to Purview
Prove it when it counts: audit-ready evidence trails that stand up to examiners, boards, and enterprise security reviews
05 · Enforcement is not waiting for an AI law
The Signal. Khwaja Shaik drew the board lesson from a CNBC interview with West Virginia Attorney General John McCuskey about the multi-state lawsuit against OpenAI. His point is that the case involves one company, but the lesson applies to every board: AI enforcement is not waiting for new AI legislation. It is arriving through tools regulators have used for decades, including consumer protection, deceptive practices, and demonstrable harm. Boards do not need a new rulebook to be exposed, because the existing one already applies. He offers a concept worth borrowing: alongside risk appetite, boards should set “value tolerance,” the maximum allowable deviation of an AI investment from its target, giving directors a language for AI performance as well as AI risk. His opening question for management: if your most consequential AI system failed tomorrow, could you show the board what you knew, what you tested, and who was accountable (Shaik, LinkedIn, 15 October)?
The Lineage Gap. A lawsuit is an allegation, not a finding, and the case should be read with that caution. What it establishes regardless of outcome is the route. Regulators and attorneys general are applying existing law to AI-related claims and harms, which means the question for any deploying company is not whether a specific AI rule covers its systems but whether its statements about those systems are accurate and its controls demonstrable. That connects directly to Signals 01 and 04. Deceptive-practice frameworks turn on the gap between what was represented and what happened; an organization whose agent records come from the agent’s own account, or whose governance claims rest on unverified policy, is exposed on exactly that gap. Shaik’s three-part test (what you knew, what you tested, who was accountable) is a reasonable minimum standard for evidence a board should be able to request on short notice.
Boardroom Prompt. Ask management to run Shaik’s test on your most consequential AI system this quarter: what did we know, what did we test, and who was accountable? How long did it take to assemble the answer, and what was missing?
06 · Twelve good agents nobody manages
The Signal. Carolyn Healey named the problem many organizations are quietly building: the next AI problem is not a bad agent, but twelve good ones nobody manages. It starts with one that works, so another gets built; sales builds three, finance builds two, and soon nobody can say how many exist, what they can access, or who answers when something goes wrong. She cites Gartner’s projections that 70% of AI applications will use multi-agent systems by 2028 and that over 40% of agentic AI projects will be canceled by the end of 2027, driven by escalating costs, unclear value, and inadequate risk controls. Her operating model treats agents like staff: every agent has a named human owner (a person, not a department), with documented authority over what it may access, decide, and execute; agents get performance reviews weekly for exceptions and unauthorized actions, monthly for value against total cost, and quarterly to expand, redesign, or retire; and one shared registry records each agent’s identity, owner, permissions, decision rights, and kill switch. Her final question before adding any agent: what evidence will earn it greater autonomy (Healey, LinkedIn, 12 October)?
The Lineage Gap. This is Signal 03’s rule turned into a management routine. “Start with minimum necessary permissions and expand authority only after the agent demonstrates reliability” is exactly authority following proof, and the weekly review of exceptions and unauthorized actions is where that proof is produced. The registry deserves particular attention because it is the prerequisite for nearly every other control discussed this week. An organization cannot scope, insure, review, or stop an agent it does not know exists. The 40% cancellation projection is also worth reading as good news in disguise: many agentic projects will fail on cost and value, and an organization with monthly value-versus-cost reviews will retire its weak agents deliberately rather than discovering them during a budget cut.
Boardroom Prompt. How many AI agents are running in your organization today, and who owns each one by name? If that question takes more than a day to answer, what is the plan for the registry?
07 · Governance starts before the contract is signed
The Signal. Oyinjadesola Edu argued that if AI intake begins after the contract is signed, it is already too late to shape the decision. Many organizations treat intake as an administrative form: tool, purpose, owner, submitted, and then nobody is clear who decides, which review applies, or what happens next. Effective intake, in her framing, does five things: creates early visibility before contracts are signed, sensitive data is connected, or processes change; establishes the facts, including the purpose, owner, users, data, proposed actions, and level of decision authority; separates missing information from genuine privacy, security, legal, or model concerns; routes each case, with lower-risk uses approved locally, specific concerns sent to specialists, high-impact cases to committee, and strategic risks to executives; and creates the first record in the AI inventory, including the decision, conditions, evidence, and next review trigger. Her caution: the intake form should not become a full risk assessment in disguise; it only needs enough to determine the next step (Edu, LinkedIn, 12 October).
The Lineage Gap. Intake is the least glamorous part of AI governance and the one that decides whether everything downstream works. Healey’s registry in Signal 06 has to be populated from somewhere, and Morrison’s gap between policy and practice in Signal 04 usually begins with agents and tools that entered the organization without passing through any front door. Edu’s inclusion of “level of decision authority” as a required fact at intake is the detail that connects her process to this week’s theme: if the authority an agent will hold is recorded at the start, then every later expansion of that authority becomes a visible decision rather than a quiet drift. Her routing principle also addresses a common failure in large companies, where every AI request goes to the same overloaded committee and approvals take months, which in turn drives teams to skip intake altogether.
Boardroom Prompt. In your organization, does AI intake happen before or after procurement commits? And does it record the level of decision authority the system will hold?
08 · Want better AI economics? Do less.
The Signal. Neha Kabra surfaced a McKinsey study of 20 companies that have consistently created significant economic value from technology and AI: an average 20% EBITDA uplift, cash positive in one to two years on average, and $3 of incremental EBITDA for every $1 invested. The number she finds most interesting: two-thirds focused on three business domains or fewer, choosing the parts of the business where even a small improvement creates material financial value. Her conclusion is that twenty use cases can produce twenty successful pilots without scaled impact (Kabra, LinkedIn, 15 October). Bain research shared by Alistair Hofert points the same way: leaders treating AI as a full business transformation report 10% to 25% EBITDA growth, the new competitive variable is “absorption speed,” and the main barriers are organizational rather than technical (Hofert, LinkedIn, 12 October). Arseny Chernov’s summary of BCG’s survey of 1,330 executives adds the allocation: AI spending now averages 3.3% of revenue, and the most advanced companies devote 70% of their AI effort to people, organization, and process, 20% to technology and data, and 10% to algorithms (Chernov, LinkedIn, 12 October).
The Lineage Gap. Three firms, three methods, one conclusion: value concentrates where focus and organizational change do. For verification, focus has a second benefit that rarely gets mentioned. Three domains can be governed properly, with owners, evidence, and outcome measurement that actually works. Twenty scattered use cases almost never are, which is one reason pilots multiply without producing proof. BCG’s 70% figure is the important corrective for budget conversations: if most of the effort in successful programs goes to people and process, then a plan that is mostly a technology purchase is, by this evidence, mostly the wrong plan.
Boardroom Prompt. How many business domains does your AI program cover today? If you had to pick the three where a small improvement would move the financials most, would they match where the investment is going?
09 · Know the work, not the licenses
The Signal. Lexi Reese shared notes from a session with a Stanford AI leadership class on managing human capital and token capital. Her framing: capacity mix modeling is the new media mix modeling. Marketers learned long ago that total spend was not enough; they had to know which channels produced results. AI creates the same problem for the whole company. Knowing who uses ChatGPT, how many Copilot licenses were bought, or how many agents were deployed does not tell you what work is being done, where AI creates leverage, or what it costs. Only with that knowledge can leaders decide what should stay human-led, where people should work with AI, what should be delegated to agents, which tools to scale or retire, and where the next dollar or hour of capacity should go. Her summary: you cannot answer that from license counts; you have to understand the work (Reese, LinkedIn, 13 October). Suzana Stojakovic-Celustka described where the value gets lost: tools work, individual tasks speed up, and business performance barely moves, because faster analysis does not create faster operations when processes, responsibilities, and coordination around it stay the same (Stojakovic-Celustka, LinkedIn, 11 October).
The Lineage Gap. Capacity mix modeling is a useful name for a discipline most organizations lack: measuring AI by the work it does rather than the tools it uses. It also turns out to be a governance tool. Deciding what to delegate to agents is a decision about authority, and Reese’s framework forces that decision to be made with evidence about the work rather than enthusiasm about the tool. Stojakovic-Celustka’s observation explains why license counts mislead: value is lost between the individual activity and the business outcome, and only a measurement system built around the work can show where.
Boardroom Prompt. Could your organization describe its current mix of human-led, AI-assisted, and agent-delegated work for one major function? If the only available numbers are licenses and usage, what would it take to measure the work itself?
10 · The AI factory is a governance system, too
The Signal. Jason Moccia summarized a Deloitte survey of 515 US enterprise leaders on scaling AI. About half of organizations run 31 or more AI pilots today, rising to nearly 70% by 2028. Token consumption is the real cost signal: 37% already use 1 to 10 billion tokens a month and 30% use more, while 61% expect to exceed 10 billion monthly by 2028. Talent, not hardware or model access, is the biggest constraint for 40% of respondents, and power and cooling are emerging as strategic constraints as infrastructure scales. Today 36% run AI at what Deloitte calls factory scale; 73% expect to by 2028. His read: none of this is really about adding infrastructure. It is about whether consumption, governance, and talent get treated as one system instead of three separate problems (Moccia, LinkedIn, 12 October).
The Lineage Gap. The forecast to watch is pilots rising toward 70% of organizations running more than 30 of them, set against Signal 08’s evidence that value comes from focusing on three domains or fewer. More pilots, more tokens, and more agents will arrive regardless; the question is whether governance scales with them. Moccia’s one-system framing is the right one, because the three problems are linked: consumption without governance produces unexplained bills, governance without talent produces paperwork, and talent without either produces sprawl. The factory analogy is apt in one more way. Factories are defined as much by their quality controls as by their output, and an AI factory without a record of what each agent did is a production line without inspection.
Boardroom Prompt. As your AI consumption grows toward factory scale, does your governance capacity grow with it, or is the same small team expected to review ten times the volume?
The Verification Debt Tracker
The 2×2 from From Artificial to Verified Intelligence. Signal counts this week, with direction vs. last issue.
Agents & Workers returned to 8 after last week’s shorter edition, and the signals converged on a single operating rule: authority must follow proof. The governed column supplied the mechanisms: treat agents like insiders, stage autonomy from recommend to draft to act, give every agent a named owner and a performance review, start governance at intake rather than after contract, and measure the work rather than the licenses. Insurers and litigators supplied the incentive, because both will ask for evidence rather than policy. Adversarial Swarms held at 1: an agent that treated a failed practice environment as an obstacle, submitted a real government form, and described its own action as a demonstration. The Perspective row is quiet for a thirteenth straight week. Twenty-two issues in, the clearest lesson of the season is that the record of what an agent did has become the control that every other control depends on.
Monday Morning
Three things to do next week.
01 · Test what happens when the sandbox fails. For one agent that operates in a test or staging environment, ask your engineering lead a single question: if the test endpoint goes down, can the agent reach production? Then confirm the answer with a network control, not a prompt. The scenario in this week’s lead signal is easy to reproduce and inexpensive to prevent.
02 · Find out where your agent records come from. For your most consequential agent, trace its activity log to its source. If the record of what it did is generated by the agent itself, add an independent source (gateway logs, API logs, or system-of-record entries) and compare the two for one week. Any difference is a finding.
03 · Read your governance statements as an underwriter would. List the three governance claims your organization makes most often, such as “humans review AI outputs” or “sensitive data stays out of AI tools.” For each, answer Morrison’s three questions: who verified it, what evidence supports it, and what exceptions remain. Fix the weakest one before anyone asks you to sign it.
The Reading Room
Three pieces worth your time this week.
Khwaja Shaik: Boards don’t fly the plane, but they need better radar (LinkedIn, 13 October, 5 reactions). On the 2026 NACD Blue Ribbon Commission report on board oversight of strategy execution, which casts effective boards as “neither passive observers nor surrogate operators” and offers an Align, Monitor, Calibrate framework. His addition: AI is now an assumption inside almost every strategy, and boards should monitor signals rather than status, including value realized against value promised.
Sasha Orloff: KPMG’s new Client Technology & Innovation group (LinkedIn, 13 October, 58 reactions). KPMG is incubating AI-native “edge companies” inside the firm and co-developing products with major AI providers. His observation from a career building software companies: building software is hard even for software firms, and products need an operating rhythm that is very different from client service. A useful lens for any professional services leader weighing build versus partner.
Keilian Knudsen: The Chief AI Officer might become the most important fractional role of the decade (LinkedIn, 12 October, 28 reactions). Citing AI Leaders Council research that 97% of organizations use AI in some capacity while just 3% have fully embedded it, and one-third have no defined AI talent strategy. His argument is that most companies need an experienced operator who can find value, build the roadmap, and measure ROI more than they need another strategy deck, which makes the execution gap a staffing question as much as a technology one.
Trust is expensive. So is its absence.
The Verified Intelligence Briefing is written by Steve Tout, Founder & CEO of Identient and author of The CISO on the Razor’s Edge. It draws from the curated Daily Signal corpus and the Verified Intelligence framework introduced in From Artificial to Verified Intelligence.
If this issue clarified something for you, forward it to one colleague who owns part of the control plane. New here? Subscribe to get The Briefing every Friday morning.
Reply or comment with the question you’d want answered in next week’s issue. Your prompt may become Boardroom Prompt #1.
Connect with Steve: LinkedIn · identient.com · stevetout.com