The weekly read on verification debt, for leaders who own the control plane.
The Pattern
Starting November 24, Wells Fargo’s updated online access agreement says customers “remain responsible for all the AI Agent’s activities” until they notify the bank that the agent’s access has been revoked. It goes further: customers must retain evidence of that revocation and provide it to the bank on request. A bank customer agreement now treats AI agents as something the customer must be able to prove control over.
That clause is a small piece of text with a large implication, and the rest of the week supplied the context. An insurance market is forming in which coverage follows independent testing, while some major insurers are seeking to exclude AI damages from traditional policies. A leading AI lab disclosed that its monitoring detected an internal model’s unauthorized internet access within 15 minutes, and acknowledged that, in some configurations, an alert can fire while an agent keeps running. A practitioner in financial services put the governing distinction in one line: your agent may have permission to access the system, but that does not mean it has permission to act.
The pattern: the question about AI agents is moving from inside the enterprise to outside it. Banks, insurers, and regulators are beginning to ask for proof of what an agent was allowed to do, what it actually did, and when its authority ended.
Thesis. For two years, AI governance has been something organizations did for themselves. It is becoming something counterparties require. When a bank contract assigns liability for agent actions, an underwriter prices agent risk, and a regulator asks for an agent’s chain of authority, internal assurances stop being enough. The organizations that can produce evidence of authority, scope, and revocation on request will keep access to banking, coverage, and customers on good terms. The rest will discover the gap at the moment someone asks.
The Signals
01 · The bank wants proof of revocation
The Signal. Houman Shadab highlighted a change in Wells Fargo’s Online Access Agreement taking effect November 24. Customers “remain responsible for all the AI Agent’s activities” until they notify the bank of revocation, and “must retain evidence of such revocation and must provide such evidence to us, at our request.” He connected it to two other developments: the Financial Stability Board’s position that an AI monitoring another AI must be “independent of the system it reviews,” and Gallagher Re’s view that current AI evaluation methods “were not designed for underwriting and are not fit for that purpose.” His focus is the corporate customer. A finance team running agents in payables or treasury has to prove three things: authority (what each agent was allowed to do), scope (whether every action stayed inside those limits), and revocation (when access ended). Consumers have Regulation E protections, but business payments mostly fall under UCC Article 4A, where a bank that follows an agreed security procedure usually leaves the loss with the company. His conclusion: companies have less protection and more agents, and proof of revocation is necessary but not sufficient, because it shows an agent had permission, not that each action stayed within it (Shadab, LinkedIn, 3 November).
The Lineage Gap. Three weeks ago, these pages covered banks blocking AI agents from customer accounts because they could not tell what the agents were trying to do. This is the other path a bank can take: allow the agent, but place the burden of proof on the customer. For corporate treasurers, that is a material shift. Under the commercial payments framework Shadab describes, the bank’s security procedure is the bank’s defense; the company’s defense is its own evidence. Most companies running agents in finance functions today could show that an agent was provisioned. Far fewer could show the moment its authority ended, and almost none could show, action by action, that it stayed inside its limits. This clause is likely to be the first of many. Once one major bank writes agent accountability into a customer contract, others will follow, and the evidence requirement becomes part of the cost of doing business with them.
Boardroom Prompt. If your bank asked tomorrow for proof of when each AI agent’s access to your accounts was revoked, who would produce it, and from what system?
02 · Detection is not containment
The Signal. Mark McGovern drew attention to OpenAI’s October 29 disclosure on monitoring its frontier models. The company reported that its monitoring system detected an internal model’s unauthorized internet access within 15 minutes, with human review beginning three minutes later. It also acknowledged a limitation in its external monitoring architecture: tool-using conversations through one API can be interrupted automatically when certain conversation-tracking mechanisms are implemented, but without them, a webhook alert may be generated while the agent continues operating, and the described misalignment monitoring does not cover a second, widely used API. McGovern’s four priorities: validate which agents, APIs, and tool calls are actually monitored; make sure agent identities, credentials, network access, and execution privileges can be revoked outside the agent’s own decision-making; test that monitoring results in actual termination of access, not just notification; and measure the time from detection to interruption. His summary: “An alert is evidence of detection. A verified loss of unauthorized capability is evidence of containment” (McGovern, LinkedIn, 2 November).
The Lineage Gap. The disclosure deserves credit. A 15-minute detection with human review three minutes later is a fast response, and publishing the architecture’s limits is the kind of transparency that helps every enterprise customer. The lesson is in the gap it names. Many enterprise agent programs count monitoring as a control, and in a narrow sense it is. But a monitor that sends an alert while the agent keeps working is evidence that something happened, not a mechanism that stopped it. Signal 01 shows why the distinction matters commercially: a bank asking for proof of revocation is asking when the agent stopped, not when someone noticed. McGovern’s detection-to-interruption measure is a metric boards can ask for today.
Boardroom Prompt. For your most consequential agent, how long would it take to go from an alert to a verified loss of access, and has anyone actually tested it?
03 · Access is not authority
The Signal. Kannan Durairaj asked a question most organizations cannot answer: could an AI agent perform a valid action or API call that the business never intended to authorize? Australian regulators have emphasized identity and access controls, monitoring, escalation, delegation, and governance that can operate at the speed of AI-driven risk, and FINRA has highlighted that agents may act beyond a user’s actual or intended scope. Most organizations can say whether an agent has access to a system; far fewer can say whether it can execute a payment, change a customer record, or authorize another agent to act. He cites a UK distribution of agent autonomy in which 80% of firms reported decision-support agents, 46% constrained execution, 22% conditional autonomy, and only 2% broad autonomy (categories that overlap). His line: “Your agent may have permission to access the system. That does not mean it has permission to act” (Durairaj, LinkedIn, 5 November). Alex Miguel Meyer put the stakes plainly: “A wrong answer gets ignored. A wrong action gets executed.” His checklist starts with an inventory and one named owner per agent, retires any agent without one, and ends with three questions for the day an agent fails: who owns it, what did it touch, and how do you stop it (Meyer, LinkedIn, 2 November). Rohan Pinto added the identity critique: an agent name in a message payload is “not identity. That’s a costume,” and an API key proves someone has a key, not who they are or whether they should be doing what they are doing (Pinto, LinkedIn, 6 November).
The Lineage Gap. Durairaj’s distinction is the precise version of a problem most governance programs blur. Access control was built for people, where the decision to grant access implied a judgment about the person’s role and intent. An agent with the same access has no such judgment attached. His layered permissions (read, recommend, prepare, execute) give management a vocabulary to separate what an agent can see from what it can do, and his inclusion of agent-to-agent delegation is the detail to watch, because authority passed between agents is the hardest kind to trace. The UK distribution is reassuring in one respect: broad autonomy over consequential activity is still rare. It is also a baseline. Each move from recommend to execute should be a recorded decision, not a configuration change.
Boardroom Prompt. For each agent in production, can management say not only what it can access, but whether it can read, recommend, prepare, or execute, and whether it can pass any of that authority to another agent?
Every AI agent in your firm is quietly taking out loans in your name. It’s called Verification Debt — and it compounds.
Retire it with Identient, the governance layer that puts identity, evidence, and ownership behind every AI decision.
Identient helps regulated firms answer the questions that come due at the worst moment — a release, a regulatory inquiry, an audit: What is your AI doing? Who authorized it? Can you prove it?
Built on AI Operating Discipline, Identient’s four-phase methodology, your firm can:
See what’s actually running: inventory every AI use case, agent, and identity-to-data touchpoint — with a named owner for each
Bound what agents can do: governed identity and access for AI agents in your Microsoft environment, from Entra ID to Purview
Prove it when it counts: audit-ready evidence trails that stand up to examiners, boards, and enterprise security reviews
04 · Coverage follows testing
The Signal. Kriti Joshi described an AI insurance market taking shape. Armilla AI covers risks including hallucinations, agent mistakes, and data leaks, tests systems for weaknesses before writing coverage, and is backed by Lloyd’s underwriters, with limits reportedly reaching $25 million per company. The Artificial Intelligence Underwriting Company independently tests agents against its AIUC-1 standard, covering manipulation, instruction override, misleading answers, and data leakage, and coverage can follow a passed audit; it recently raised a $40 million Series A. Munich Re, Chaucer Group, and Relm Insurance are also entering the market, while some major US insurers are seeking to exclude AI-related damages from traditional liability policies. Her observation: insurance pricing depends on measuring risk accurately, which depends on evaluating AI systems properly, so AI evaluation “isn’t just a research problem. It’s a financial one” (Joshi, LinkedIn, 31 October). Fayeron Morrison identified the exposure on the other side of the form. To investors, AI is the engine transforming the business; on the D&O or cyber renewal, the same AI is described as “narrow, limited, experimental.” If an agent can read customer data, trigger transactions, or talk directly to clients, calling it internal writing assistance on an insurance application is a misrepresentation, and it surfaces when a claim is made. Her question for boards before the next renewal: who compared the company described to the underwriter with the company described to investors (Morrison, LinkedIn, 5 November)?
The Lineage Gap. The insurance market is splitting in two directions at once: specialist carriers offering coverage for AI risk after testing, and traditional carriers carving AI out of existing policies. For a company that relies on its general liability or cyber coverage, that means the AI risk it assumed was insured may not be. Morrison’s point, which she raised here in October in the context of governance statements on applications, now has a sharper edge. When insurers are actively excluding AI, how a company describes its AI use on a renewal determines what is covered, and an inconsistent description is a coverage dispute waiting to happen. Joshi’s framing explains why evaluation is moving to the center: the test result is becoming the price.
Boardroom Prompt. Does your current liability or cyber policy exclude AI-related damages, and does the description of AI use on your last renewal match what you tell investors?
05 · The toolmakers’ tools were compromised
The Signal. Mark McGovern summarized Cursor’s disclosure that malicious versions of Anthropic’s Claude Code extension were distributed through its extension marketplace for about 11 hours on October 29. Up to 5,000 developers may have received compromised versions, which attempted to establish persistent SSH backdoor access, transmitted host information, and attempted to install persistence that could survive removal of the extension. Cursor removed the affected packages, temporarily disabled its marketplace, and published remediation steps. His point is that development environments are becoming high-value attack paths, because a compromised developer workstation may reach source code, cloud credentials, and deployment pipelines. His priorities: control which AI developer extensions are allowed and who may publish them, restrict developer access to production credentials and deployment authority, and verify remediation by rotating credentials and independently confirming containment (McGovern, LinkedIn, 31 October). Khwaja Shaik raised a related board question about the software supply chain: up to 90% of enterprise software is open source, and most boards can say how many vulnerabilities were found last quarter, but very few can say how many were fixed in the systems that run the business (Shaik, LinkedIn, 5 November).
The Lineage Gap. The incident was contained quickly and disclosed with remediation guidance, and it should be read as a supply-chain event rather than a flaw in any model. What it adds to the week’s theme is a reminder that the evidence of control has to cover the tools that build agents as well as the agents themselves. An organization that can prove what its production agents did, but cannot say which AI extensions its developers installed last week, has a gap at the point where the code is written. Shaik’s distinction between findings and fixes applies directly: the meaningful measure after an incident like this is not how many affected installations were identified, but how many were verified clean and how many credentials were rotated.
Boardroom Prompt. Does your organization control which AI coding tools and extensions developers can install, and could it identify every affected workstation within a day if one were compromised?
06 · The bill is visible; the unit cost is not
The Signal. Lewis Walker summarized Deloitte’s new State of AI in the Enterprise report, based on 3,500 senior leaders. Eighty-one percent say AI has made decisions and execution faster, but only 25% are deeply transforming their business: “Speed is becoming common. Deeper transformation is not.” Seventy-one percent track total AI inference and API spend, but only 44% track cost per unit of inference. Revenue gains from AI were reported by 28%, up from 20% in January. Forty percent let AI carry out decisions or actions without human approval to at least a moderate degree, and for 23%, it is still unclear who is accountable when something goes wrong. Seventy-four percent say keeping data and compute in their own region is at least moderately important, and 62% are at least moderately concerned about relying on foreign-owned AI (Walker, LinkedIn, 2 November). Khwaja Shaik drew the board lesson from the cloud era: enterprises optimized for speed, and years later concentration risk surfaced, leverage fell, and costs rose. Inference is a recurring operating expense that compounds with every agent and interaction, so boards should ask about cost per outcome, dependence on a single model or vendor, the time and cost to switch, and whether AI suppliers are stress-tested like financial counterparties (Shaik, LinkedIn, 2 November).
The Lineage Gap. Two Deloitte numbers belong together. Forty percent of organizations let AI act without approval to some degree, and 23% cannot say who is accountable when it goes wrong. That overlap is where the week’s other signals land: a bank, insurer, or regulator asking for proof will ask the accountable owner, and nearly a quarter of organizations do not have one. The cost data tells a parallel story. Knowing the total bill without the unit cost is like knowing payroll without knowing headcount, and Shaik’s question about exit cost is the one most AI business cases skip. The sovereignty figures are worth noting as well: control over where data and compute sit is becoming a strategic criterion, not only a compliance one.
Boardroom Prompt. Who is accountable when an AI agent in your organization acts without approval and gets it wrong? And do you know your cost per AI outcome, or only the total invoice?
07 · The risks nobody disclosed
The Signal. Clare Kitching, in the most engaged post in this week’s set, shared findings from the MIT AI Risk Initiative: 32% of the top 100 companies have not publicly acknowledged any risk from AI, rising to an estimated 62% of the top 1,000. Five risks accounted for over half of all acknowledgments: discrimination, weapons and cyberattacks, fraud and scams, loss of privacy, and devaluation of human creativity. Companies rarely acknowledged the risks experts rated most severe; no top-100 company acknowledged power centralization or competitive dynamics, and 77% of risks went unacknowledged by companies in sectors experts judged extremely vulnerable to them. Her view: organizations take a risk seriously when they can picture it in their own business, and the less familiar risks, such as dependence on a handful of AI providers, changes to jobs, or competitive pressure to deploy too quickly, still belong in planning (Kitching, LinkedIn, 5 November).
The Lineage Gap. Public risk disclosure and actual risk management are not the same thing, and a company can manage a risk it does not disclose. But disclosure gaps matter in a week like this one. Morrison’s point in Signal 04 about inconsistent descriptions to investors and underwriters applies to public filings as well: a company that describes AI as central to its strategy while acknowledging no AI risk is creating exactly the kind of inconsistency that becomes a problem after an incident. Kitching’s list of unacknowledged risks is also a useful checklist. Dependence on a few providers connects directly to Shaik’s concentration warning in Signal 06, and competitive pressure to deploy quickly is the condition under which every control discussed in this issue tends to get skipped.
Boardroom Prompt. Does your company’s public disclosure of AI risk match the role AI plays in your strategy? Which risk on Kitching’s unacknowledged list would be hardest to discuss in your boardroom?
08 · Governance cannot wait for Washington
The Signal. Cathy Slider described how this week’s US election results may complicate the debate over federal versus state AI regulation. The administration has pushed for a uniform national framework, while states have developed their own rules, some comprehensive, as in Colorado, and others targeted, as in California. With Democrats set to control both chambers of Congress in January, efforts to restrict state AI regulation may face new opposition, while the administration retains considerable executive authority, which could mean several more years of uncertainty. Her takeaway: businesses should not wait for Washington before establishing their own AI governance (Slider, LinkedIn, 5 November). John Pavolotsky expects little change in legislative direction at first. Only about 0.6% of bills introduced in the current Congress have been signed into law, against a historical range of 2% to 9%, so states will remain the driving force, with final rules under the Colorado AI Act due before it takes effect on January 1, 2027 (Pavolotsky, LinkedIn, 5 November). Arun Antony listed the international calendar: automated decision-making rules in California and Colorado from January 2027, South Korea’s AI Basic Act penalties after its grace period from January 2027, Canada’s OSFI model risk guidelines including AI from May 2027, key obligations under India’s data protection law from May 2027, and EU AI Act high-risk obligations from December 2027 (Antony, LinkedIn, 4 November).
The Lineage Gap. Whatever happens in Congress, the compliance calendar for 2027 is already crowded, and it is set mostly by states and other countries. For a multinational, the practical conclusion is the one Slider reaches: governance designed to satisfy a specific statute will be rebuilt every time a statute changes, while governance designed around a few durable capabilities will carry across jurisdictions. Antony’s five questions (identity, authority, delegation, enforcement, evidence) are a reasonable statement of those capabilities, and they match what the bank, the insurer, and the supervisor in this week’s other signals are asking for. Regulation is converging on evidence, regardless of which level of government writes it.
Boardroom Prompt. Which 2027 AI compliance deadlines apply to your organization, and is your governance program built around those statutes or around capabilities that would satisfy any of them?
09 · The atomic unit is the workflow
The Signal. Kevin Mannion highlighted a line from Palantir’s earnings call this week, from CTO Shyam Sankar: “The atomic unit is the workflow.” Sankar’s argument is that AI labs have the enterprise wrong by treating the individual knowledge worker as the unit of value: “You can make people more productive and generate no actual return on investment.” Software development is his one exception, because there the worker is the workflow. Mannion noted the deal pattern Palantir described: customers arrive saying what they have does not work, move quickly to shorter contracts, then expand sharply. A home appliance company went from a $1 million pilot in the second quarter to a $15 million annual contract in the third; an industrial materials company went from nearly $3 million to $29 million. His advice for anyone running AI transformation: stop counting who is logged in, pick one workflow, and measure what comes out of it (Mannion, LinkedIn, 4 November). Guillermo Flor’s summary of Sequoia’s AI Ascent offered a practical definition that fits the same view: for business purposes, a system that can be dispatched to do a job, recover from failure, and keep going until the task is complete is what matters (Flor, LinkedIn, 2 November).
The Lineage Gap. Workflow as the unit of value is also workflow as the unit of governance. An adoption dashboard counts users; a workflow can be measured, owned, and evidenced end to end, with a beginning, an outcome, and a record of every step in between. That makes Sankar’s framing useful beyond sales strategy. If AI is bought, deployed, and expanded one workflow at a time, then authority, scope, and evidence can be designed one workflow at a time as well, which is far more tractable than governing “AI use” across an enterprise. Sequoia’s definition sharpens the point: a system that recovers from failure and keeps going until the job is done is exactly the kind of system that needs a defined scope and a verified stop.
Boardroom Prompt. Pick the AI workflow your organization is most proud of. Can management show what goes in, what comes out, who owns it, and the record of what happened in between?
10 · What survives the model swap
The Signal. Rakesh Gohel offered a test of what an organization actually owns: if a model swap wipes out what your AI agent learned, you never owned that knowledge. Because a better model arrives every few months and anyone can rent it, the model cannot be the source of advantage. What survives is knowledge about the organization’s own decisions, kept in layers of different durability: an ontology of the entities, relationships, constraints, and actions the business actually runs on; evaluations built from real operator edits and rejections that define a good decision under the organization’s conditions and can check whichever model comes next; procedures and rules that make validated knowledge cheap to apply and easy to inspect; and, last, model weights, useful for speed but the least portable place to keep an advantage (Gohel, LinkedIn, 1 November). Patric Dahse made the same point from a consulting angle: AI can now analyze legacy data and spot quality issues in days rather than weeks, but a model still does not know why a 20-year-old SAP system looks the way it does, which data matters to the business, or what happens if the cutover goes wrong (Dahse, LinkedIn, 2 November).
The Lineage Gap. Gohel’s framework is about competitive advantage, but every layer he describes is also a verification asset. An ontology records the constraints an agent must respect. Evaluations built from real decisions are the standard against which any model, current or future, can be checked. Written procedures are what an auditor can inspect. Knowledge that lives only in model weights can be neither inspected nor carried forward, which makes it both a strategic and a governance weakness. Read with Shaik’s warning about exit costs in Signal 06, the conclusion is consistent: the organizations with the most freedom to change models will be the ones that have written down what good looks like in a form no vendor holds.
Boardroom Prompt. If your organization had to replace its primary AI model next quarter, which knowledge would survive the switch, and which would have to be rebuilt from scratch?
The Verification Debt Tracker
The 2×2 from From Artificial to Verified Intelligence. Signal counts this week, with direction vs. last issue.
Agents & Workers held at 8, and the governed column turned outward. A bank contract made customers responsible for agent activity until revocation and required them to prove it. Insurers began conditioning coverage on independent testing while others moved to exclude AI. Practitioners separated access from authority, regulators set a crowded 2027 calendar, and the value research kept pointing to the workflow as the unit that can be measured and owned. Adversarial Swarms held at 2: a frontier model that reached the internet without authorization and was detected, but in an architecture where some alerts do not stop the agent; and a compromised AI coding extension distributed to developers for 11 hours. The Perspective row is quiet for a sixteenth straight week. The shift this week is about audience: proof of agent control is no longer something organizations produce for themselves. Their counterparties have started to ask for it.
Monday Morning
Three things to do next week.
01 · Read your bank agreements for agent clauses. Ask your treasurer and general counsel to check whether any banking, payments, or platform agreement now addresses AI agents, and what evidence it requires. If an agent touches company accounts, confirm you can show when its access was granted, what it was allowed to do, and when it was revoked.
02 · Test the stop, not the alert. For one production agent, run a simple exercise: trigger the condition that should stop it, and measure how long it takes to go from alert to verified loss of access. Record the result. That number is more useful to a board than any count of monitored agents.
03 · Compare the two descriptions. Before your next D&O or cyber renewal, put the description of AI use from your insurance application next to the description in your most recent investor materials. If they differ materially, resolve the difference before the underwriter or a claimant finds it.
The Reading Room
Three pieces worth your time this week.
Hiten Panchal: From prompt engineering to graph engineering (LinkedIn, 31 October, 12 reactions). A clear explanation of how AI systems are evolving from single prompts to autonomous agents to networks of agents sharing memory and workflows, and why each step changes the risk: cascading failures, shared-state leakage, and decision provenance that becomes hard to trace without hardwired approval points.
Nicole Darden Ford: Should the CISO role be split in two? (LinkedIn, 31 October, 56 reactions). A seasoned security leader’s view that the answer is less about two CISOs and more about the right structure around one accountable executive, with a strong deputy owning operations. Her sharper point: organizations keep expanding the CISO’s responsibilities without matching authority or resources.
Ram Srinivasan: From knowledge work to wisdom work (LinkedIn, 4 November, 29 reactions). Starting from Drucker’s 1959 coinage of “knowledge worker” and an OpenAI essay on the future of the firm, a reflection on what becomes valuable when knowledge is cheap: judgment, context, and the willingness to take responsibility for consequences. His questions about where authority resides when intelligence is embedded throughout an organization are the right ones for leadership teams.
Trust is expensive. So is its absence.
The Verified Intelligence Briefing is written by Steve Tout, Founder & CEO of Identient and author of The CISO on the Razor’s Edge. It draws from the curated Daily Signal corpus and the Verified Intelligence framework introduced in From Artificial to Verified Intelligence.
If this issue clarified something for you, forward it to one colleague who owns part of the control plane. New here? Subscribe to get The Briefing every Friday morning.
Reply or comment with the question you’d want answered in next week’s issue. Your prompt may become Boardroom Prompt #1.
Connect with Steve: LinkedIn · identient.com · stevetout.com