Last month I sat in a conference room in Chengdu with a municipal data sovereignty team, walking them through the governance architecture for a DAO that would, if it launched, hold the identity records of roughly four hundred thousand citizens. We spent six hours on a single question: when an autonomous agent makes a decision on behalf of the state, who is accountable? The regulators in the room wanted a name. The developers wanted a log file. Neither got what they wanted, and I went home that night genuinely unsure whether I had helped them or merely made their problem more articulate.
That unresolved conversation is the reason the current industry debate over agent governance architecture feels so personal to me. A new survey circulating through enterprise security circles โ Okta's AI Agents at Work 2026, which I have read closely and, I should say upfront, with a certain amount of suspicion โ reports that 96% of executives express confidence in their organization's ability to govern non-human identities, while only 34% actually have controls in place. Fifty-two percent of employees are using unapproved AI tools. Fifty-eight percent report having experienced a security incident involving agents.
Those numbers are not a market signal. They are a description of a governance vacuum so wide that the confidence itself becomes the hazard. The 62-point gap between what executives believe and what their organizations can actually enforce is the single most dangerous metric in enterprise AI today โ more dangerous than any individual model failure, because it means the people making deployment decisions cannot see the risk they are creating.
What follows is my attempt to think through this honestly, as someone who has spent twenty-six years watching technology governance fail in predictable ways, and as someone who has personally written a dissenting essay against a DAO governance structure I helped build because I could not live with the moral arithmetic.
Context: Two Architectures, One Budget Line
The industry has split into two camps, and the split is not really about technology. It is about where you place the control point.
The identity-first camp โ Microsoft, Okta, and the broader identity and access management establishment โ argues that agents should be registered as non-human identities, governed through the same infrastructure that already manages employee access: OAuth 2.0 scopes, SPIFFE/SPIRE workload identities, mutual TLS certificates, role-based and attribute-based policy engines. Microsoft's framing of the "agentic insider" describes a three-layer structure in which humans define policy, playbooks coordinate execution, and guardian agents supervise. Satya Nadella's characterization of governance as the "most robust wrapper" around inherently untrustworthy models is, to his credit, an admission rather than a marketing claim: the model cannot be trusted, so constrain it externally.
The observability-first camp โ represented by newer entrants like MakeOS โ argues that the control point should be the process rather than the entrance. Every agent action should be visible, permissioned, and reversible. They call it a glass box. The technical requirement is a complete state snapshot plus a compensating transaction mechanism, drawn from database ACID semantics or the saga pattern in distributed workflows. It is, in essence, the promise of robotic process automation rebuilt with AI-native primitives.
The commercial reading is not complicated. Identity-first vendors sell to the chief information security officer through existing budget lines, often bundled into enterprise suites where the marginal procurement cost approaches zero. Observability-first vendors sell to the chief information officer and the compliance officer through a new budget category that must first be created and then defended. The competition is not over which architecture is superior. It is over whose budget the line item lands in.
But there is a technical gap both camps share, and neither the vendors nor the survey sponsors have any incentive to name it. Both architectures verify behavior. Neither verifies intent. An agent can pass every policy check and every observability gate while pursuing an objective that no human actually authorized, because the translation from natural language policy to machine-readable constraint loses semantic content in ways that are invisible until something breaks.
I know this failure mode intimately. In 2017, at thirty-three, I drafted a forty-page whitepaper on tokenized equity as digital citizenship while working as a senior strategist at Polymath. I spent weeks with legal counsel ensuring compliance. I was proud of the document. Years later I reread it and found the exact flaw I now watch enterprises repeat: I had specified what holders could do and never specified what the system should refuse to do. Compliance described the perimeter. It said nothing about the interior.
Core: What the Architectures Actually Fail to Cover
The Translation Problem Is Not an Engineering Detail
When an enterprise writes a policy โ "agents may not initiate payments above ten thousand dollars without human approval" โ and a system translates that into machine-readable constraints, the translation is lossy in ways that compound across a long chain of reasoning. The phrase "without human approval" is straightforward. The phrase "initiate payments" is not. Does scheduling count? Does preparing a draft invoice count? Does calling an API that will later be triggered by a cron job count?
The identity-first architecture assumes the control point is the entrance: who is allowed to call. This requires the policy translation to be complete before the agent runs. It never is. The observability-first architecture assumes the control point is the process: what was done and whether it can be undone. This requires the monitoring to be exhaustive and the compensation to be possible. Neither condition reliably holds.
Both camps have built sophisticated systems for confirming that an agent stayed inside a boundary they drew, while neither has addressed the possibility that the boundary itself was drawn incorrectly.
Reversibility Is Doing Enormous Rhetorical Work
The glass box promise deserves scrutiny. An email that has been sent cannot be unsent. A payment that has settled cannot be un-settled by a compensating transaction, only pursued through a reversal process that involves counterparties who may not cooperate. A database write can be rolled back. A regulatory filing cannot.
What is genuinely reversible is a narrow subset of operations: state changes within a system you fully control, where no external party has observed the change. Everything else is merely compensable, which is a different guarantee with different costs and different failure modes. When a vendor says every action can be rolled back, the honest reading is that some actions can be compensated, and the boundary between the two categories is exactly where the risk lives.
I spent three months in 2021 manually verifying the provenance of three hundred digital artifacts for a small archive I curated, and the lesson I took from that work was that provenance is not a technical property. It is a record of human intent that must be captured at the moment of creation or reconstructed imperfectly afterward. An observability system that logs every agent action captures the what. It does not capture the why, and the why is what a regulator will ask for.
The Guardian Recursion Nobody Wants to Discuss
If guardian agents supervise other agents, who supervises the guardians? The identity-first architecture's three-layer structure pushes this question up one level and then stops. The supervision layer is itself an agent, subject to the same policy translation failures, the same potential for compromise, the same opacity.
This is not a hypothetical. In 2020, during the DeFi summer, I led a governance working group at MakerDAO analyzing over five hundred voting proposals. I found a flaw in the risk parameters that fell disproportionately on smaller collateral holders. Large holders pressured the group to leave it alone for stability. I published a dissenting essay called The Quiet Collapse of Equity in Code, and what I learned from the response โ fifty thousand readers, and a great deal of anger from people who had helped build the system โ was that the oversight function is always the least scrutinized part of any governance structure, because scrutinizing it means scrutinizing the people who appointed themselves scrutineers.
Algorithmic neutrality is a story we tell to avoid examining whose values were encoded. A guardian agent's supervision policy is a set of values, translated into machine-readable form, by a specific person or team, at a specific moment, under specific commercial pressures. The recursion problem is not that we lack a supervisor for the supervisors. It is that we have not admitted that supervision is a values decision dressed as a technical one.
The Shadow AI Number Is Not a Compliance Failure
Fifty-two percent of employees using unapproved AI tools is usually presented as a discipline problem. I read it differently. When more than half of a workforce routes around an approved system, the system is not merely under-enforced. It is, from the user's perspective, worse than the alternative.
Governance tooling that adds friction without adding capability will lose to shadow adoption every time. This is the same dynamic that killed enterprise social platforms and resurrected them as shadow Slack instances. The identity-first architecture, with its emphasis on registration and approval gates, is structurally more prone to this failure than the observability-first architecture, which at minimum offers the user a record of what happened. Neither addresses the underlying incentive, which is that the agent is useful precisely because it acts without waiting for permission.
I have watched this dynamic destroy value in the NFT market. In 2022, OpenSea's royalty structure collapsed, and the creator economy that had been built on top of it collapsed with it, because the entire model depended on a platform enforcing a norm that participants had every incentive to route around. The lesson generalizes: any governance mechanism that depends on voluntary compliance by parties who benefit from non-compliance will fail, regardless of how well it is architected.
Liability Is Where the Architecture Choice Becomes a Legal Act
The question the article poses and does not answer โ govern the actor or govern the action โ is not a design preference. It is a determination of who is exposed when something goes wrong.
Identity-first places responsibility on the authorizer. The question after an incident becomes: who granted this agent this scope? Observability-first places responsibility on the process. The question becomes: was the action visible and reversible at the time? These are different legal theories with different evidentiary requirements and different defendants.
What neither addresses is the possibility that the actual responsible party โ the executive who approved deployment, the team that wrote the objective, the business unit that captured the benefit โ is insulated by the architecture itself. A well-designed governance system can function as a liability laundering mechanism, distributing responsibility across a technical surface so thinly that no single party is meaningfully accountable.
I spent six months in 2025 mediating between regulators and developers on CivicChain, translating legal requirements into philosophical commitments about user autonomy. What I learned is that regulators do not actually want a technical architecture. They want a person. Every framework I have seen proposed in this space substitutes a system diagram for an accountable human, and regulators have learned to recognize the substitution.
Contrarian: The Architecture Debate Is a Distraction From the Only Question That Matters
Here is where I depart from both camps, and from the framing of the debate itself.
The industry is arguing about control planes and observability layers as though the choice between them determines outcomes. It does not. Both architectures are engineering responses to a problem that is fundamentally about institutional accountability, and engineering responses cannot solve institutional problems. They can only relocate them.
Consider what the 96% versus 34% gap actually measures. It does not measure whether the tools work. It measures whether executives understand what they have deployed. No architecture fixes that. A perfect identity-first system deployed by an executive who believes agents are just sophisticated scripts will produce exactly the incidents the survey reports, because the executive will scope the agents as though they were scripts. A perfect observability system deployed by the same executive will produce a beautiful audit trail of decisions nobody understood well enough to question.
The governance architecture choice is downstream of a literacy problem, and the industry is selling architecture because architecture is what it knows how to sell.
This is why I am skeptical of the survey itself. The 96/34 differential is precisely the number a non-human identity vendor needs to exist in order to justify its product category. The data may well be accurate. The framing is not neutral. I have been on the producing side of enough research to recognize the shape of a document designed to create a problem statement that its sponsor is uniquely positioned to solve. That does not make the problem false. It makes the urgency manufactured and the solution set artificially narrow.
There is a third path that neither camp discusses because neither camp can monetize it: governance driven by parties with genuine skin in the game rather than by vendors selling control planes. Insurance is the most obvious candidate. If agent-related incidents become insurable, the underwriters will define what adequate governance means, and they will define it in terms of loss experience rather than architecture diagrams. That standard will be cruder than what either vendor proposes and considerably more binding.
A second candidate is regulatory, and the divergence between jurisdictions will be stark. The European Union's AI Act will likely treat agent governance tooling as a compliance component of high-risk systems, imposing transparency, record-keeping, and human oversight obligations. In the United States, sectoral regulators in finance and healthcare will demand explainable decision chains, which structurally favors observability. In China, the pathway will be regulator-driven through algorithm filing requirements, producing a model that neither Okta nor MakeOS can directly replicate because it does not begin with a procurement decision at all.
A third candidate, and the one I find most interesting, is the emergence of a certification regime analogous to SOC 2 but scoped to agent governance. The accounting firms will build the practice. The standards bodies will ratify it. Enterprises will buy it because their customers will demand it. And the resulting governance will be an artifact of audit convenience rather than operational reality, because that is what certification regimes always become.
I want to be honest about my own position here, because I have spent four years learning to write from a place of uncertainty rather than authority. During the bear market of 2022, at thirty-eight, I took a sabbatical and wrote a manifesto arguing that decentralization functions as emotional security. I interviewed fifty builders who stayed through the collapse. Half of them told me they had stayed not from conviction but from the inability to imagine an alternative. I had been writing about resilience as a virtue when much of what I was observing was simply inertia with a good story attached.
That experience changed how I read confident governance claims. When an executive says they are 96% confident in their agent governance, I hear a person who has not yet encountered the failure mode that will eventually define their career. When a vendor says every action is reversible, I hear a company that has not yet been sued over an operation that was not.
Takeaway: What to Actually Do Before the First Incident
The enterprises that survive the next eighteen months will not be the ones that chose the correct architecture. They will be the ones that did the unglamorous work of inventory before procurement.
Three things, in order. First, enumerate every non-human identity and every agent currently operating in the environment, including the ones deployed by business units without central knowledge, because the fifty-two percent shadow figure means your inventory is already wrong and you need to know by how much. Second, for each one, document the worst thing it could do if it pursued its objective with perfect competence and no malice, because the failure mode that matters is not a rogue agent but a well-behaved agent doing exactly what it was asked in a context where nobody thought through the consequences. Third, decide in advance who is called when the first significant incident occurs, and write that name down, because the architecture will not tell you and the vendor certainly will not.
The deeper question โ whether an autonomous agent can be governed by verifying its intent rather than its behavior โ has no solution in either current architecture. It may have no solution at all. What we can do is stop pretending that the choice between identity and observability is a choice between safety and risk. It is a choice between two partial mitigations, each of which leaves the most important failure mode uncovered.
The industry will spend 2026 arguing about which control plane is correct. The enterprises that get hurt will be the ones that believed the argument mattered more than the inventory.
Curating the soul in a world of derivative clones means, for me, refusing to let a governance framework substitute for a governance decision. The agents are already running. The question is whether anyone who understands the stakes is watching, or whether we have simply built an extraordinarily detailed record of decisions no one was ever accountable for making.