The Layer Nobody Governs

You can’t guarantee what an agent will do by constraining what it can do. You have to govern what it knows.

The enforcement stack is assembling fast. On September 28, NVIDIA shipped the Open Agent Safety Platform: OpenShell, a secure runtime that turns operator instructions into verifiable policy on Vera CPUs, plus Sentry — a watchdog that runs on BlueField-4 DPUs, sits on the only path between the agent and its model, and quarantines an agent that steps outside its boundary in milliseconds. Progent, from Berkeley researchers, enforces least privilege at the tool-call interface and cut the AgentDojo attack success rate from 41.2 percent to 2.2. OWASP published its first Top 10 for Agentic Applications, and memory poisoning made the list as ASI06.

Every one of these governs what an agent can do. None of them governs what it can believe.

That’s a coverage gap, not a philosophical quibble. Sentry watches the boundary, not the beliefs. An agent acting entirely within its boundary on poisoned knowledge is invisible to every control in the stack. Progent approves or blocks tool calls against policy — the policy never asks whether the knowledge that motivated the call is true.

The knowledge layer has no enforcement point at all. OWASP’s ASI06 write-up names the controls that exist — write-time screening, trust-scored retrieval, provenance tracking, scope isolation — and the epistemic-security literature calls them underdeveloped. The Agent Security Bench measured up to 84.3 percent attack success across the defenses it tested. These are scattered tools, not a governance model. There is no ontology for what an agent is allowed to believe, no integrity model for its picture of the world, no answer to the question every deployment will eventually face: on what evidence is this agent operating?

The attack makes the question urgent. Agents write their own memory. MINJA-class attacks don’t need privileged access — an attacker plants content through ordinary interactions and lets the agent’s own extraction pipeline do the writing. Reported success rates run from 80 to over 99 percent. The agent that remembers is the agent that can be poisoned.

Then there’s propagation. Agents talk to agents. I gave Claude Code a complex project on Thursday and it spawned about 200 subagents — that’s real work now. One poisoned belief at the top propagates through the fleet: A tells B, B writes it to shared memory, C retrieves it as established fact. The final report a human reads is coherent, confident, and wrong.

The stakes are no longer hypothetical. Your laptop is the easy case. Managed-agent platforms are already moving this stack into enterprises — Anthropic’s Claude Managed Agents, Salesforce running OpenShell inside Slack, SAP embedding it in Joule Studio. The boundary cases are already real: an agent pulling patient records in a hospital, or sitting next to the cockpit in an airplane you’re on. On the laptop, bad knowledge wastes a weekend. In the rest of it, bad knowledge moves a patient or a plane.

Researchers have started to name this — a recent paper calls these systems epistemic agents and warns of epistemic drift when they’re poorly governed. Naming is not governance.

What governance would look like is a separate fight: provenance requirements for every belief, integrity checks on what an agent retains, scope limits on how far a belief can travel, quarantine when nothing verifies. Constraint says no. Governance decides who says what’s true, and who answers when it wasn’t.

The hardware is ready. The policies are written. Nobody owns the layer where the agent’s world gets built.