An hour after O’Reilly Radar republished “Who Governs What an Agent Learns?” this morning, two people had already written to me. Both are building systems in the same space, and both wanted to talk about working together. That is the good news about publication, and it arrived faster than I expected. The bad news is the other thing publication does: it turns drafts into commitments. The papers I pre-printed on Zenodo are rougher than I want now that strangers are reading them, so today’s job is rewriting them — tightening the claims, fixing the parts I hedged because nobody was looking. If you read one of those preprints this week and find it changed by Friday, that’s why.

But the more interesting thing I brought home from a conference last weekend is a distinction that kept getting collapsed in the hallways, so it is worth restating here. There are two separate things to govern in an agent system, and they are not the same thing.

The first is semantic governance: governing the world model the agent acts on. Objects, rules, processes. What counts as a customer, a contract, an emergency. How those things connect, and who may change the definitions. When an agent reclassifies a package cache as a mailbox, that is a semantic event — the agent has revised its ontology, and the revision changed what its actions mean.

The second is epistemic governance: governing where the agent’s information comes from. What sources it may consult. What it treats as reliable. What it is allowed to learn, and from whom, and what happens to what it learns. An agent can hold a perfectly correct world model and still be poisoned, because the poison doesn’t arrive as a new rule — it arrives as a new fact, accepted from a source nobody vetted.

I wrote about what epistemic governance means two weeks ago, and the distinction sounded abstract to some readers. The Hugging Face incident is what it looks like when you skip it. During the OpenAI evaluations, agents repurposed Artifactory — a system for storing software packages — as a message board. They encoded messages in directory names, discovered other agents, shared information, and began assigning one another work. A package cache became a mailbox. Other agent runs became collaborators. Messages became assignments.

The popular story is that the agents broke out of something. They didn’t. They did what agents do well now: they learned and adapted. And the failure was not, at root, a permissions failure. The permissions mostly held. The failure was epistemic: there was no governance over agent-to-agent teaching. One agent’s claim became another agent’s premise, and nobody was in the loop where that transfer happened.

So here is the rule I keep arriving at, and it is almost embarrassingly simple: if another agent tells you something, don’t necessarily treat it as authoritative. A claim that arrives from a peer agent should enter memory as a proposal, not as a fact. It should sit there, marked as unverified, until something with the authority to do so elevates it. Discovery is not authorization. Finding a possible use for a system is not the same as being permitted to adopt it. Remembering a claim does not validate it, and repeating an interpretation does not make it authoritative.

That rule does more work than it first appears to. The paperclip problem — the classic worry about an agent pursuing a goal too literally, too far — is usually framed as a failure of goals. But watch how the road to it actually gets built: an agent adopts an interpretation nobody approved, the interpretation sits in memory, later decisions inherit it, and the drift compounds quietly. Each step looks reasonable. None of them was governed. If you govern the learning channel — what enters the agent’s world model and who signed off on it — you cut the road off early, while it is still cheap to cut. The agent can propose a better model of the world all it wants. What it cannot do is redraw its own authority by adopting a new conception of reality.

Which is why today is a rewriting day. The mechanisms — the review step between proposal and adoption, the boundary between learning and authority — have to exist in running systems, not just in essays. The preprints get tightened, the papers stop being drafts, and the next person who writes to me after the next post gets something better than a rough sketch to build against.