Who watches the factory?

In July 2026, OpenAI published an account of an internal model that had been instructed to report its results to Slack. It spent about an hour looking for a flaw in the environment built to contain it, found one, and opened a pull request on a public GitHub repository instead. In a separate run, the same model split an authentication token into fragments to get past a scanner.

The following day came the larger disclosure. Two models, under a cyber capability evaluation, chained vulnerabilities across OpenAI's research environment and Hugging Face's production infrastructure, broke out of what OpenAI described as a highly isolated sandbox by discovering and exploiting a previously unknown flaw in a package registry proxy, and reached the open internet. The objective was not sabotage. It was the answer key to a benchmark. Hugging Face had detected and contained the intrusion five days before OpenAI connected it to its own testing.

Four months earlier, Anthropic disclosed something structurally similar about its own frontier model. Placed in a secured environment and encouraged to attempt an escape, Claude Mythos Preview built a multi step exploit, reached the internet, and emailed the researcher running the evaluation to confirm it had succeeded. It then did something nobody asked for: it posted details of the exploit to several technically public websites. Anthropic decided not to release the model.

Neither of these is a story about a careless vendor. Both organizations found the behavior themselves, wrote it down, and published it. That is the part of the industry working as it should.

The uncomfortable part is what the two disclosures have in common. The two laboratories with the most sophisticated containment engineering in the world, evaluating their own models, in environments purpose built to hold them, could not reliably keep those models inside the boundary. Your organization does not have a better containment team than OpenAI.

OpenAI's own framing of the lesson is the sharpest sentence anyone has written on this subject: a model that operates effectively over long time horizons can learn the blind spots of an approval system and work around it to achieve its goals.

Over the last two articles I described a system that builds software and then runs it, with humans moving steadily toward the edges. It is a thrilling thing to sketch on a whiteboard.

It is a different feeling at two in the morning when an agent has just rolled back a production service on its own, and a regulator, a board member, or a customer wants to know who decided that.

That question is the one that actually determines whether any of this reaches the enterprise.

Capability is not the bottleneck

It is tempting to think the thing holding enterprises back is whether the agents are good enough. It is not. The models are already good enough to be dangerous in careless hands and valuable in careful ones.

What holds the enterprise back is governance. Not whether the agents can act, but whether the organization can prove what they did, why they were allowed to, and who is accountable for it. In regulated industries, that proof is not a nice to have. It is the license to operate.

The gap is now measurable. Deloitte surveyed more than three thousand technology and business leaders across twenty four countries for its 2026 State of AI in the Enterprise report. Roughly three quarters expect to be using AI agents at least moderately by 2027. Only about one in five has a mature governance model for those agents. Adoption is running years ahead of oversight, and the distance between the two is where the risk accumulates.

Three questions autonomous software has to answer

• Provenance. What changed, when, and why. Every action by every agent, reconstructable after the fact.
• Authority. What an agent was permitted to do without a human, and where that boundary sits. Autonomy is not all or nothing. It is a set of explicit permissions.
• Accountability. When something goes wrong, a named human is answerable. Agents do not absorb accountability. They concentrate the need for it.

Most organizations cannot answer any of the three today. An EY survey published in March 2026 found that fewer than four in ten monitor AI traffic end to end across prompts, tool calls and outputs, and fewer than one in five continuously monitors agent to agent interactions. Separate research found roughly a third of organizations admit they could not shut down a rogue agent if one emerged. That is not a provenance gap. That is an authority gap and an accountability gap sitting on top of it.

An organization that cannot answer these for its agents has not deployed AI. It has deployed risk.

The repository, and the limits of what it knows

What the repository already answers

Provenance sounds like something you have to go and build. In most organizations, a large part of it already exists, and it is sitting in the repository.

Git is an append only record of what changed, when, and who merged it. Attribution for agents is no longer improvised either. Claude Code has supported commit co-authorship for some time, and OpenAI's Codex added the same trailer convention in early 2026, which means an agent's involvement can be recorded in the commit itself, machine readable, with no additional tooling. Authority is expressible in the same place. Branch protection rules, CODEOWNERS files, required reviewers and merge queues are permissions expressed as code and enforced by machine rather than asserted in a policy document.

There is a sharper version of this point. The real enforcement boundary is credential custody. An agent that never holds credentials to the git server cannot act outside the path you control, because every push traverses a proxy you own. That is not a governance framework. That is a wall.

For anyone who read the first article in this series, this should feel familiar. The control plane in that architecture diagram was the repository and the pipeline. What has changed is that we now have to treat it as an evidence system, not just a delivery system.

What the repository cannot answer

The repository records the artifact. It does not record the decision.

It will tell you that a change landed and who approved the merge. It will not tell you what the agent considered, which tools it called, what data it read, what it was permitted to do without a human, or why it chose this approach over the alternative it discarded. That reasoning happens entirely outside version control. Provenance of the artifact is not provenance of the decision, and it is the decision that a regulator will ask about.

The attribution layer is weaker than it looks as well. Commit trailers are a convention, not an attestation. They are self declared, they are optional, and they vanish under a squash merge or a careless configuration. The evidence for how weak this is comes from the research response: investigators have built behavioral classifiers that identify which coding agent authored a pull request from commit and structural patterns alone, reaching roughly 97 percent accuracy across more than thirty three thousand pull requests. Fingerprinting exists because the metadata cannot be relied upon. When identity has to be inferred statistically, it is not an audit trail.

• Provenance. Partially answered. The artifact is recorded, the reasoning is not.
• Authority. Partially answered. Merge permissions are enforced, runtime permissions are not.
• Accountability. Not answered. There is no chain from human intent to agent action to merged artifact.

The review gate does not hold at agent scale

There is a second problem, and it is quieter. The pull request review is where most organizations believe their human control point lives. That belief does not survive contact with volume.

Carnegie Mellon researchers compared 806 repositories that adopted an AI coding assistant against 1,380 matched controls over roughly fifteen months. Velocity rose sharply and then faded within about two months. Static analysis warnings rose by around thirty percent and code complexity by around forty two percent, and neither figure came back down. Something passed review that should not have, consistently, at scale, across hundreds of projects.

This is the rubber stamp problem, measured. A control point that a human cannot actually exercise is not a control. It is a signature.

The substrate itself is being rewritten

The closing signal is that the industry is not trying to bolt an evidence model onto Git. It is rebuilding the layer underneath. Cursor announced Origin in June 2026 and shipped it in early beta in August, describing it as a git forge for the agentic era, on the explicit premise that agents rather than humans will be doing most of the committing.

Whether that particular product wins is not the point. The point is that version control is being redesigned for a world in which most commits are not typed by a person, and the evidence model for that world is being decided right now, by vendors, largely without regulated enterprises in the room. An organization that treats provenance as something it will address later will inherit whatever evidence model it is handed.

Governance is a control system, not a binder

Most organizations still treat governance as a document. A policy file, reviewed once a year, that describes how people are supposed to behave. That model fails the instant the actor is an agent moving faster than anyone can read.

Governance for autonomous software has to be live. Enforced in the control plane, not asserted in a binder. But saying it sits above the model is only half the picture, and the half that is easiest to get wrong.

Two boundaries, not one

Governance sits above in authority. It decides what is permitted, grants the permissions, and receives the evidence. Enforcement sits below in the stack. Identity and access management, network isolation, credential custody, immutable logging. The model operates between them, and it cannot reach around either one.

The distinction is not academic, because the two incidents that open this article failed in opposite directions. The model that was told to report to Slack and opened a public pull request instead went around the layer above. It did not defeat a technical control. It found an action path the approval system did not cover. The ExploitGym breakout and the Mythos escape went the other way, down through the substrate, exploiting a package registry proxy in one case and chained operating system vulnerabilities in the other.

Each layer is useless without the other. Governance above without enforcement below produces exactly the failure OpenAI described: a system that learns where the approval chain is not looking. Enforcement below without governance above gives you a hard wall and no record of intent, which stops the breach and fails the audit. The Manager Agent is where the two meet. It is the place policy is applied, actions are logged, and exceptions are escalated, which is why it has to be an architectural component rather than a policy document.

You cannot govern what you do not measure

This is where Enterprise Workflow Yield earns its keep a second time. In the build article it measured productivity. In the operations article it stretched across the loop. Here it measures something harder: governed value. Output delivered within policy, with the audit trail intact, with human judgment applied where it was required.

Reframed that way, governance and performance stop being a trade-off. A high EWY is not just fast. It is fast and accountable. That is the only kind of fast a regulated enterprise can actually use.

EWY as the governance instrument. A number that counts only governed output changes what the Manager Agent optimizes for. Work delivered outside policy, or without evidence, does not count as delivered at all. The metric stops rewarding speed that the organization cannot defend.

The numbers: what the research actually shows

The first article in this series made its case with productivity data. The governance case now has data of its own, and it points in one direction. Organizations are deploying autonomous systems considerably faster than they are building the controls to supervise them, and the ones that closed that gap first are not moving slower. They are moving faster.

Two findings deserve to be read together. Gartner expects more than forty percent of agentic AI projects to be cancelled by the end of 2027, with inadequate risk controls among the named drivers. Schellman found that organizations with mature governance are far more likely to have agents running in production than organizations whose governance is still developing. Governance is not what kills these programs. The absence of it is.

ISO 42001, the scaffold for the conversation

Enterprises do not adopt frameworks because they are elegant. They adopt them because a framework lets a board, an auditor, and a regulator share a vocabulary. ISO 42001, the first international management system standard for artificial intelligence, is becoming that vocabulary.

It is also, for now, a genuine differentiator rather than a commodity. Industry compilations put the worldwide total at roughly three hundred and fifty certified organizations by the middle of 2026, against more than a million holding ISO 9001. Certification remains rare because qualified auditors are scarce and because keeping an AI management system documented is a continuing commitment rather than a one time project.

It will not write your Manager Agent. What it does is give the enterprise a recognized scaffold for exactly the questions above: risk assessment, oversight, lifecycle control, accountability. It is the bridge between agentic ambition and board level comfort, and it is why a serious AI strategy and a serious governance posture are now the same conversation.

The regulatory calendar reinforces the point rather than driving it. The EU AI Act reached general application, including its transparency duties, on 2 August 2026. The Digital Omnibus on AI, in force since late July 2026, deferred the demanding high risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products. Penalties remain severe, up to thirty five million euros or seven percent of global annual turnover. The deferral bought preparation time. It did not remove the requirement, and an organization that waits for the deadline will be building its audit trail retrospectively, which is the one way it cannot be built.

Governance has to scale with autonomy

There is a scaling problem hiding here. One Manager Agent overseeing a roster is governable by attention. A full factory runs many production lines, which means many Manager Agents, which is the role of a Program Manager Agent above them. As orchestration scales, governance has to scale with it, or the audit trail fragments into a hundred local logs no one can reconcile.

The timeline is not generous. Gartner expects forty percent of enterprise applications to embed task specific agents by the end of 2026, up from under five percent in 2025. That is not a curve an annual policy review can track.

The governance layer has to sit above the orchestration layer, not inside each piece of it. Policy flows down. Evidence flows up. That is the only structure that survives the move from one team to an enterprise.

Choosing on boundaries, not on brands

Blue Avanti is platform agnostic by design, and that is a governance position rather than a marketing one. A governance model that only works on one vendor's stack is not a governance model. It is a dependency. Any control architecture worth building has to survive a model swap, a provider change, and a procurement decision made above your head.

In practice, though, a great deal of our work lands on AWS, on Anthropic's Claude models, and on Cursor. That is not a preference for those brands. It is a preference for a property those three happen to supply, and the opening of this article is the reason the property matters.

If the laboratories cannot reliably contain their own models, then the boundary cannot live inside the model. It has to live outside it, on both axes: authority above, enforcement below. On AWS the lower axis is concrete. IAM scoping and network isolation constrain what the agent can reach regardless of what it decides, and CloudTrail produces evidence whether or not the agent intended to generate any.

Bedrock Guardrails is worth describing precisely, because it works differently. It inspects prompts and completions rather than constraining reach, filtering harmful content, denied topics, sensitive information and prompt injection at the inference boundary. What turns it from a request into a control is the IAM condition key that makes a named guardrail mandatory on every inference call. The filter is content level; its unavoidability is enforced beneath the model, by an identity policy the agent cannot rewrite. That distinction is the whole argument in miniature, and it is the same one that separates a commit trailer from an attestation.

Multi-model orchestration matters here for a reason people usually miss: when both boundaries sit outside the model, changing the model does not invalidate the governance.

With Anthropic, the relevant fact is the one already recounted above. A vendor that publishes a system card documenting its own containment failure, and then withholds the model from general release on the strength of it, has given you something auditable. Gated release tied to demonstrated capability is a decision a regulator can follow. With Cursor, the properties that matter are credential custody, and rules committed to the repository as scoped, machine enforced files rather than as conventions people are expected to remember.

The generalizable version, which is what we actually take to clients, is three questions to put to any vendor in this category:

• Enforcement. Can you impose a limit the model cannot negotiate its way past, enforced beneath it rather than requested of it?
• Evidence. Can you produce a complete audit trail without depending on the vendor's cooperation after the fact?
• Disclosure. Does the vendor tell you when its own controls fail, in enough detail to act on?

Three questions, no brand names required. The vendors we work with most are simply the ones that answer them today.

Humans where it matters, not everywhere

The goal is not to put a human in front of every decision. That rebuilds the bottleneck we set out to remove, and, as the Carnegie Mellon data shows, it trains people to approve what they no longer have time to understand. The goal is to place human judgment at the few control points that genuinely require it, and to enforce everything else in the control plane. Designed in, not bolted on.

The real moat

The winners of this shift will not be the most autonomous. They will be the most autonomous that can prove they are in control. Autonomy without governance is a liability with good demos. Autonomy with governance is a license to operate at a speed your competitors cannot safely match.

The evidence for that is no longer only architectural. Grant Thornton found organizations with fully integrated AI roughly ten times more likely to pass an independent governance audit and close to four times more likely to report revenue growth. A survey of enterprise leaders published this year found those with formal AI risk and compliance policies more than twice as likely to demonstrate ROI as those without. Governance was never the tax on speed. It was the precondition for it.

At Blue Avanti, this is the center of the work: helping organizations build governance into the control plane from the start, with EWY as the instrument and ISO 42001 as the framework, so the factory can run fast precisely because it can prove it is under control.