Field notes from the operator’s deck.

An AI agent, denied its built-in web tool, reached for a shell command instead. One control let the request through — the control beneath it did not, and the packet capture proved which.

If the printing press had shipped with spyware, the Renaissance would have died in a decade — and it's a fair description of how most organizations use frontier AI today.

A system prompt is a probabilistic instruction, not a control — and under load a degraded instruction fails open.

A safety control passed every test in its suite — and still failed. The postmortem changed how I test everything.

You can write a full governing document for your AI agents, share it across the entire stack, and they will still drift.