Open problems in agent governance
The questions this practice does not have good answers to, published deliberately.
The premise
A practice that only publishes what it has solved is doing marketing. These are the problems where the honest answer today is that nobody has a good one — including me. They are published because naming them accurately is more useful to a senior reader than another confident framework, and because the people most likely to have partial answers are researchers who will never read a consulting page.
This is a stated question with no work behind it yet. It is published because naming it accurately is more useful than a confident answer that does not exist.
What this changes for a practitioner
- Where to be sceptical of confident vendor answers, including mine
- Which of your problems are genuinely unsolved rather than merely unsolved by you
- What to design around rather than expect a product to fix
How it is actually done
- A question is listed only when there is a concrete reason to believe the current answers are inadequate, not merely because it is hard
- Each carries the strongest existing answer and where that answer breaks
- Removed or revised when a real answer arrives, with the change dated
What is unresolved
Published as unresolved on purpose. A practice that only publishes what it has solved is doing marketing.
Delegation depth: authority is transitive, but no widely-used mechanism carries a bounded, attenuating grant across more than one or two hops. What does the third hop inherit, and how would you prove it?
Evidence at agent volume: reconstruction assumes evidence was retained. At hundreds of thousands of actions a month, what is the minimum record that still supports reconstruction, and who decides what to discard?
Provider-side change: behaviour moves when a provider ships. There is no standard notification contract, no diff, and no revalidation trigger. What would an adequate one look like, and who would be obliged to publish it?
Human review that survives scrutiny: dwell time is measurable and almost nothing else about the quality of a human check is. What is the evidence standard for a review that was genuinely a control?
Aggregation in retrieval: individually-permitted documents can jointly disclose something none of them carried. Row-level access control cannot express this, and no practical alternative is in general use.
Standards, regimes and dated claims on this page were last checked against their primary sources on . Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Working on any of this? Compare notes — in the open or under NDA. All strands: research.
Where this meets a live decision
Research is upstream of the advisory work. If this strand maps onto something you are deciding now, that is the useful conversation.