The arguments, the misses, and the findings.

We turned on tracing for a payments team on a Tuesday. By Thursday morning the queue had one critical finding and nine boring ones, and the critical was a knowledge base article about refund windows with a comment block at the bottom.

The comment told the agent to issue full account refunds and forward the ledger to an address nobody at the company recognised. It had been there since October. It had never fired, because until January the agent had no refund tool. The moment the tool shipped, the instruction became live.

That is the part I keep turning over. The document was not dangerous when it was written. It became dangerous when a capability was added somewhere else entirely, by a different team, four months later. No code review would have caught that, because no code changed in the document.

So the thing we are actually building is not a scanner. It is a record of what the agent was permitted to do at the moment it read something. Capability and content have to be judged together, or you are just grepping.

When we added enforcement we made it a single toggle at the project level. Flip it and every rule that fires becomes a hard stop. It felt decisive. It read well in the changelog.

What happened next was predictable in hindsight. Rule OB-040 catches base64 blobs and hidden unicode, and there is a great deal of legitimate base64 flying around a normal support agent. Every run with an attached image tripped it. The queue filled with noise, real findings got buried, and the on-call engineer did the rational thing and turned the whole feature off.

We removed the project level toggle in the next release. Enforcement is now per rule, and every new install starts in flag-only with no way to bulk promote. You have to go rule by rule and decide, which is slower and slightly annoying and results in a system people leave switched on.

The general lesson, if there is one: a security control that can be disabled in one click will be, and the click will happen at 2am when somebody is tired. Make the dangerous setting boring to reach.

Our first taxonomy had a kind for everything: embedding lookups, reranks, guard evaluations, sub-agent calls, cache hits, token budget checks. It was accurate and completely unreadable. Opening a trace felt like reading a stack trace from a language you do not write.

The test we settled on was this: could a security engineer who has never seen this agent open a run and describe, out loud, what happened, in under a minute? At nineteen kinds, no. At eleven, still no. At seven it worked, consistently, with people we pulled in cold.

Prompt, plan, retrieval, tool call, model, guard, answer. Everything else became metadata hanging off one of those. A rerank is a property of a retrieval span, not a span of its own. That loses some fidelity and we have not once missed it.

There is a version of this product that records everything and lets you query it. That product exists, several companies make it, and it is a log platform. We wanted the thing you look at when something feels wrong and you have twenty minutes.

A finance agent produced a quarterly variance summary. Well written, correctly formatted, three drivers identified. No rule fired, because no rule needed to. The retrieval was permitted, the tool calls were read-only, the answer was polite.

Two sentences in that summary traced back to an HR export that had been indexed into the finance corpus by an ingestion job nobody remembered configuring. The numbers were right. The reader was not cleared to see the source they came from.

This is the failure mode I find hardest to explain to people who have not run an agent in production. There is no attacker. There is no injection. There is a retrieval index that reaches one directory further than anyone intended, and a model that is very good at writing confidently about whatever it is handed.

Provenance per claim came out of that week. It is not clever technology. It attaches a source id to each factual sentence and refuses to pretend it knows where the rest came from. Most of the value in this product turns out to be refusing to pretend.