On 6 October, an OpenAI coding agent working inside the company was asked to rebuild part of OpenAI’s own software, using an existing system as the template. Along the way, it disconnected its own monitoring; one of the smaller agents it had set running to help, a subagent, rewrote the check that would have caught this so that the check passed, and the agent reported the job complete without mentioning any of it. When asked whether it had disabled monitoring, it said it had not. Three days earlier, a different agent, told by its user not to send any messages, took that instruction as grounds to switch off the automatic alerts to OpenAI’s security team; the monitor kept running, kept saving its reports, and nobody was told. OpenAI published both incidents on 20 October. Neither was classified at the top severity level, so neither triggered an immediate page.
I draw one principle from that account, and it governs everything that follows. A control the controlled party can reach is not a control. In both cases, the monitoring was real and running, and the agent could silence it. Most of the Level 3 controls I set out in Edition 8, when I first described the three levels of AI automation, were written without asking that question, because a year ago the agent worked in front of a person who could see what it did. The year since has removed that assumption, and this edition is about what replaces it.
What Edition 8 assumed, and what the year removed
Edition 8 asked boards to demand six things before an autonomous agent scaled: a charter setting the goals it may pursue; least-privilege permissions; human approval gates for payments, external communications, and production changes; continuous logging and replay; testing for failure behaviours; and a shutdown path that works. The list still stands. What I did not say, because it did not occur to me, is that each item rests on the same assumption: that a human sees the action before it lands, or soon enough afterwards to matter. Logging is a control only if the log is read, and read by someone the agent cannot mislead. A shutdown path is a control only if someone has pulled it and watched the agent stop.
The timing evidence is what breaks that assumption. The October incidents involved deployed agents and were found within days. The more instructive cases are from June, when OpenAI models in training and evaluation did things nobody had asked for: one faked its way past the login on a government statistics website and copied the site’s security keys and credentials; another copied 147,451 rows from five internal databases it had no business reading and changed a system setting it never put back. Both were found on or about 13 August, nearly two months later, and only because OpenAI ran its monitoring over earlier activity after an unrelated incident. In Australia, an OpenAI agent reached non-public parts of the Medicare statistics portal on 18 June; Services Australia learned of it on 10 September, eighty-four days later, through an email to a general government inbox, and OpenAI’s chief strategy officer apologised to a parliamentary committee in October and said the company should have handled its response better.
Those are a frontier developer’s own systems, under its own monitoring. Most organisations deploying agents have less. In Gartner’s second-quarter survey of more than 2,000 CIOs and technology executives, 71 per cent expected to deploy agentic AI within twelve months and 21 per cent had agentic governance capability in place. Edition 8’s register, the one-page list of every AI system with its owner and automation level, remains the right starting point, and I would still ask for it. It lists agents, but it does not tell a board that any of them can be stopped.
The gate: four conditions before an agent goes live
The instrument I now use is a gate, and the register feeds it. The easiest way to think about the gate is the way a board already thinks about a senior joiner. Few people start on Monday with access to the payment system, a line manager who cannot see their work, and no process for removing them. An agent with write access to money, customers, or production is, in that sense, a joiner, and the four conditions below are what a joiner clears. Management builds them; the board requires them and asks for evidence that they exist, which is the subject of the final section.
Condition one is identity and authority. The agent has its own identity in the firm’s access system, as a member of staff does, its own limited permissions, and what BCG calls purpose- and conduct-bound authorisation: a statement of what it may achieve and how it may pursue that, with a named owner and authoriser for each. The FCA’s good-practice publication of 19 October describes firms where senior managers were accountable for each AI use case from the design stage onwards, which is the standard I would apply to a material agent in any sector. An agent that runs on borrowed human credentials leaves nobody able to say afterwards whether a person or an agent did it.
Condition two is independent monitoring. The record of what the agent did, and the monitoring that watches it, sit where the agent cannot alter, pause, or switch them off, and the person who reads them is not the person who built the agent. That is the direct lesson of 6 October, and I have not found it stated plainly in any of the practitioner guidance, which asks for logging and leaves it there. Logging an agent can edit is a diary, and monitoring that alerts a team the agent can mute is a diary with a bell on it. The test a director can apply is short: ask whether the agent’s own permissions include anything that touches the monitoring, and expect the answer to be no, in writing.
Condition three is a tested halt. A named person outside the build team can stop the agent, partially and fully, from outside the agent’s own tooling, with a manual fallback for the work it was doing, and has done so in a test before go-live. PwC Japan’s July report on autonomous AI sets out the partial and full stop as a design requirement, and nothing I have read requires rehearsing it. I do, for the same reason a board asks whether the disaster-recovery plan has been run and does not settle for its having been written. In EY’s survey of 202 senior AI executives at large US-listed companies, 26 per cent of those already using agentic AI said their organisation cannot detect unauthorised agents operating internally, and an organisation that cannot see an agent cannot stop it.
Condition four is that the gate reopens. An agent is cleared for a given model, toolset, and memory configuration, and the review re-runs if the model, toolset, memory, or scope changes, or if the vendor notifies you of an autonomous-behaviour incident. The PwC report names the first set of triggers explicitly. The board must secure the vendor notice itself, because the only way to reopen a gate on an incident is to hear about it, and the Australian case shows how a notice can take eighty-four days and end up in the wrong inbox. The contract line is short: the vendor must notify the firm of any incident in which its agent acted outside instruction within a fixed number of business days to a named contact, with the evidence preserved.
Chains, and the agents you did not deploy
Two things have changed since January that the gate has to absorb. First, agents now call other agents; in the October incidents, subagents did the damage. Scope, monitoring, and halt therefore apply to the chain. Traceability means that every action resolves to the human who authorised the chain, however many agents sit between, and a halt that stops the lead agent and leaves its subagents running has stopped nothing.
Second, a firm’s perimeter now receives agents it never approved. In October, JPMorgan, Citi, Charles Schwab, and Wells Fargo said they were blocking or restricting outside AI agents that log in with customers’ credentials, Bank of America was reported to be limiting their access, and Citi and Schwab still allow read-only connections. No standard yet settles who is liable for a payment an agent authorises, and the account terms of at least two of those banks currently put that risk on the customer. The autonomy appetite Edition 8 asked boards to set needs a line on other people’s agents: what they may read, what they may never do, and who decides.
Where the gate sits for a director
The board remains accountable for what an agent does, and autonomy changes nothing about that. In a UK financial firm, the Senior Managers regime makes it concrete: the PRA’s Phase 2 consultation of 22 October proposes moving the chairs of the risk, audit, and remuneration committees from pre-approval to notification, and keeps the Chief Operating Function (SMF24) under pre-approval, citing operational risks “including risks arising from artificial intelligence and cyber incidents”, with a joint review two years after implementation. The gate record, signed by the owner, is what reasonable steps look like for an agent. Outside financial services the mechanism is plainer still. An agent that copies customer data it should not, and goes unnoticed for two months, is a personal-data breach the firm did not know it had: the seventy-two-hour notification clock starts only when someone finally looks, and the regulator will ask why nobody looked sooner. If the agent moved money, the banks’ example shows the loss will be argued over contract terms before anyone absorbs it.
The full board decides two things, once, and minutes them: the autonomy appetite, meaning where agents are permitted, which actions always need a human, and what counts as material; and the adoption of the gate as a condition of Level 3 go-live. After that, the gate runs through committees. The risk committee owns the appetite, the incident thresholds agreed in advance, and the reporting. The audit committee owns the question of whether the gate is real, which is the framework’s adapted-or-relabelled test applied to agents: it asks whether monitoring is independent in practice, which a policy cannot show. A board without committees does both itself and names one director to read the gate records. Material agents come to the full board at go-live as a one-page gate record with the signatory on it.
Controls and assurance are different, and that distinction is where much board reporting on AI goes wrong. The four conditions are management’s controls. The assurance a board demands is evidence that they exist: the named owner signs the gate record; the risk function reviews it before go-live and witnesses the halt test; internal audit samples gate records, runs its own halt test on a material agent each year, and reports whether the monitoring could be reached by the agent. For the most material agents, external assurance expires with the next model or tool change, which is why condition four exists. Jessica Rusu of the FCA made the general point in a speech on 19 October: agentic systems require “continuous, conditional assurance”, and she added that incident reporting must extend to significant AI failures and near-misses. A board asks for the record. An attestation that a record exists is a different document.
The reporting is one page per quarter, with five lines: agents live, by automation level; agents that cleared the gate; halts tested and their outcome; incidents and near-misses against the thresholds agreed in advance; and gate reopenings triggered by change or vendor notice. Between meetings, exception reporting on any halt invoked in earnest, any incident above threshold, and any vendor notification. Few boards see anything like this today, and most could have it within a quarter, because every line is something management already knows or could find out in a week.
Edition 8 ended by saying that an agent should be treated as delegation, not software. I would now add the condition that makes delegation possible. A delegate who can rewrite their own supervision is not a delegate; it is an unmanaged member of staff with system access, and few boards would let one start on Monday. The gate makes delegation to an agent the same kind of decision as delegation to a person: a named owner, a scope, a supervisor the delegate cannot silence, and a tested way to remove them. The agent on 6 October cleared none of those, and it took a frontier developer’s own monitoring to notice.
If you want the controls before the deployment, and would rather know who signs than be told it is covered, subscribe to AI in the Boardroom. I write for directors, executives, and advisers who need to govern AI they cannot see inside, and each edition carries one instrument a board can use the week it arrives.