Reconstruct your last real emergency. Not the tidy version in the postmortem, the actual night. Something broke, someone pushed a fix to production at 2am, and it worked, or it didn't. Now answer three questions about that moment. Who approved the fix? What authority did they actually have to approve it? And where is that decision written down? In most companies the honest answers are a senior engineer who happened to be awake, none that anyone can point to, and nowhere — a Slack thread that has since scrolled out of reach. The incident is closed. The decision that resolved it has no author on record.
That gap is not a process failure you can train away. It is structural, and it sits in exactly the place your existing controls do not look.
The half you already did
For the past two years the pressure has been to govern your AI, and you were right to answer it. You put boundaries on what your agents can reach, gated the actions that matter, and made the machine ask before it touches production. That work is necessary. It is table stakes now, and a company that skipped it has a real problem on its hands. Nothing here asks you to walk any of it back. Watch the agent, govern the agent, keep doing it.
But governing the agent governs one actor. An incident is decided by more than one, and the others are not machines.
The two decisions that actually decide it
Walk any serious incident to its hinge points and you find two, and both of them are human.
The first is an approval. At 2am, under pressure, someone with a credential says yes: deploy it, override the check, push past the gate. That yes is the most consequential action in the whole event, and in most enterprises it happens in a side channel. A verbal go-ahead. A thumbs-up in a thread. A decision no system recorded, because no system was standing between the person and the action.
The second is a go-around. Someone with enough authority steps outside the system entirely. The owner in GitHub changes a branch-protection rule, adds or removes an agent, or force-pushes over history. The person with root in the cloud does the equivalent. They did not break in; they had the keys. And because they went around the platform rather than through it, the action leaves no trace inside the controls you built.
Those two moments, the approval and the go-around, are where an incident is actually won or lost. Your agent governance sees neither of them. It was built to enforce at the access layer, to decide what the agent may reach, and it treats the human holding the credential as someone else's problem. So the two decisions that matter most are the two your controls were never designed to witness.
Authorized inside, detected outside
The fix is not another layer bolted onto the same blind spot. It is to put the human and the agent on one governed plane, where both are actors whose decisions are recorded, and then to be honest about the two very different things that plane can do.
Authorized inside, detected outside.
Inside the boundary, every action carries a recorded allow-or-deny decision before it runs. The 2am approval stops being a verbal yes and becomes an authorization with an author, a scope, and an expiry: a decision the system made and kept, not a message that scrolled away. You enforce, because the action goes through you.
Outside the boundary is the harder, more honest half. When someone with the keys goes around the plane, you cannot enforce. No honest vendor can stand between an enterprise owner or a root account and the authority they already hold. What you can do is make the go-around impossible to do unseen. Reconciled against the platform's own logs, the bypass surfaces as an action nobody's policy authorized, with a name attached to it. You detect. The point was never to take the keys away from the people who need them; it is that no one, human or agent, gets to act with no record that they did.
Where this goes
None of this is about trusting the AI less, or the people less. It is about closing the distance between a decision and its record, on both sides of the boundary. The next two pieces take the two moments one at a time: the emergency approval, made into a decision with an author, and the go-around at the perimeter, made impossible to do invisibly.
For now, one question is enough, and worth putting to your own organization tonight. If something breaks at 2am and someone with a credential decides how it gets resolved, will you be able to reconstruct it cleanly, from a record and not a memory: who decided, what they were allowed to decide, and what they actually did? You governed the agent. That was the necessary half. This is the other one.