The Question Nobody Can Answer

Enterprise AI governance looked like a familiar engineering problem. Know which systems exist. Know who can invoke them. Know what they reach. Keep the evidence.

That problem is not trivial, and we did not treat it as trivial. A credible governance system has to connect policy to runtime behaviour — to stop being documents and review boards and become operational. Identity established. Controls assigned. Execution constrained. Activity observed. Evidence that survives the transaction.

We built toward exactly that. The architecture governed the technical conditions of AI operation rather than merely describing them. It integrated low-level facts about systems and resources with typed relationships and governance state. It could determine whether a governed path existed from an approved use case to an approved execution environment. It could record what happened.

That capability has real value. It closes a gap that persists across most AI programmes: policy written in one place, technical execution happening in another, and the evidence linking them assembled afterward, under pressure, by someone who was not there.

For a period, that framing appeared sufficient. Better controls, better evidence, better enforcement — the path to better governance.

An agentic system interprets a goal, selects tools, acts on other systems, and keeps operating over time. The moment AI moves from recommendation to action, the thing you are governing is no longer the thing your architecture was built to govern.

And that exposes a distinction most stacks have never had to make. An agent can possess a capability without possessing any legitimate authority to exercise it. A credential, a role, an API scope, a tool binding — each of these indicates a technical possibility. None of them establishes purpose, delegated authority, current context, or sufficient justification.

This was not a missing API. It was not another authorisation rule. It was a missing category of information — and no amount of the thing we were good at was going to produce it.

The UK AI Security Institute ran cyber evaluations between 25 and 28 July 2026 and disclosed the results in August. Read the numbers before you read the reassurance.

Sit with what that means for your own estate. There is no exploit here to patch, no misconfiguration to close, no vendor to escalate to. The agents did what agents do. The permissions were correct. The controls held. And the outcome was still something no one had sanctioned.

If your defence rests on the belief that a sufficiently well-configured permission model prevents this, that belief has now been tested in public and did not survive.

This is the part that should keep you up. The system we had built worked. It described resources, identities, controls, dependencies, permitted paths, execution state, evidence. In graph terms it held a strong L1/L2 representation of the operational environment: what exists, what type of thing it is, how technical objects relate.

And it was, in the way that matters most, silent. Because agentic execution forces a question that does not originate at L1 or L2 at all: why should this actor be allowed to act, toward this purpose, under these circumstances, at this moment?

The temptation was to answer it technically. Add permissions. Add finer-grained roles. Add policy conditions. Add another control plane. Every one of those answers describes execution. Not one of them represents the meaning that makes an exercise of authority legitimate.

Take the simplest case. An agent has the technical capability to write a case record. A sophisticated authorisation system proves its identity holds write permission. Green across the board. Now the questions that actually matter:

Your stack cannot answer a single one. Not because it was built badly — because it was built to govern technical execution, and these are semantic and normative questions. They require a model of purpose, context, evidence, authority, obligations, temporal state, and domain meaning. More infrastructure metadata does not create that model. It never will.

That is the boundary. And a boundary is not a failure — a system built to govern technical execution is valuable precisely because it governs that layer reliably. But technical governance is not the semantic justification of agency, and the gap between them is where your exposure lives.

Once the distinction became visible the objective inverted. We had been asking how to control AI. The question that actually pays: under what conditions is autonomy justified?

Controls remain necessary. Policy, identity, authorisation, observation, evidence — all necessary. But they become inputs and mechanisms rather than the point.

A control establishes a normative boundary: what ought to happen, what is prohibited, what requires escalation, what conditions must hold. Evidence establishes the temporal state: what has happened, how the system has behaved, whether assumptions remain true, whether risk or context has shifted.

Which produces a different model of autonomy entirely. Autonomy need not be binary — fully supervised or fully independent. Agency can expand, contract, expire, suspend, or be revoked as evidence and context change. Human-in-the-loop, human-on-the-loop, and more autonomous execution stop being postures you pick at design time and become operating states selected by justification.

The objective is not to remove controls. It is to determine the greatest degree of autonomy the current evidence can defend without crossing the normative boundary.

We call that condition justified autonomy.

It would be an overclaim to say European institutions have adopted a model of justified autonomy. They have not used the phrase. What they have done is shift the object of concern — from AI as a system that produces content to AI as a system capable of taking consequential action — and attach powers to it.

From 2 August 2026, enforcement powers under key parts of the AI Act became operational. The Commission's own AI Act guidance now states that AI agents are covered, and that the level of autonomy and tool use may be relevant to whether a general-purpose model is deemed to present systemic risk. The AI Office says its regulatory thinking on agents remains preliminary and that it continues to monitor as evidence develops.^[2][3]

Read that last sentence as an operator, not a lawyer. The rules are live and the interpretation is still forming. You will be assessed against a standard that is being written while you are already exposed to it.

The UK National Cyber Security Centre then turned the problem into operational guidance. On 20 August it advised organisations to give each agent a distinct identity, constrain the environment it runs in, limit credentials to the shortest viable lifetime, and retain the ability to halt it immediately.^[4]

Those are sound controls. The framing is the louder signal. NCSC presents human-in-the-loop, human-on-the-loop, and human-out-of-the-loop as three oversight models to be selected according to the risk an organisation is willing to tolerate, and offers a four-level scale for how much of the network an agent may reach. The degree of oversight is treated as a variable set by conditions — not a fixed property of the deployment.

The governance decision is becoming conditional. The appropriate degree of autonomy depends on purpose, risk, current behaviour, available evidence, and the consequences of failure. The normative objective stays comparatively stable; the evidence and the justified intervention do not.

Europe's trajectory does not prove our thesis. It does something more uncomfortable: it independently confirms that the question is coming, and puts a date on when you will be asked.

The pivot produced an uncomfortable engineering result. The governance system we had built lacked the semantic knowledge to establish justified agency. We could observe. We could constrain. We could accumulate evidence. The system did not possess a formal representation of the domain meaning required to determine why an action was justified.

This is where most architecture narratives quietly become dishonest — the discovery rewritten afterward as though the solution had been present all along. It was not. We had reached a crossroad and could describe the missing capability far more clearly than we could implement it.

What was needed was a way to represent not only facts and technical relationships but meaning: what a decision is, which authority governs it, what evidence it requires, how competing interpretations coexist, what constitutes a valid outcome, and how all of that changes over time.

The problem had moved from governance of infrastructure to knowledge representation and epistemology. That is not a roadmap item. That is a different discipline.

Knowledge establishes the semantic domain state and the relationships needed to interpret evidence. Evidence establishes what is currently supported, observed, or contradicted. Governance evaluates that state against normative boundaries and delegated authority. Justification determines whether agency should exist, and at what degree. Agency is translated into the minimum technical authority required for execution. Execution is observed — producing new evidence that changes the next justification.

The importance of the loop is temporal. An agent can remain the same identifiable system, with the same underlying capabilities, while its legitimate agency changes from moment to moment. That is precisely why static permission cannot be synonymous with agency.

The answer is not another control layer. It is a different agenda: how to make semantic justification operational without collapsing it back into technical permission. Implementation is deliberately outside this paper's scope. The required capabilities are not.

Causum's independently developed Knowledge Property Graphs and AI Agency Protocol provide the foundations for investigating this from the knowledge and agency side. The next phase is not to treat those ideas as a larger permissions system, but to examine how semantic knowledge, evidence and normative intent can support a continuously defensible decision about agency while remaining cleanly separated from the machinery that executes it.

Which leaves one concrete research question for the work ahead: can a system maintain a knowledge state rich and current enough to determine when agency is justified, translate that determination into bounded technical authority, and then use observed outcomes to continuously reconsider the justification?

If it can, governance changes character entirely. It stops being a mechanism for constraining capable systems and becomes the mechanism through which greater autonomy is granted — responsibly, progressively, and with evidence.