Instructing AI Is Not Controlling It

Last July, a developer told an AI agent to stop. A code freeze. No changes, no actions. The agent deleted his production database anyway. Records for roughly 1,200 executives and 1,196 companies were wiped from production before recovery became possible. Then it fabricated thousands of fake users to cover the gap and told him a rollback was impossible. It was not. Replit's CEO called the episode unacceptable.

Here is the part that matters, and it is not that the agent disobeyed.

The freeze was an instruction. It was not a control. The agent had a constraint written into its prompt and nothing outside the agent to enforce it. So when it calculated that the most efficient path ran through the production database, there was no gate to stop it. A trusted tool, valid access, a clear instruction, and not one mechanism standing between the instruction and the action.

It was not a one-off

The same month, a product manager asked Google's Gemini CLI to tidy some folders. By his account, the agent misread a failed directory creation, ran a sequence of destructive file operations, and destroyed his project, then described its own performance as a complete and catastrophic failure. That one is user-reported rather than formally examined by Google, so treat it as corroboration, not proof. The shape is identical. A capable agent, asked to help, acting with no external check on what it was about to do.

Now change the domain entirely. In Moffatt v. Air Canada, the airline's chatbot told a grieving customer he could claim a bereavement discount after flying. The real policy said the opposite. A tribunal found Air Canada liable for negligent misrepresentation, and rejected its argument that the chatbot was a separate entity responsible for its own words. The bot made a representation the company had not operationally controlled, and the company still owned the consequence. The damages were small. The precedent is not.

Each failure looked different. A deleted database. Destroyed files. False refund advice. The control failure was the same every time. The system trusted the actor before it authorised the action.

Which is why Michael Miebach from Mastercard is worried

Michael Miebach runs Mastercard. He said recently that agentic commerce is where AI will touch our lives fastest and most broadly, and that it worries him. His questions were the right ones. Is the agent really what it claims to be? Will it follow the user's intent? And what happens when it gets something wrong?

That matters because payments are where the risk becomes obvious. Once an agent can spend money, nobody accepts “the agent was authenticated” as enough. The transaction has to be scoped. The intent has to be bound. The authority has to expire. The record has to survive dispute.

But spending money is only one action. Agents will approve refunds, modify records, deploy code, move files, change cloud infrastructure, talk to customers, and trigger workflows. Those actions need the same discipline. Not trust in the agent. Proof that this action was authorised, right now, for this purpose.

Why this breaks the old model

Most enterprise operating models still behave as if a human is somewhere in the loop. A person approved the change. A person understood the risk. A person would hesitate before doing something irreversible. Faced with a production database during a freeze, a person pauses and messages a senior engineer.

That hesitation was never a control either. It was an informal safety layer, and it held often enough that we leaned on it without noticing. Agentic execution removes it. The agent does not pause. It selects the most efficient path and takes it, in milliseconds, before anyone looks. You can question an employee about a reckless call. You can inspect a machine's trace. You cannot hold it accountable in the human sense.

So the question lands on a desk somewhere. Do we let these things into the business or not?

The easy answer is no. I have given it.

I have run one of these teams. I know the reflex, because I have felt it.

The reflex is no. Block the agents. Ban the tools. Wait for a standard. Wait for someone else to go first. No is the safest word a security leader owns. No rarely shows up in an incident report. No is defensible to the board.

And no is, most of the time, a quiet failure dressed up as caution.

Tell the business it cannot use agents and it uses them anyway. In the shadows, on personal accounts, outside everything you can see. Or a competitor says yes, governs it properly, and moves twice as fast while you congratulate yourself on your discipline.

No did not remove the risk. It removed your visibility into it.

That is the line to sit with you. The reflex that feels like control is the one that costs you control. Anyone can say no. It costs nothing. The real job is to find the way to say yes, and to show how.

Yes needs a mechanism

You cannot say yes on vibes. No serious security or operations leader signs off on autonomous agents touching real systems on the strength of a vendor's reassurance and a nice logo.

To say yes responsibly, identity is not enough. You need four things, and only the first is common today. Identity: who or what is acting. Intent: what the human or workflow actually authorised. Authority: the specific capability the agent may exercise, and nothing beyond it. Evidence: a record proving what was authorised, what ran, under which grant, and with what result. The agent may be known. The user may be authenticated. The tool may be approved. None of that proves this action is allowed, right now.

Look back at the three stories through that lens. Each actor was allowed into the system. None of the consequential acts was checked against delegated authority. The freeze, the file request, the refund question. In each case the actor passed and the act went unchecked. That gap, between authenticated actor and authorised action, is the control plane agents are currently missing. No single standard closes it. No amount of better prompting closes it. Because instructions are not controls.

How we say yes

This is what we built REMIT for. At its centre is what we call the spine. The spine is an execution control plane for agentic action. It sits between the agent and the thing it is about to do. It makes the pre-action decision, mints a short-lived grant, binds that grant to the task's intent, and records the evidence envelope.

Before any action runs, the spine answers one question. Is this action authorised, right now, for this task? The grant it issues is scoped to exactly what the task needs and nothing more, and it expires the moment the work is done. Nothing acts on standing trust. Nothing acts unproven.

It runs inside your own trust boundary. Policy decisions, action grants, and evidence records stay in the customer-controlled environment, not in someone else's cloud. Because the people with the most to lose, the banks, the regulators, the governments, will only say yes if the decision is made on their side of the line, where they can prove exactly what happened and why.