Assurance that rests on "our monitoring is very good" is a promise. Provable trust rests on a proof and a receipt. Writing on what that distinction means in practice — sector by sector, and control by control.
NVIDIA OpenShell decides what a sandboxed agent may reach, one request at a time; rules like never sending data out after reading a secret and untrusted input need memory of the session. polyaxion-openshell puts polyaxion in OpenShell's supervisor middleware: an untrusted page, then an internal API read, then a send to an outside host, and the last request gets a 403 with reason code polyaxion_trifecta before OpenShell attaches any credentials.
At METR a stranger asked an agent for its provider API key and got it; the key ran up $600,000 in three weeks. No single step was forbidden: the violation was the sequence. Inventory and authentication decide who reaches an agent; polyaxion decides what it may do once someone does. With it in the loop, 0 forbidden effects in 120 sessions across four models; without it, 23 credential leaks.
Epoch AI measured how fast the price of an answer falls. We measured what it costs to know the answer is right. On etcd Raft, a verified specification costs 3.4 to 10 times an unverified one, the machine checker missed 17 of 35 planted bugs, and model reviewers accepted none of 151 specifications.
Claude Code now counts the rules a folder pre-approves — 278 in this repo — and drafts a trust boundary from evidence rather than a questionnaire. Both are the right instinct, and both stop one step short of the question those labels make askable: can the permitted operations, in some order, carry untrusted input out with no gate in between?
It comes with real spending controls — a budget, a per-payment limit, an approved-merchant list. Good controls. They also answer a narrower question than they look like they do: a $10 cap under a $500 budget authorizes fifty transactions, and money has no undo button.
An agent can take a sequence of authorized actions, and the sequence as a whole causes harm. Hugging Face and GitLost show the failure is architectural, not operational — and none of the four control layers answers the question it poses.
Banking's intelligent operating model rests on governance and trust. Neither can stay a promise once agents can act — a per-action check never holds a fact about the set of actions, and the exposure lives in the gaps between the checks.