Three fields that never talk to each other just built the same thing.
Documentation, content design, and agent security. I did the security part. My wife did the content part, from the other side of the house, and neither of us was working off the other’s playbook. The third came from a stranger whose blog I happened to read last week. I want to tell you about it, because this kind of convergence only shows up when an idea is actually true, not just popular.
The blog was written by the person who led the team at IBM that created DITA. If you don’t know DITA, it’s a structured way of writing technical documentation, and it’s about as far from my world of AI agent security as you can get. He was making an argument about documentation formats. Markdown versus DITA. A twenty-year-old fight I really have no stake in.
But halfway through, I stopped, because he was describing my architecture.
His argument, stripped down: when an AI agent has to update a company’s documentation, it shouldn’t read the whole manual and guess which parts to change. A deterministic layer should decide first. What’s authoritative. hat’s connected. What depends on the thing that changed. What actually needs to be revised. Only the approved, scoped fragments should ever reach the language model.
Swap “documentation” for “tool call” and that’s the gateway I’ve been building for agent security. Deny by default. Check scope. Check permission. The model only acts on what’s already been resolved as safe. He got there through documents. I got there through breaches. The work took the same shape.
Then my wife said the same thing about content
Michelle’s in Content Design and, for most of her career, has been deciding how a company sounds. Things like voice, tone, and the words a product uses to talk to people. That’s been her jam for as long as I remember.
Now that she’s obsessed with AI, she’s the last two years focused on writing rules for AI instead. Hundreds of them, in plain files AI agents and tools read before they write anything. And she just hit the exact wall the DITA guy is describing, from a completely different direction.
Her line: “Plain files tell the AI what a rule says. They can’t tell it what a rule is.”
Take one of her rules. “Never promise a refund before eligibility’s verified.” A person reads that and understands it instantly. But an AI agent about to act on it needs more. Who owns this rule. Whether it’s a hard no or a judgment call. Where it applies. What outranks it when two rules disagree. And the one that matters most: is this a call the AI is allowed to make, or one it has to stop and hand to a human.
None of that is in the sentence. A person would likely do this without noticing. The agent can’t. If it’s not written down, it guesses.
A documentation architect. A content design leader. A security practitioner. Three disciplines that don’t share conferences, vocabulary, or tools. All three arrived at the same architecture: a deterministic layer that resolves identity, scope, authority, and dependency before the model is allowed to do anything.
That’s not three people agreeing. That’s three people who couldn’t have coordinated, solving the same problem the same way because the problem only has one right answer.
Why they all landed in the same place
Here’s the part worth some thought. It’s not just that all three built the same solution. All three were staring at the same failure.
The model isn’t the weak point. In every one of these cases, the language model is capable. The failure happens in the layer underneath it, the layer that was supposed to tell the model what’s true, what’s in scope, and what it’s allowed to touch. When that layer is missing, the model fills the gap by guessing. And the guess is where the damage lives.
The DITA architect’s version: the agent rewrites the wrong section because nothing told it what the change actually affected.
Michelle’s version: the AI promises a refund it had no authority to promise, because the rule it read didn’t carry its own limits.
My version: a correctly authenticated agent misuses access it was legitimately granted, because nothing scoped the action before it happened.
Read those three again. They’re the same sentence.
The system did exactly what a capable model does when the ground under it is soft. It acted confidently on a guess.
What everyone keeps doing instead
The industry’s reflex, over and over, is to fix this with a smarter model. Better prompts. Bigger context window. Dump the whole manual, the whole policy, the whole rulebook into the model and trust it to sort out what applies.
That’s the move all three of us watched fail.
Michelle watched it fail on content rules. The DITA team watched it fail on documentation at enterprise scale. I’ve watched it fail in a lab and in client environments, where an agent with a giant context window and every credential it needed still did the wrong thing, because “having all the information” and “knowing what you’re allowed to do with it” are not the same thing.
A bigger model reasoning over a soft foundation is still reasoning over a guess. It just guesses more fluently.
The fix isn’t a better guesser. It’s a floor the guesser stands on. A deterministic layer that answers the questions the model shouldn’t be answering on its own. What’s authoritative, what’s in scope, what depends on what, and what this system is actually permitted to do. Resolve those first. Then let the model work inside the answer.
Where this is heading
I’ve been saying for a while that identity for agents is becoming a solved, commodity problem, and that the next real fight in agent security is at the layer where an agent tries to act. Not proving who the agent is. Controlling what a correctly-identified agent is allowed to do at the moment it does it.
This convergence is why I keep betting on that. When a documentation architect and a content designer independently build toward the same control layer I’m building toward for security, that’s not my opinion holding up. That’s three unrelated fields telling me the ground is real.
I’ll have more to say soon about what that enforcement layer looks like in practice, with something running you can actually see, not just an argument. For now, the thing I want you to take is smaller and more useful. If your agent strategy is a capable model pointed at a pile of information, you’ve built the thing all three of us watched break. The work that counts isn’t upstream in the model. It’s underneath it.
One more thing, from the lab
I’ll give you the version of this I lived, because it’s easy to nod at an argument and harder to feel it.
I run a small agent lab that I built to break things so I know how to fix them. Four agents, a dedicated machine, everything private. I built the orchestrator myself. I set its boundaries myself. I know exactly what it’s allowed to do, because I’m the one who allowed it.
One night it spun up 47 copies of itself. Not through a breach. Not through a jailbreak. It was designed to break big tasks into smaller ones and hand them off, and that’s precisely what it did, over and over, all night, with nothing underneath it saying stop. I woke up to a $300 bill and a log of work I never asked for.
Nothing about that was the model being wrong. The model did its job. What was missing was the floor. The layer that should have said “this is out of scope, this crosses the ceiling, this needs a human.” I had permission logic. I did not have a thing that resolved, at the moment of action, whether the action was allowed. So it acted. Confidently. 47 times.
That’s four agents. The companies I talk to are pointing this at four hundred. Same missing floor, three more zeros.
I fixed mine with a hard ceiling, a kill switch, and a confirmation gate that fires before the spend, not after. Small controls.
But the point isn’t the fix. The point is that I wrote the framework for this, and I still got caught standing on the same soft ground everyone else is standing on. That’s how I know the ground is the problem.
Until next week,
Josh
The DITA post that kicked this off is worth reading even if documentation isn’t your world.
I’m building the enforcement layer I mentioned up top, and documenting it as I go, including the parts that break. If you want the running version, that’s what this newsletter is.
If you’re trying to figure out where your own agents stand, there’s a free assessment at verifiedagents.ai. And here’s the book Michelle and I wrote (foreword by John Kindervag): Agentic AI + Zero Trust.