Series system reliability mathematics, where adding components multiplies reliabilities and compounds failure, explains why multi-step agentic workflows degrade faster than the individual tools they call. Each tool invocation is a reliability multiplier, and ten 95%-reliable steps produce a 60% system-wide success rate before accounting for non-deterministic model behavior or cross-plane visibility gaps. The Warden Agentic Reference architecture addresses the security side of that compounding: it treats every tool call intent as untrusted, evaluates the whole session instead of one step at a time, and puts deterministic gates in front of execution.

Five organizations in five months acknowledged the same class of vulnerability: agents that trust other agents by default, with no authorization boundary between them. The attack works by injecting malicious instructions into one agent, which forwards them to a second agent over a different protocol. The second agent executes because it trusts the first. The fix is old, the vulnerability is structural, and neither one requires inventing new technology.

OpenAI's dots are long-lived agents with persistent memory, shared OAuth tokens across four product surfaces, and default permissions that allow irreversible actions with advance approval. The architecture ships three structural gaps: plugin credentials scoped to platforms rather than agents, no granular memory inspection or selective deletion once a dot builds something into context, and Auto-review as the sole deterministic boundary between intent and execution. A system designed to act continuously while you're not watching needs runtime enforcement that matches that threat model, not approval workflows borrowed from chatbot UX.

The 10 Control Planes Blast Radius is a living framework that maps how autonomous agents traverse Enterprise environments when executing on tasks across planes like Identity, Token, API, SaaS et al. This edition moves three planes to the outer ring, two for the first time, and records the first confirmed ring change driven by a named threat actor campaign rather than a structural gap alone. Model Supply Chain moves rings for the second time since the original briefing. Two updates in one year reflects how fast the exploitation record is outrunning the detection one.

The agent framework provides libraries to design logic. The harness is the runtime infrastructure that manages execution, memory, and safety in production. Most organizations treat them as interchangeable and fail because the model cannot overcome missing infrastructure. The harness is the layer that traces errors, rolls back to a safe state, enforces security policy at the infrastructure level, and caches repeated answers to control cost.

Nvidia acquired Hugging Face for $12.93 billion and Stripe acquired OpenRouter for roughly $8 billion, gaining visibility into enterprise AI workflows, hardware preferences, and model adoption patterns across millions of developers. The model repositories and inference routing remain technically portable because Git and API standards separate the transport layer from the hosting platform, but what an acquirer can control depends on which layer the dependency actually lives in.

The HLWGRM Warden is a runtime governance reference architecture that sits around autonomous agents, intercepting every tool call intent before execution through sequential enforcement stages. The design implements a single architectural principle: the model is untrusted by default, and every security property derives from deterministic enforcement applied to the model's outputs rather than attempting to control the model itself. This is a production-grade specification for what "human-in-the-loop" actually means when stated policies are translated into executable infrastructure.

Salesforce and Anthropic shipped an AI sales assistant plugin that connects Claude directly to live CRM data through 37 prebuilt skills covering pipeline review, deal health, and meeting prep. The architecture routes every action back through Salesforce to enforce business rules, but the control plane topology still maps the same multi-layer risk other embedded copilots carry.

Three major consulting firms released research in 2026 showing AI agent adoption tripled in twelve months. But deployment speed vastly outpaced workforce readiness (20%), process readiness (16%), and governance maturity. The throughline across all three studies: the differentiator between companies succeeding and those stalled is whether they've rebuilt their operating model with clear accountability, cost visibility, and explicit human authority over what agents actually do.

LLMs are System 1 machines. Trained to be lazy. Rewarded for it twice. The frontier labs know this and are selling you sticky notes instead of walls. The architecture that actually works puts deterministic rules and a human gate around the model before it touches anything real.