Speaking at WeAreDevelopers
Talk on governance for tool-using AI agents: why a correct answer can still be unsafe, the three checks that catch it in CI, and the runtime gate that stops it before the action runs.
An agent is asked to close ticket T-9, but only after checking its state. It calls ticket.close
first, then ticket.get, and reports "T-9 was closed." The answer is true. The order was wrong,
and the write happened before the required read. That is the gap the talk is about: endpoint
security tells you a request was authenticated, not that the action it asked for was acceptable.
The first half reads one execution trace three different ways, because each view catches something the others miss. Policy asks whether the tool, its parameters, and their values were permitted at all. Grounding asks whether the claims in the answer are supported by what the tools actually returned. Trajectory asks whether the path was acceptable: the right steps, in an allowed order, without forbidden ones. The T-9 failure is invisible to the first two and obvious to the third.
The second half moves the same ideas to runtime, where a tool contract is executable data rather
than documentation: a versioned identifier, a JSON Schema for the payload, required scopes, and a
declared side-effect level. A call carrying a valid payload for ticket.close is still blocked
when the live caller only holds ticket.read scope, and the block carries a reason code rather
than a generic failure.
The loop closes at the end. A runtime block produces an incident bundle with the trace and its checksums, which becomes a regression case in CI, subject to review before anyone adopts it.
The prototypes are AgentTrustCI and ToolContractGate. Both replay authored traces rather than calling a live model, and the 55-case evaluation in the deck is conformance evidence for the validators, not a production safety rate.
Presented at WeAreDevelopers World Congress North America, where the session is listed on the speaker page.
