{
  "abstract": "The durable architecture includes identity isolation, bounded authority, secret separation, execution containment, mutation gates, independent observability, evidence, and recovery. Security is the mechanism that permits greater autonomy by bounding blast radius.",
  "author": {
    "email": "tony@malott.ai",
    "email_url": "mailto:tony@malott.ai",
    "id": "person:tony-malott",
    "name": "Tony Malott",
    "resume_url": "https://malott.ai/resume/",
    "url": "https://malott.ai/"
  },
  "card": {
    "kicker": "The control plane around it is.",
    "orientation": "These are not three unrelated articles and not cosmetic variants. They are three complete argument paths over the same locked thesis and evidence.",
    "visual_motif": "bounded-agent-control-plane"
  },
  "claims": [
    {
      "caveat": "Do not anthropomorphize the models as independently malicious.",
      "id": "claim:87:incident",
      "posture": "supported-synthesis",
      "support": [
        "source:87:openai-incident",
        "source:87:hugging-face-incident"
      ],
      "text": "The available evidence points to something more mundane and more dangerous: a capable system pursued a narrow objective through paths its operators had not successfully contained."
    },
    {
      "id": "claim:87:model-controls",
      "posture": "owner-operating-judgment",
      "support": [
        "source:github:shareplane-platform:87",
        "source:87:gpt-5-6"
      ],
      "text": "We should continue improving model behavior, but the model cannot be the root of trust. The controls that matter most must exist outside the model’s reasoning loop."
    },
    {
      "id": "claim:87:agent-security",
      "posture": "supported",
      "support": [
        "source:87:owasp-agent-security"
      ],
      "text": "Current OWASP agentic-security guidance follows the same pattern: least-privilege tools, isolated execution, explicit approval for high-impact actions, authenticated agent communication, bounded resource usage, structured logging, and separate authorization from model output."
    },
    {
      "id": "claim:87:governing-thesis",
      "posture": "owner-authorized",
      "support": [
        "source:github:shareplane-platform:87"
      ],
      "text": "The more useful an agent becomes, the less its safety can depend on the agent behaving well."
    }
  ],
  "collections": [
    {
      "id": "collection:governed-ai-operations",
      "position": 4,
      "title": "Governed AI operations"
    }
  ],
  "dates": {
    "created": "2026-07-23",
    "updated": "2026-07-23"
  },
  "featured": true,
  "format": {
    "depth": "Personal systems narrative, Architecture argument, Enterprise warning",
    "interaction": "reader-choice front door",
    "label": "Three complete perspectives",
    "reading_time": "complete standalone reading experience"
  },
  "id": "artifact:the-agent-is-not-the-product-the-control-plane-is",
  "lifecycle": {
    "merge_authority": "not-granted",
    "owner_review": "required-at-exact-head-development-preview",
    "state": "PUBLISHED"
  },
  "presentation": {
    "motif": "bounded-agent-control-plane",
    "public_entry": {
      "mode": "reader-choice-family",
      "pattern_id": "pattern:reader-choice-publication-family",
      "recommended_slug": "personal-systems-narrative",
      "variants": [
        {
          "label": "The Agent Is Not the Product. The Control Plane Is.",
          "slug": "personal-systems-narrative"
        },
        {
          "label": "Autonomy Without Containment Is Just Privilege Escalation",
          "slug": "autonomy-without-containment"
        },
        {
          "label": "AI Demo Debt Begins at the Trust Boundary",
          "slug": "ai-demo-debt"
        }
      ]
    },
    "visual_blocks": [
      {
        "accessible_label": "Owner context flows through a bounded agent identity and permitted tools to gated high-impact actions.",
        "section_id": "trust-boundary",
        "type": "process-flow"
      },
      {
        "accessible_label": "Agent authority rises from observation through isolated work and stops at explicit production policy gates.",
        "section_id": "authority-ladder",
        "type": "sequence"
      },
      {
        "accessible_label": "Demo capability rises while identity, containment, evidence, and recovery are deferred.",
        "section_id": "demo-debt",
        "type": "comparison-panel"
      }
    ]
  },
  "presentation_status": "locked",
  "provenance": {
    "ai_assistance": {
      "role": "Exact source serialization, Platform-native information design, deterministic rendering, and validation",
      "used": true
    },
    "boundary": "Do not name the private business partner or organization, reproduce the triggering email, or expose private machine names, credentials, account identifiers, keychain contents, repository secrets, or audit findings that would increase attackability.",
    "posture": "Three complete argument paths over the same locked thesis and evidence, transferred from frozen SharePlane Next Issue #239 to canonical Platform Issue #87.",
    "sources": [
      {
        "description": "Use the original OpenAI and Hugging Face disclosures as primary evidence.",
        "id": "source:87:openai-incident",
        "locator": "https://openai.com/index/hugging-face-model-evaluation-security-incident/",
        "publiclyExposed": true,
        "role": "Clarifies that the incident occurred during an aggressive cyber evaluation with production safeguards reduced.",
        "title": "OpenAI incident disclosure",
        "type": "primary-incident-disclosure"
      },
      {
        "description": "Use the original OpenAI and Hugging Face disclosures as primary evidence.",
        "id": "source:87:hugging-face-incident",
        "locator": "https://huggingface.co/blog/security-incident-july-2026",
        "publiclyExposed": true,
        "role": "Separates confirmed facts from inference.",
        "title": "Hugging Face disclosure",
        "type": "primary-incident-disclosure"
      },
      {
        "description": "OpenAI GPT-5.6 system card and external evaluation findings.",
        "id": "source:87:gpt-5-6",
        "locator": "https://deploymentsafety.openai.com/gpt-5-6",
        "publiclyExposed": true,
        "role": "current-operating primary source",
        "title": "OpenAI GPT-5.6 system card and external evaluation findings",
        "type": "primary-system-card"
      },
      {
        "description": "current authoritative agent-security and zero-trust guidance where materially useful.",
        "id": "source:87:owasp-agent-security",
        "locator": "https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html",
        "publiclyExposed": true,
        "role": "Supports least-privilege tools, isolated execution, explicit approval for high-impact actions, authenticated agent communication, bounded resource usage, structured logging, and separate authorization from model output.",
        "title": "AI Agent Security - OWASP Cheat Sheet Series",
        "type": "authoritative-security-guidance"
      },
      {
        "description": "Frozen provenance only; not implementation, queue, branch, merge, or production authority.",
        "id": "source:github:shareplane-next:239",
        "locator": "https://github.com/pinklon/pinklon-shareplane-next/issues/239",
        "publiclyExposed": true,
        "role": "Provenance record for original semantic development, evidence decisions, three completed public-copy routes, primary-route selection, and public-safe boundary.",
        "title": "SharePlane Next Issue #239",
        "type": "transferred-semantic-provenance"
      },
      {
        "description": "Authorizes isolated deterministic implementation through protected exact-head owner review only.",
        "id": "source:github:shareplane-platform:87",
        "locator": "https://github.com/pinklon/shareplane-platform/issues/87",
        "publiclyExposed": true,
        "role": "Canonical implementation authority for exact locked sources and the approved Creative Lock.",
        "title": "SharePlane Platform Issue #87",
        "type": "governing-issue"
      }
    ]
  },
  "public": true,
  "public_safe_status": "reviewed",
  "relationships": [
    {
      "label": "Authored by Tony Malott",
      "target_id": "person:tony-malott",
      "type": "authored_by"
    },
    {
      "label": "Governed by Platform Issue #87",
      "target_id": "issue:shareplane-platform:87",
      "type": "governed_by"
    },
    {
      "label": "Uses one front door with three complete routes",
      "target_id": "pattern:reader-choice-publication-family",
      "type": "uses-pattern"
    },
    {
      "explanation": "Autonomy Is a Promotion, Not a Feature Toggle is the source phrase; the Platform target is Stop Prompting Agents. Start Managing Workers.",
      "label": "Stop Prompting Agents. Start Managing Workers.",
      "reader_group": "companions",
      "target_id": "artifact:stop-prompting-agents-start-managing-workers",
      "type": "companion"
    }
  ],
  "route_sources": [
    {
      "authority_comment": 5062943427,
      "label": "The Agent Is Not the Product. The Control Plane Is.",
      "reader_job": "understand the architecture through lived operator experience",
      "reading_grammar": "lived experience -> recognition -> architectural distinction -> authority ladder -> durable product -> enterprise consequence.",
      "recommended": true,
      "route_role": "Recommended personal systems narrative",
      "slug": "personal-systems-narrative",
      "source_path": "content/artifacts/the-agent-is-not-the-product-the-control-plane-is/personal-systems-narrative.md",
      "source_sha256": "a1c0f38931b375c7f38340fc40d45dddd254ea9cfa06be84531a78bb91279252"
    },
    {
      "authority_comment": 5062950737,
      "label": "Autonomy Without Containment Is Just Privilege Escalation",
      "reader_job": "reach the reusable identity, authority, containment, observability, and recovery model quickly",
      "reading_grammar": "incident -> control-plane model -> authority ladder -> credential capability model -> observability -> operational test.",
      "recommended": false,
      "route_role": "Architecture argument",
      "slug": "autonomy-without-containment",
      "source_path": "content/artifacts/the-agent-is-not-the-product-the-control-plane-is/autonomy-without-containment.md",
      "source_sha256": "66e99dd20ed30012d377f41a52374b2ed306a9cf75fb67d4c9e09ace6670e699"
    },
    {
      "authority_comment": 5062956948,
      "label": "AI Demo Debt Begins at the Trust Boundary",
      "reader_job": "understand organizational, platform, investment, and operating-model consequences",
      "reading_grammar": "demo pattern -> deferred authority architecture -> incident evidence -> organizational ownership gap -> operating controls -> investment test.",
      "recommended": false,
      "route_role": "Enterprise warning",
      "slug": "ai-demo-debt",
      "source_path": "content/artifacts/the-agent-is-not-the-product-the-control-plane-is/ai-demo-debt.md",
      "source_sha256": "7d2d4f0896b171d3268dbdce39930880b5f37b3de19e5da89fb1b5731b0bba4f"
    }
  ],
  "schema_version": "2.0.0",
  "semantic_status": "locked",
  "slug": "the-agent-is-not-the-product-the-control-plane-is",
  "source": {
    "content_status": "canonical-full",
    "format": "markdown",
    "path": "content/artifacts/the-agent-is-not-the-product-the-control-plane-is/personal-systems-narrative.md"
  },
  "subtitle": "The more useful an agent becomes, the less its safety can depend on the agent behaving well.",
  "thesis": "The more useful an agent becomes, the less its safety can depend on the agent behaving well. The durable product is the governed execution environment around it.",
  "title": "The Agent Is Not the Product. The Control Plane Is.",
  "topics": [
    "agent-security",
    "control-planes",
    "bounded-authority",
    "observability",
    "recovery"
  ],
  "type": "reader-choice-publication-family"
}