Tyler Akidau, CTO, Redpanda.getty​In March 2026, according to an article from The Verge, a Meta engineer asked an internal AI agent to analyze a technical question that another engineer had posted on a company forum.The agent generated a response and posted it without a confirmation step. The advice was wrong. The engineer who had asked the question followed it, triggering a permission change that exposed company data for two hours, though a Meta spokesperson denied earlier reports that user data was mishandled. Meta classified it as a Sev 1, its second-highest severity tier.​The agent never authenticated into any sensitive system. It was posted to a forum, and a human did the rest.​​This is what makes the incident worth studying. The security stack had nothing to evaluate. Every credential check was legitimate. The damage came from a human acting on the agent's output. Security researchers call this the "confused deputy" problem—a trusted program with elevated privileges getting tricked into misusing its own authority. Norm Hardy described the pattern in 1988.To apply this concept to agentic AI: An agent can misuse its authority because a prompt injection redirected it, because an ambiguous instruction was interpreted too liberally or because its own reasoning produced an action no one anticipated. In every case, the agent's individual actions look authorized.The failure is that nothing in the infrastructure can evaluate whether those authorized actions add up to something the organization actually wanted.The Determinism ProblemTraditional software is deterministic. An engineer writes instructions, and the software follows them. When the code says "don't do X," it does not do X. Bugs happen, but the model is predictable and auditable.​Agents break that contract. You can tell an agent "don't do X," and it might reinterpret the instruction, ignore it entirely or fall victim to a prompt injection that overrides it. That is the core value of agents: They reason, adapt and act on ambiguous inputs.It is also the core risk, and traditional controls can fall short here. An identity and management (IAM) stack can check whether an agent is authorized to call an API, but not whether the agent should be calling that API right now, on behalf of this user or for this purpose.A prompt injection can redirect an agent mid-task without changing any of its credentials. An ambiguous instruction can produce an action the operator never anticipated.​Moving Decisions Out Of BandTo address this, companies need new architectural patterns.Instead of trying to make agents more reliable through better prompts or tighter instructions, organizations should identify the decisions that can cause problems and make those decisions via a deterministic infrastructure that the agent cannot touch.​​The Meta incident is a useful illustration. The agent was invoked to help analyze a question; it posted a response to the forum without waiting for the engineer who invoked it to confirm.That confirmation step should not have been the agent's responsibility to enforce. It should have lived entirely outside the agent, in the workflow infrastructure that determines what an agent's output is allowed to do before a human sees it. Consequential distribution decisions are exactly the kind of thing that belong in a deterministic policy layer that the agent does not control.​The same principle applies when agents directly touch sensitive data. Consider an agent that processes portfolio data. It needs access to the client's data, but should not choose which client's data it accesses. The infrastructure injects the client identifier when the agent requests data. The agent cannot change Client X to Client Y because it does not control that parameter.​Policy enforcement works the same way. If the system requires human approval for trades over a threshold, that rule lives in a deterministic policy engine that the agent never sees. The agent submits proposals. The engine routes anything over the threshold to human approval and executes the rest. The agent does not know the policy exists, which means it cannot circumvent it.​Transcripts As The Governance Foundation​While out-of-band controls govern what the agent is allowed to do, regulations such as the EU AI Act and ISO/IEC 42001 are also converging on a requirement to provide a complete accounting of what an AI system did.​Companies should also maintain a complete record, such as with a transcript, of every action, tool call and data access. This is the foundation for every governance function that follows: debugging failed agent runs, detecting anomalies across a fleet of agents over time and evaluating agent performance.​​The same evaluations companies run on employees—did they deliver, are they working well with others, are they maintaining quality—apply to agents, except they can run continuously and autonomously. All of them depend on transcripts as the evidentiary base.​​Maintaining transcripts at this depth is not free. Capturing every prompt, tool call and data retrieval across a fleet of agents produces large volumes of data, which raises real storage and retention costs over time (though those costs are generally negligible compared to LLM costs). Those same records concentrate sensitive information, including the data the agent touched, so the transcript store itself becomes a high-value target that needs its own access controls and encryption. And raw logs only become useful when they are structured and searchable, which takes deliberate instrumentation rather than a setting you switch on.​Why Capable Is Not The Same As Trustworthy​The Meta incident was an infrastructure failure, not a model failure. There was no confirmation step before the agent posted, no out-of-band controls on what its output could trigger downstream.​Organizations should start here: Inventory every agent. Replace static API keys with scoped ephemeral tokens. Architect's critical decisions outside the agent's reach. Record every action in an immutable transcript.​Agents will never be perfect, they will never behave like deterministic software and they will always have failure modes distinct from those of humans. The infrastructure around them has to account for all of it.​​Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?