An architecture that can learn from disagreement, and an architecture built to constrain it
What to do Monday morning: find the place in your architecture where the world is allowed to disagree with the model.
The rest of this is why that is the whole job.
On 29 January 2025 I put a question to a LinkedIn discussion on agentic AI, alongside a video of the case it came from:
Tell me how Agentic AI would have known to ask, “What time of day do orders come in?”
One answer came back. It was generated by an AI tool and passed along in good faith by a participant who then offered to build it into a proper research framework — a generous, constructive contribution, and I want to be clear that what follows is about the answer, not the person who relayed it.
The answer said a well-designed agentic AI would recognize the order timing patterns autonomously, identify the missing variable of time-based order clustering as crucial, and generate the inquiry before a human analyst considered it.
Read that middle clause again.
You can only call time-of-day the missing variable once somebody has told you which variable was missing. Knowing the answer is four o’clock, order timestamps look obviously worth examining. Before you know it, they are one field among hundreds, and nothing in the data marks them as more interesting than delivery distance, part number, or requisition value. The answer reasons backward from a solution it already had.
That is not a capability. It is hindsight wearing the costume of one.
I asked one follow-up, and it is the question I have been circling ever since:
How does agentic AI address the seemingly disparate strands of data in which unidentified related attributes collectively impact the desired outcome?
Unidentified carries the whole thing. You cannot pattern-match on a relationship you have not nominated as a candidate — and nothing nominates this one, because on every org chart, every process map and every dataset in that operation, service technician incentives and parts delivery performance are unrelated.
Eighteen months later, this is my answer to my own question. It is not a claim about what AI cannot do. It is a claim about an architectural property — one that a system built in 1998 had, that most agent deployments do not, and that determines whether a question like that one can enter the system at all.
One clarification before anything else, because the word guardrail now covers a great deal of ground — input filters, output validators, policy engines, runtime monitors, evaluator agents, escalation paths. This is not an argument against all of that. The target here is narrower and specific: a compliance-oriented guardrail, meaning one whose target state is zero violations. Where that describes the architecture, everything below follows. Where it does not, it does not.
Start with what the 1998 system actually did.
What “self-learning” meant in 1998
A defense maintenance operation was delivering parts on time 51 percent of the time against a 90 percent requirement.
The algorithms took historic supplier performance and reconciled it against real-time buying conditions, then ranked the available suppliers for each requirement. Twenty or thirty of them in some categories, re-ranked requirement by requirement as conditions moved. A buyer worked from the top five or ten. The ranking was presumed correct, and it usually was — delivery performance went from 51 percent to 97.3 percent.
Three things sat around that ranking. None of them is performed by a guardrail merely because a guardrail exists — each requires a traceable learning loop with an independent source of present-condition evidence, which is the distinction this whole piece turns on.
First, the buyer set the objective. If price was primary, the list ranked on price. If delivery was primary, the same list re-ranked to put greater weight on past delivery performance over lower cost. That is not the buyer disagreeing with the system. It is the buyer supplying the one thing the algorithms could not know — what this particular requirement was actually for — and the system doing exactly what it was built to do with it.
Second, the buyer could disqualify a supplier on information the system did not have. A weather event. A port strike. A regional disruption that had not reached any data feed and would not for days. The supplier that wins on both price and delivery history is the wrong answer when its freight cannot move, and no amount of historic accuracy fixes that. The buyer was not overruling the ranking’s logic. The buyer was supplying a fact the ranking had been computed without.
And this only counted for anything because of the third thing: the exception had to be transparent and traceable. Recorded, attributable, reviewable. Without that, an exception is indistinguishable from a buyer quietly favoring a supplier, and the whole mechanism becomes a loophole instead of a control. Real-time exception management works only when the exceptions leave a record.
There is a precondition underneath all three, and it is easy to miss. The baseline ranking had to be right. An exception is only evidence if the thing it departs from is defensible. Where the underlying model is weak, a person going against it tells you nothing — it is preference, not information, and no amount of traceability converts one into the other. The statistical ranking is what made disagreement worth recording in the first place.
That cuts both ways. A guardrail derived from a shaky model of the operation produces violations that carry no signal either. The problem is not only that a compliance-oriented guardrail discards its exceptions. It is that in many deployments there is nothing underneath them worth keeping.
So where was the learning?
In the outcome. Every requirement either closed or it did not, and that result went back into the supplier’s historic record, which the next ranking computed against. Continuously, automatically, with nobody adjudicating what counted.
And the outcome was never just the arrival date. If the part shipped on time but arrived dead on arrival, or was the wrong part, that failed — because a part that does not close the service call has not done the job it was ordered to do. Quality and correctness landed in the same historic record as delivery, governing the same ranking. A supplier who shipped fast and shipped wrong lost standing on precisely the instrument that rewarded the one who shipped right. No separate quality program. No quarterly vendor scorecard. The same loop.
Delivery performance reached 97.3 percent in three months, measured against calls that actually closed. No new platform was installed to produce that. The technology selection came afterward, which is why no vendor can be credited with the result.
A note on the term. In 1998 the language was advanced algorithms, researched under SR&ED funding and running on the hardware of the period. Self-learning is how I describe the same mechanism now. What matters is not the label. It is the shape of the loop.
A note on the source. The result is documented in the contemporaneous record and has been published repeatedly since 2007. The architecture above — the objective setting, the traceable exception, the outcome measure — is described here from my own record of the engagement. The original filing prepared by counsel at the time is the document that would settle it, and it is not yet in front of me.
1. The exception is recorded, not suppressed
An exception in 1998 was a fact entering the record. It named a supplier, a reason, and a buyer, and it sat alongside the ranking it displaced — so the file showed both what the system computed and what reality did to it.
A compliance-oriented guardrail runs the other way. It draws a boundary and measures its own success by the absence of crossings. Zero violations is the target state, and a violation is a thing to be closed.
One architecture treats the exception as information. The other treats it as a defect in its own operation.
That is not a difference of degree. It is a difference in what the system treats as evidence.
2. One is measured against the world, the other against the rule
The 1998 loop was closed by an outcome — did the call close — arriving on a short enough cycle to act on. Not the shipment date. Not a conformance report. The completed job.
A compliance-oriented guardrail is evaluated against the rule it encodes. Not against what happened downstream.
That gap is the whole problem. Such a guardrail set can be one hundred percent satisfied while the operation degrades underneath it, and nothing in the instrument will report it. Rule conformance and operational truth are two different measurements, and only one of them was driving the result in 1998.
3. Whoever disagrees has to know something the system does not
This is the load-bearing difference, and it is the one usually missed.
The buyer’s exception carried information because the buyer stood in a condition the system could not see. Present, physical, unencoded, and often hours or days ahead of any data feed. A port closed. A plant down. Freight that cannot move regardless of what the historic record says about that supplier.
Now the conditional that matters. Where a guardrail is derived from the same model of the operation the agent reasons from — same data, same definitions, same assumptions about how the work gets done — it is not necessarily an independent check on the agent. It may simply reproduce the same assumptions at another layer.
Where that holds, it is the agent’s own reasoning wearing a supervisory label, and it agrees by construction.
I am not claiming a percentage. I am claiming that when the condition is true the consequence follows, and that the condition is worth checking before anyone treats the governance layer as independent. Add a layer that reasons from the same inputs as the thing it governs and you have not added a check. You have added a second copy of the first layer and given it a different name.
This is also where the clean-data argument runs out. If the agent and the guardrail read from the same source, cleaning it improves both equally and the gap between them stays exactly zero. Independence is a sourcing property, not a quality property. Clean data cannot manufacture a second opinion. It can only make two dependent layers agree more precisely — and a more precise agreement between two copies of the same assumption is not corroboration.
Worse, it is quietly self-reinforcing. Every quality test is conducted against the model: no duplicates, no nulls, consistent definitions, reconciled sources. All of it measures whether the values match what the schema says they should be. None of it can tell you whether the schema carves the operation at its joints. So the cleaner the data becomes, the more internally consistent and therefore more authoritative an unvalidated representation looks, and the less anyone thinks to question it.
At that defense operation the order timestamps were already there, years before RAM 1998 arrived. Every release carried a time. The data was not dirty — it was clean, complete and correct, and it sat that way for years, because nothing in a clean dataset nominates one field as more interesting than any other. Cleanliness does not generate hypotheses.
The check is a single question: what does the oversight layer know that the agent does not? If the answer is nothing, there is no oversight — only agreement.
4. Watching for divergence is not the same job as deciding
The senior manager in 1998 approved nothing. He watched the pattern of exceptions.
That function only works because the exception was both permitted and traceable. One disqualification is a fact about a port. A run of them in the same region, month after month, is a fact about the model — the encoded conditions have stopped matching the real ones, and something upstream needs re-tracing. The buyers were not gaming anything. They were responding to conditions in front of them, which is exactly what made the record worth reading.
Where the architecture is compliance-oriented, a violation is routed to suppression. The exception gets closed. Nobody asks what the run of them was telling them. The signal is generated, and then consumed by the process designed to make it go away.
5. The flatline: when the failure looks exactly like success
Here is the part that should concern anyone deploying agents at scale.
A well-tuned guardrail set produces zero violations. So does a system where the mechanism capable of disagreeing has been removed, or has quietly stopped functioning.
In a snapshot, those two conditions are indistinguishable. Both report zero. Both look like the program is working. The reporting has never looked better.
I call this Objective Flatlining™ — the condition in which the disagreement channel stops producing variance, not because alignment has been achieved, but because the mechanism capable of disagreeing has been removed or absorbed. The system appears at its most stable at precisely the point it has stopped improving.
It applies to objectives as readily as to channels. A program that stops being measured against its original commitment flatlines the same way: nothing to reconcile, nothing to explain, no variance in the record.
It is a particularly dangerous failure mode because it can announce itself by producing nothing. An overrun exhausts a budget. An error gives a wrong answer. A missed deadline is a date on a calendar. This one generates no incidents, no exceptions, and no escalations — which is why it survives review after review.
So how do you tell the two apart?
Not by the incident count. Zero is the reading both conditions produce.
One diagnostic is the variance rate over time. Genuine alignment tends to produce a low but noisy rate — occasional exceptions, irregular, tracking real conditions, because reality keeps producing edge cases.
Which gives the question, rather than the answer:
A variance rate that trends toward zero and stays there should trigger a second question: has genuine alignment increased, or has the system lost its capacity to detect meaningful disagreement?
Sometimes the honest answer is the first one. A tightly bounded, genuinely deterministic process can run at zero exceptions because zero is correct. An environment can stabilize. Those are real, and a flat line in either case is nothing to worry about.
But be careful about the explanations that sound like alternatives and are not. If the flat line arrived because detection sensitivity was retuned, or because exception categories were reclassified, or because the reporting changed — those are not competing explanations. They are how the capacity to disagree gets removed. Each one narrows what the channel is able to register, and a channel that can no longer register disagreement will report zero forever.
None of this is new, and none of it requires AI. In 2005 a major US retailer engaged me to assess a procurement strategy that was not delivering the value they expected. They had consolidated their supplier base under a leveraged-spend initiative. Suppliers had cut price hard to win one of the chosen slots, the terms were locked in contract, and the savings reporting was clean — negotiated against the pre-consolidation baseline, no exceptions, nothing to reconcile.
They were paying 21 percent above market.
Not because anyone overcharged them. On signing day those discounts were real. But the commodities in question were what I identified in the late nineties as Dynamic Flux — a characteristic of steady, sometimes rapid decline in price over time, typical of indirect materials and MRO. The contract froze a number that was correct at the moment it was struck. The market kept moving. The number did not.
The 21 percent was not a premium. It was the distance the market traveled while the contract stood still.
And the suppliers who understood the characteristic said nothing, which was not misconduct. Their obligation was the negotiated price, not the real-time market price. Honoring the agreement and staying silent were the same act. One party away from the organization absorbing the cost, doing exactly what they had agreed to do — the same shape as technicians batching orders at four o’clock because that was how they were measured.
Nothing in that arrangement could report a problem, because nothing in it was malfunctioning. The contract performed as written. The savings report measured against the baseline it was built to measure against. The mechanism that could have registered the gap — a live comparison against the market — had been contracted away as a deliberate feature of the program.
Which is the general form, and it is worth stating on its own: once a process or an operating model is treated as final, erosion begins. Not because anyone stops caring. Because finality removes the channel through which movement would be noticed.
That is the whole failure mode, twenty years before anyone dispatched an agent — and it is exactly what a compliance-oriented guardrail is. An encoded rule, fixed at a point in time, correct when written, reporting conformance against a frozen reference while the world it describes keeps moving. What changes now is only the speed at which the clean reporting accumulates.
The tell is not the level. It is the absence of movement — and the first thing worth asking is what changed about the instrument.
Which makes this testable rather than merely worrying. When the line goes flat, audit the channel itself:
- Can facts that were never encoded still enter the system at all?
- Is anyone still permitted — and still incentivized — to register an exception?
- Does a registered exception reach a reviewer who is independent of the thing being reviewed?
- Does outcome performance still corroborate the clean report, or is the report the only evidence you have?
Four clean answers and the flat line is real. One bad answer and you are not looking at alignment. You are looking at a channel that has lost the ability to tell you otherwise.
A note on a much older flat line
Twenty-one years ago I described a different flat line entirely — a commodity price series with minimal fluctuation, where flat meant low savings potential, because there was nothing there to recover.
Different object, different decade, different decision. Objective Flatlining™ is not an extension or a derivation of it. They were arrived at independently, on unrelated problems, twenty-one years apart.
What they share is a single interpretive move, and it is the move worth taking from both:
A signal that stops moving is not a stable signal. It is an unexamined one.
What I will concede
The 1998 system had an advantage most agentic deployments do not: a bounded domain with an unambiguous outcome measure, available fast enough to close the loop. Delivery performance either improved or it did not, and the answer arrived in weeks.
Where no such signal exists, guardrails are not a lazy substitute for learning. They may be the only instrument available, and an organization deploying them is not making a mistake by doing so. A guardrail answers a real question — what must never happen — and that question has to be answered.
What a compliance-oriented guardrail cannot answer is whether your understanding of the operation has stopped matching the operation. It was never built to. The error is not using guardrails. The error is treating a clean guardrail report as evidence that nothing has drifted.
The bridge, and it is narrow
There is a version of this where the two architectures converge, and it is specific enough to test.
A guardrail can become part of a learning loop the moment a violation is logged as a candidate signal that the frame has moved, rather than as a compliance failure to be closed.
Part of one, not the whole of one. Logging is the entry condition. Someone still has to read the run of exceptions, connect them to what happened downstream, decide whether the frame actually moved, and change the operating assumption if it did. That is the work. The log only makes it possible.
It also requires one thing most current deployments lack: an independent channel to present conditions — a basis for disagreement that does not come from the same encoded inputs the agent already reasons from. Without it, the exception is decorative, and the layer above it has nothing left to detect.
Which is the finding, stated as plainly as I can state it:
Automate the recommendation without preserving an independent channel for real-world disagreement, and you keep the engine but lose the correction.
What remains is consistency at whatever level the encoded frame supports — and no signal telling you that improvement has stopped.
That was true in 1998, when a wrong assumption affected human decisions one at a time.
It is not a smaller problem now that the same assumption sits inside an autonomous system making thousands of decisions at machine speed.
Back to the question
The January 2025 question still stands, and I want to state the fair version of it, because the unfair version proves nothing.
The unfair version asks a system to produce an answer that is already known. Anyone can pass that, including the answer I received. The fair version is this: take a case where nobody has yet supplied the answer, and see whether the system nominates the relationship that turns out to matter.
I would like to be shown that. Not as a rhetorical device. I have put this question back into circulation repeatedly over the eighteen months since I first asked it, in front of an audience deliberately built to include the people best positioned to answer, and it has not once been taken up. That is a real observation, and it is still not proof of anything. A question that goes unanswered is consistent with the question being unanswerable — and equally consistent with answering it being unrewarding for anyone whose position depends on the opposite conclusion. Those two produce identical silence.
Which is the discipline this entire post argues for, applied to my own position. A channel that produces no variance tells you nothing about whether agreement was reached. It only tells you that nothing came back. By the standard set out above, that is precisely the reading I should distrust when it happens to favor me.
So the question is not whether 1998 was smarter than 2026. It is one question you can put to any architecture in front of you:
When reality disagrees with the encoded frame, does the architecture merely contain the disagreement — or can the disagreement change what the system understands?
Quick Takeaway — the skip-to-the-end whodunit
For anyone who reads the last page first, here is who did it.
It was never the technology. In 1998 it was a set of algorithms with a channel for facts they did not have. In 2005 it was a contract that was correct on the day it was signed. In 2026 it is an agent with a guardrail around it. All three worked exactly as designed. Two of them produced clean reports while the operation they described moved out from underneath them.
The mechanism, in three lines. A model of the operation gets encoded. The encoding is treated as settled. From that moment the only signal that could reveal drift is disagreement — and every architecture on that list either preserved a channel for it or removed one.
Why this is not a complaint about AI. Roughly half to eighty-five percent of initiatives have failed to deliver what was promised, depending on the source and the era — through e-procurement, through ERP, through analytics, and now through AI. Four technology eras, four generations of tooling, one distribution that refuses to move. A constant that survives that many changes of technology is not caused by technology.
The falsifiable version. I am not predicting that AI fails. I expect the distribution to hold — and that which side of it an organization lands on will be determined by something other than the platform it selects. If a wave of deployments succeeds at a materially better rate, and the difference tracks the technology rather than the operating logic underneath it, then I am wrong and this is the post to hold up.
What to do Monday morning. Find the place in your architecture where the world is allowed to disagree with the model. If you cannot locate it, that is the finding. If you can, check whether anyone reads what it produces.
Because the answer to the whodunit is the same in every era, and it has never once been the tool:
When reality disagrees with the encoded frame, does the architecture merely contain the disagreement — or can the disagreement change what the system understands?
-30-
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
Related
What Are the Differences Between RAM 1998 Self-Learning Algorithms and Guardrails for Agentic AI?
Posted on August 9, 2026
0
An architecture that can learn from disagreement, and an architecture built to constrain it
What to do Monday morning: find the place in your architecture where the world is allowed to disagree with the model.
The rest of this is why that is the whole job.
On 29 January 2025 I put a question to a LinkedIn discussion on agentic AI, alongside a video of the case it came from:
One answer came back. It was generated by an AI tool and passed along in good faith by a participant who then offered to build it into a proper research framework — a generous, constructive contribution, and I want to be clear that what follows is about the answer, not the person who relayed it.
The answer said a well-designed agentic AI would recognize the order timing patterns autonomously, identify the missing variable of time-based order clustering as crucial, and generate the inquiry before a human analyst considered it.
Read that middle clause again.
You can only call time-of-day the missing variable once somebody has told you which variable was missing. Knowing the answer is four o’clock, order timestamps look obviously worth examining. Before you know it, they are one field among hundreds, and nothing in the data marks them as more interesting than delivery distance, part number, or requisition value. The answer reasons backward from a solution it already had.
That is not a capability. It is hindsight wearing the costume of one.
I asked one follow-up, and it is the question I have been circling ever since:
Unidentified carries the whole thing. You cannot pattern-match on a relationship you have not nominated as a candidate — and nothing nominates this one, because on every org chart, every process map and every dataset in that operation, service technician incentives and parts delivery performance are unrelated.
Eighteen months later, this is my answer to my own question. It is not a claim about what AI cannot do. It is a claim about an architectural property — one that a system built in 1998 had, that most agent deployments do not, and that determines whether a question like that one can enter the system at all.
One clarification before anything else, because the word guardrail now covers a great deal of ground — input filters, output validators, policy engines, runtime monitors, evaluator agents, escalation paths. This is not an argument against all of that. The target here is narrower and specific: a compliance-oriented guardrail, meaning one whose target state is zero violations. Where that describes the architecture, everything below follows. Where it does not, it does not.
Start with what the 1998 system actually did.
What “self-learning” meant in 1998
A defense maintenance operation was delivering parts on time 51 percent of the time against a 90 percent requirement.
The algorithms took historic supplier performance and reconciled it against real-time buying conditions, then ranked the available suppliers for each requirement. Twenty or thirty of them in some categories, re-ranked requirement by requirement as conditions moved. A buyer worked from the top five or ten. The ranking was presumed correct, and it usually was — delivery performance went from 51 percent to 97.3 percent.
Three things sat around that ranking. None of them is performed by a guardrail merely because a guardrail exists — each requires a traceable learning loop with an independent source of present-condition evidence, which is the distinction this whole piece turns on.
First, the buyer set the objective. If price was primary, the list ranked on price. If delivery was primary, the same list re-ranked to put greater weight on past delivery performance over lower cost. That is not the buyer disagreeing with the system. It is the buyer supplying the one thing the algorithms could not know — what this particular requirement was actually for — and the system doing exactly what it was built to do with it.
Second, the buyer could disqualify a supplier on information the system did not have. A weather event. A port strike. A regional disruption that had not reached any data feed and would not for days. The supplier that wins on both price and delivery history is the wrong answer when its freight cannot move, and no amount of historic accuracy fixes that. The buyer was not overruling the ranking’s logic. The buyer was supplying a fact the ranking had been computed without.
And this only counted for anything because of the third thing: the exception had to be transparent and traceable. Recorded, attributable, reviewable. Without that, an exception is indistinguishable from a buyer quietly favoring a supplier, and the whole mechanism becomes a loophole instead of a control. Real-time exception management works only when the exceptions leave a record.
There is a precondition underneath all three, and it is easy to miss. The baseline ranking had to be right. An exception is only evidence if the thing it departs from is defensible. Where the underlying model is weak, a person going against it tells you nothing — it is preference, not information, and no amount of traceability converts one into the other. The statistical ranking is what made disagreement worth recording in the first place.
That cuts both ways. A guardrail derived from a shaky model of the operation produces violations that carry no signal either. The problem is not only that a compliance-oriented guardrail discards its exceptions. It is that in many deployments there is nothing underneath them worth keeping.
So where was the learning?
In the outcome. Every requirement either closed or it did not, and that result went back into the supplier’s historic record, which the next ranking computed against. Continuously, automatically, with nobody adjudicating what counted.
And the outcome was never just the arrival date. If the part shipped on time but arrived dead on arrival, or was the wrong part, that failed — because a part that does not close the service call has not done the job it was ordered to do. Quality and correctness landed in the same historic record as delivery, governing the same ranking. A supplier who shipped fast and shipped wrong lost standing on precisely the instrument that rewarded the one who shipped right. No separate quality program. No quarterly vendor scorecard. The same loop.
Delivery performance reached 97.3 percent in three months, measured against calls that actually closed. No new platform was installed to produce that. The technology selection came afterward, which is why no vendor can be credited with the result.
A note on the term. In 1998 the language was advanced algorithms, researched under SR&ED funding and running on the hardware of the period. Self-learning is how I describe the same mechanism now. What matters is not the label. It is the shape of the loop.
A note on the source. The result is documented in the contemporaneous record and has been published repeatedly since 2007. The architecture above — the objective setting, the traceable exception, the outcome measure — is described here from my own record of the engagement. The original filing prepared by counsel at the time is the document that would settle it, and it is not yet in front of me.
1. The exception is recorded, not suppressed
An exception in 1998 was a fact entering the record. It named a supplier, a reason, and a buyer, and it sat alongside the ranking it displaced — so the file showed both what the system computed and what reality did to it.
A compliance-oriented guardrail runs the other way. It draws a boundary and measures its own success by the absence of crossings. Zero violations is the target state, and a violation is a thing to be closed.
One architecture treats the exception as information. The other treats it as a defect in its own operation.
That is not a difference of degree. It is a difference in what the system treats as evidence.
2. One is measured against the world, the other against the rule
The 1998 loop was closed by an outcome — did the call close — arriving on a short enough cycle to act on. Not the shipment date. Not a conformance report. The completed job.
A compliance-oriented guardrail is evaluated against the rule it encodes. Not against what happened downstream.
That gap is the whole problem. Such a guardrail set can be one hundred percent satisfied while the operation degrades underneath it, and nothing in the instrument will report it. Rule conformance and operational truth are two different measurements, and only one of them was driving the result in 1998.
3. Whoever disagrees has to know something the system does not
This is the load-bearing difference, and it is the one usually missed.
The buyer’s exception carried information because the buyer stood in a condition the system could not see. Present, physical, unencoded, and often hours or days ahead of any data feed. A port closed. A plant down. Freight that cannot move regardless of what the historic record says about that supplier.
Now the conditional that matters. Where a guardrail is derived from the same model of the operation the agent reasons from — same data, same definitions, same assumptions about how the work gets done — it is not necessarily an independent check on the agent. It may simply reproduce the same assumptions at another layer.
Where that holds, it is the agent’s own reasoning wearing a supervisory label, and it agrees by construction.
I am not claiming a percentage. I am claiming that when the condition is true the consequence follows, and that the condition is worth checking before anyone treats the governance layer as independent. Add a layer that reasons from the same inputs as the thing it governs and you have not added a check. You have added a second copy of the first layer and given it a different name.
This is also where the clean-data argument runs out. If the agent and the guardrail read from the same source, cleaning it improves both equally and the gap between them stays exactly zero. Independence is a sourcing property, not a quality property. Clean data cannot manufacture a second opinion. It can only make two dependent layers agree more precisely — and a more precise agreement between two copies of the same assumption is not corroboration.
Worse, it is quietly self-reinforcing. Every quality test is conducted against the model: no duplicates, no nulls, consistent definitions, reconciled sources. All of it measures whether the values match what the schema says they should be. None of it can tell you whether the schema carves the operation at its joints. So the cleaner the data becomes, the more internally consistent and therefore more authoritative an unvalidated representation looks, and the less anyone thinks to question it.
At that defense operation the order timestamps were already there, years before RAM 1998 arrived. Every release carried a time. The data was not dirty — it was clean, complete and correct, and it sat that way for years, because nothing in a clean dataset nominates one field as more interesting than any other. Cleanliness does not generate hypotheses.
The check is a single question: what does the oversight layer know that the agent does not? If the answer is nothing, there is no oversight — only agreement.
4. Watching for divergence is not the same job as deciding
The senior manager in 1998 approved nothing. He watched the pattern of exceptions.
That function only works because the exception was both permitted and traceable. One disqualification is a fact about a port. A run of them in the same region, month after month, is a fact about the model — the encoded conditions have stopped matching the real ones, and something upstream needs re-tracing. The buyers were not gaming anything. They were responding to conditions in front of them, which is exactly what made the record worth reading.
Where the architecture is compliance-oriented, a violation is routed to suppression. The exception gets closed. Nobody asks what the run of them was telling them. The signal is generated, and then consumed by the process designed to make it go away.
5. The flatline: when the failure looks exactly like success
Here is the part that should concern anyone deploying agents at scale.
A well-tuned guardrail set produces zero violations. So does a system where the mechanism capable of disagreeing has been removed, or has quietly stopped functioning.
In a snapshot, those two conditions are indistinguishable. Both report zero. Both look like the program is working. The reporting has never looked better.
I call this Objective Flatlining™ — the condition in which the disagreement channel stops producing variance, not because alignment has been achieved, but because the mechanism capable of disagreeing has been removed or absorbed. The system appears at its most stable at precisely the point it has stopped improving.
It applies to objectives as readily as to channels. A program that stops being measured against its original commitment flatlines the same way: nothing to reconcile, nothing to explain, no variance in the record.
It is a particularly dangerous failure mode because it can announce itself by producing nothing. An overrun exhausts a budget. An error gives a wrong answer. A missed deadline is a date on a calendar. This one generates no incidents, no exceptions, and no escalations — which is why it survives review after review.
So how do you tell the two apart?
Not by the incident count. Zero is the reading both conditions produce.
One diagnostic is the variance rate over time. Genuine alignment tends to produce a low but noisy rate — occasional exceptions, irregular, tracking real conditions, because reality keeps producing edge cases.
Which gives the question, rather than the answer:
Sometimes the honest answer is the first one. A tightly bounded, genuinely deterministic process can run at zero exceptions because zero is correct. An environment can stabilize. Those are real, and a flat line in either case is nothing to worry about.
But be careful about the explanations that sound like alternatives and are not. If the flat line arrived because detection sensitivity was retuned, or because exception categories were reclassified, or because the reporting changed — those are not competing explanations. They are how the capacity to disagree gets removed. Each one narrows what the channel is able to register, and a channel that can no longer register disagreement will report zero forever.
None of this is new, and none of it requires AI. In 2005 a major US retailer engaged me to assess a procurement strategy that was not delivering the value they expected. They had consolidated their supplier base under a leveraged-spend initiative. Suppliers had cut price hard to win one of the chosen slots, the terms were locked in contract, and the savings reporting was clean — negotiated against the pre-consolidation baseline, no exceptions, nothing to reconcile.
They were paying 21 percent above market.
Not because anyone overcharged them. On signing day those discounts were real. But the commodities in question were what I identified in the late nineties as Dynamic Flux — a characteristic of steady, sometimes rapid decline in price over time, typical of indirect materials and MRO. The contract froze a number that was correct at the moment it was struck. The market kept moving. The number did not.
The 21 percent was not a premium. It was the distance the market traveled while the contract stood still.
And the suppliers who understood the characteristic said nothing, which was not misconduct. Their obligation was the negotiated price, not the real-time market price. Honoring the agreement and staying silent were the same act. One party away from the organization absorbing the cost, doing exactly what they had agreed to do — the same shape as technicians batching orders at four o’clock because that was how they were measured.
Nothing in that arrangement could report a problem, because nothing in it was malfunctioning. The contract performed as written. The savings report measured against the baseline it was built to measure against. The mechanism that could have registered the gap — a live comparison against the market — had been contracted away as a deliberate feature of the program.
Which is the general form, and it is worth stating on its own: once a process or an operating model is treated as final, erosion begins. Not because anyone stops caring. Because finality removes the channel through which movement would be noticed.
That is the whole failure mode, twenty years before anyone dispatched an agent — and it is exactly what a compliance-oriented guardrail is. An encoded rule, fixed at a point in time, correct when written, reporting conformance against a frozen reference while the world it describes keeps moving. What changes now is only the speed at which the clean reporting accumulates.
The tell is not the level. It is the absence of movement — and the first thing worth asking is what changed about the instrument.
Which makes this testable rather than merely worrying. When the line goes flat, audit the channel itself:
Four clean answers and the flat line is real. One bad answer and you are not looking at alignment. You are looking at a channel that has lost the ability to tell you otherwise.
A note on a much older flat line
Twenty-one years ago I described a different flat line entirely — a commodity price series with minimal fluctuation, where flat meant low savings potential, because there was nothing there to recover.
Different object, different decade, different decision. Objective Flatlining™ is not an extension or a derivation of it. They were arrived at independently, on unrelated problems, twenty-one years apart.
What they share is a single interpretive move, and it is the move worth taking from both:
What I will concede
The 1998 system had an advantage most agentic deployments do not: a bounded domain with an unambiguous outcome measure, available fast enough to close the loop. Delivery performance either improved or it did not, and the answer arrived in weeks.
Where no such signal exists, guardrails are not a lazy substitute for learning. They may be the only instrument available, and an organization deploying them is not making a mistake by doing so. A guardrail answers a real question — what must never happen — and that question has to be answered.
What a compliance-oriented guardrail cannot answer is whether your understanding of the operation has stopped matching the operation. It was never built to. The error is not using guardrails. The error is treating a clean guardrail report as evidence that nothing has drifted.
The bridge, and it is narrow
There is a version of this where the two architectures converge, and it is specific enough to test.
A guardrail can become part of a learning loop the moment a violation is logged as a candidate signal that the frame has moved, rather than as a compliance failure to be closed.
Part of one, not the whole of one. Logging is the entry condition. Someone still has to read the run of exceptions, connect them to what happened downstream, decide whether the frame actually moved, and change the operating assumption if it did. That is the work. The log only makes it possible.
It also requires one thing most current deployments lack: an independent channel to present conditions — a basis for disagreement that does not come from the same encoded inputs the agent already reasons from. Without it, the exception is decorative, and the layer above it has nothing left to detect.
Which is the finding, stated as plainly as I can state it:
What remains is consistency at whatever level the encoded frame supports — and no signal telling you that improvement has stopped.
That was true in 1998, when a wrong assumption affected human decisions one at a time.
It is not a smaller problem now that the same assumption sits inside an autonomous system making thousands of decisions at machine speed.
Back to the question
The January 2025 question still stands, and I want to state the fair version of it, because the unfair version proves nothing.
The unfair version asks a system to produce an answer that is already known. Anyone can pass that, including the answer I received. The fair version is this: take a case where nobody has yet supplied the answer, and see whether the system nominates the relationship that turns out to matter.
I would like to be shown that. Not as a rhetorical device. I have put this question back into circulation repeatedly over the eighteen months since I first asked it, in front of an audience deliberately built to include the people best positioned to answer, and it has not once been taken up. That is a real observation, and it is still not proof of anything. A question that goes unanswered is consistent with the question being unanswerable — and equally consistent with answering it being unrewarding for anyone whose position depends on the opposite conclusion. Those two produce identical silence.
Which is the discipline this entire post argues for, applied to my own position. A channel that produces no variance tells you nothing about whether agreement was reached. It only tells you that nothing came back. By the standard set out above, that is precisely the reading I should distrust when it happens to favor me.
So the question is not whether 1998 was smarter than 2026. It is one question you can put to any architecture in front of you:
Quick Takeaway — the skip-to-the-end whodunit
For anyone who reads the last page first, here is who did it.
It was never the technology. In 1998 it was a set of algorithms with a channel for facts they did not have. In 2005 it was a contract that was correct on the day it was signed. In 2026 it is an agent with a guardrail around it. All three worked exactly as designed. Two of them produced clean reports while the operation they described moved out from underneath them.
The mechanism, in three lines. A model of the operation gets encoded. The encoding is treated as settled. From that moment the only signal that could reveal drift is disagreement — and every architecture on that list either preserved a channel for it or removed one.
Why this is not a complaint about AI. Roughly half to eighty-five percent of initiatives have failed to deliver what was promised, depending on the source and the era — through e-procurement, through ERP, through analytics, and now through AI. Four technology eras, four generations of tooling, one distribution that refuses to move. A constant that survives that many changes of technology is not caused by technology.
The falsifiable version. I am not predicting that AI fails. I expect the distribution to hold — and that which side of it an organization lands on will be determined by something other than the platform it selects. If a wave of deployments succeeds at a materially better rate, and the difference tracks the technology rather than the operating logic underneath it, then I am wrong and this is the post to hold up.
What to do Monday morning. Find the place in your architecture where the world is allowed to disagree with the model. If you cannot locate it, that is the finding. If you can, check whether anyone reads what it produces.
Because the answer to the whodunit is the same in every era, and it has never once been the tool:
-30-
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
Share this:
Like this:
Related