Public documents from the practice: an executive brief for leaders who are starting to feel this problem, and a technical crosswalk for the reviewers, auditors, and security teams who have to check it. Written to be read, cited, and — like everything here — checked against the record.
The published governance checklists cover the organizational questions and stay nearly silent on the four you can actually measure. This brief lays out all nine, marks which four are answerable with evidence rather than assurance, and — anchored to the July 2026 OpenAI containment breach — shows one we measured ourselves.
Six live conformance checks from the Agent Containment Diagnostic, each mapped to the control frameworks an auditor, reviewer, or buyer’s governance team already uses — NIST AI RMF, OWASP (LLM and Agentic), MITRE ATLAS, and SOC 2. Assertions measured off packet capture and disk state, never the agent’s own narration.
