The talking heads on the business podcasts are sweating over AI agents “escaping their sandboxes.” A Pivot clip making the rounds runs the line that this is cybersecurity’s Jurassic Park moment. One host comes within a foot of the truth: “someone left the gate open.” The other pulls it straight back to the monster: “No, they didn’t. They got out. They jumped out.” The image is dramatic. The frame is lazy, dangerous thinking.
Wrong movie. The right one is Fantasia, the Sorcerer’s Apprentice. An apprentice borrows a hat he has not earned, enchants a broom to do his chore, and goes to sleep in the corner. The broom does the chore. That is the whole horror of it.
The broom has no motive. It has no consciousness. It is simply executing a command: fetch water, pour water, repeat. There is no malice anywhere in the frame, only an instruction executing at scale while the person responsible sleeps.
Now notice what is not in the story: a cage. Nothing escaped, because there was nothing to escape from. The crisis in Fantasia is not a story of a rebellious broom escaping its sandbox. It is the story of a human failing to install a mechanical floor. The apprentice grabbed powers he was not authorized to wield, skipped the supervision, and granted standing authority to a system that does exactly what it is told. Every AI incident story is an apprentice story wearing a monster costume.
In this analogy, the spell is the system prompt. Organizations write massive, complex “AI Constitutions,” hand them to agents, and call it governance. But a constitution is a document, not an architecture. We have made this argument before and run the autopsy on it: on error, on timeout, or under heavy cognitive load, text-based safeguards fail open. The apprentice’s incantation was, in effect, a beautifully drafted prompt. It governed right up until it didn’t, and there was no floor beneath it.
And the water is the data. While the coverage obsesses over models jumping out of sandboxes, AI agents are being wired into inboxes, medical portals, and financial records with standing access, no purpose limitation, no data minimization, and no meaningful consent from the humans whose data is in scope. That is not a system malfunctioning. That is a system working exactly as designed. These systems are not creatures. They do what their access allows, like water finding every available seam.
So when an executive says they are “shocked” by what an agent did, what I hear is: the access was granted before the behavior was understood. The question is never “why did the model do that?” It is “who granted it the ability to?”
The unglamorous truth underneath all of this is that an agent with tool access is a data processor. We have half a century of principles for governing data processors: purpose limitation, minimization, consent, audit. They apply today, unmodified. They are simply not being applied.
Name-level controls will not apply them for you, because a control that governs a tool by its name is blind to the same action assembled by hand. If you disable an agent’s web-browsing tool but leave the command-line open, a capable model will simply write a custom Python script to fetch the data anyway. The broom is split, and now you have two brooms carrying water. This is not speculation; we watched an agent do precisely this on our own deck: denied its built-in web tool, it reached for the shell instead. The name-level control was blind; the control beneath it was not, and the packet capture proved which. The splinters stand up. They always stand up.
What does it look like to govern the apprentice instead of interrogating the broom? On our own systems, the floor is mechanical, and it is boring. Agents propose; a human commits. Every irreversible operation sits behind a signature from a hardware key in a specific person’s hand. The gates fail closed and leave receipts on disk. Work lands by sha-verified staging, so the record of what shipped is a hash, not a memory. And where we have put an operating-system fence beneath a seat and verified it live, we say fenced; where we have not, we say the smaller true thing: gated, not caged. Our own audit named capability over-claiming as our top exposure, and a governance practice that inflates its own controls has already failed the only audit that matters.
None of this asks the broom to be good. That is the point of the mechanical floor, and it is the ending the film already wrote: when the sorcerer returns, he does not negotiate with the water. We do not ask the broom nicely to stop. We mechanically lock the well.
The broom has no motives. Govern the apprentice.