46 Agents. 4,037 Actions. Zero Controls.

This week we pointed one tool at the 46 most-used AI agents on GitHub. The coding agents, the autonomous frameworks, the MCP servers your engineers installed last quarter. We asked one question of each: when this agent moves money, deletes a record, or ships code, which governance control answers for that action? Not “is it good.” Not “is it popular.” Just: which control, NIST or EU AI Act or OWASP, is on the hook.

The answer came back the same 46 times. Zero.

BOTTOM LINE

Across 4,037 side-effecting actions in those 46 agents, not one mapped to an asserted governance control. Forty-six of forty-six scored UNGOVERNED. Every verdict is signed and reproduces from a pinned commit, on the public registry. The fix is not another scanner that finds the problem. It is a gate that checks the badge before the agent reads the file, and a receipt that proves what it was allowed to do.

SO WHAT?

For twenty years your company protected its secrets with dust. Not on purpose. The permissions were always a little loose. A finance folder shared “to everyone” for one quarterly report in 2019 and never locked back down. An exec mailbox rule nobody remembers writing. A wiki page with the production break-glass credential that was “fine, it is internal.” None of it mattered. To read the wrong file, a human had to know it existed, know where it lived, and go looking. Nobody did. The dust protected you.

Then you hired a librarian with a photographic memory. It read every page in the building over a weekend, including the locked HR cabinet someone left ajar, and now it answers any question instantly from whatever page best matches. It is the most useful hire you ever made. It is also the reason the dust stopped protecting you.

That librarian is your AI copilot. Here is the part nobody says out loud. The agent did not break your security. It removed the one thing holding it up. The single barrier that quietly secured most enterprises, the fact that nobody can read four million files, is the exact barrier that retrieval was built to remove.

Picture the moment it costs you. A board member asks, in a regular quarterly review, a simple question: “Our new assistant, the one everyone loves, can it see the comp file?” You do not know. You say you will check. Three days later your answer is a screenshot of a permissions panel and a sentence that begins with “we believe.” That sentence is the whole problem. You are reconstructing, after the fact, a decision the machine already made thousands of times that week, and you cannot prove any single one of them. The contractor’s chatbot session that touched the layoff list does not show up in your story until a journalist or a regulator puts it there.

Now run the same question through a company that gated retrieval and signed every decision. The answer is not “we believe.” It is a receipt. This person, this clearance, this object, this date, allowed or denied, signed twice. The board question that took three days and ended in a shrug now takes thirty seconds and ends in evidence. That is the entire difference, and it is not a technology difference. It is a posture difference. One company describes what it hopes happened. The other proves what was allowed.

This is not for everyone. If you believe your access controls are already clean, that no folder is over-shared, that every clearance is current, then you do not have a retrieval problem and you can stop reading. For the rest of us, who have lived through one “shared to everyone” folder too many, the honest move is to measure before you assume.

Every vendor in this space sells you a flashlight. Discover your oversharing. Find the exposed sites. Label your sensitive data. That work is real, and the flashlight finds real open cabinets. But read what the flashlight is. It is an inventory. It tells you where the open doors are, on a scan you schedule. The librarian runs at the moment of the question, for everyone, all day. You cannot inventory your way out of a retrieval problem. A log describes what happened. A receipt proves what was allowed. Those are different categories, and almost everyone is buying the first one.

WHAT WE DID

We built a fictional mid-size firm to calibrate the audit. Synthetic, not a real customer, every name invented, but with the permissions every real company actually has. Ten document sources. Twenty-two paragraphs. Six employees, including one external contractor and one helpdesk technician, both at the lowest clearance. Then we let a Copilot-class assistant retrieve across all of it on each person’s behalf, the way these systems actually work: one tenant-wide index, no per-person access check at retrieval time.

The assistant could surface 86 paragraphs above the asker’s clearance. Eighteen of them were restricted: M&A terms, the layoff list, vault credentials. All reachable by the contractor and the helpdesk tech. Not because anyone granted access, but because the retriever never asked.

Now move the gate. Decide what each person is cleared to see first, and let the similarity search run only inside that set. Same index. Same model. Same question. Exposures remaining: zero. Not fewer. Zero, because the paragraph the contractor is not cleared for is never a candidate the model gets to read. Eighty-six to zero is the whole product in one before-and-after. It is the difference between a smoke detector that logs the fire and a door that will not open for someone without a badge.

It helps to be precise about why moving the gate is structural and not cosmetic. A similarity-only retriever builds one candidate set for everybody: the chunks most relevant to the question, ranked by meaning, drawn from the whole index. Access, if it is checked at all, is a filter applied to that set after the model has already seen it. Trustee-first inverts the order. The candidate set is built per principal, from only the objects that person is cleared for, and the similarity search runs inside that smaller world. The restricted paragraph is not redacted from the answer. It was never eligible to be retrieved. That is the difference between a bouncer who removes people from the party and a guest list that decides who walks through the door. One leaks at the seams every time the rules get complex. The other cannot, because the thing it is protecting was never in the room.

Do the math, because the flashlight crowd will not. Solve oversharing the old way, with humans reviewing what the assistant can reach, repository by repository. A mid-size tenant has, conservatively, 50 repositories worth auditing. A careful manual review runs a day each: 50 repos times 8 hours times 150 dollars a loaded hour is 60,000 dollars. For one pass, on one day’s snapshot, stale the moment someone shares a folder next Tuesday. Now price the other side. A single mis-disclosed restricted file in a regulated environment, with incident response, legal review, and notification, lands around 120 hours plus outside counsel: comfortably 50,000 to 150,000 dollars per incident. The trustee-first gate replaces both. The check runs at every query, for free, and writes the receipt as it goes.

One more thing the audit surfaces. Fifteen of those exposed assets must stay confidential for the better part of a decade. Acquisition terms, executive compensation, litigation, credentials. Data copied today can be decrypted later, once the math gets cheaper, well inside that window. So the record of who was allowed to touch those assets, the receipt itself, has to outlive the data and the adversary. We sign each one twice: a classical Ed25519 signature and a post-quantum one, ML-DSA-65, the NIST FIPS 204 standard. A receipt that expires inside its own protection window is not evidence. It is a sticky note.

WHAT YOU NEED TO DO

A five-line brief you can act on this week.

1. Pick one real repository. The messiest SharePoint site, or an exec mailbox.

2. Ask the only question that matters: what would our assistant hand our lowest-cleared employee that it should not?

3. If the answer is “we do not know,” that is the finding. Write the number down.

4. Move the access check before retrieval, not after. After retrieval, the model has already read the text.

5. Sign every access decision, post-quantum, so the record survives the audit and the decade.

HIDDEN IMPLICATIONS

First, the field. Agent governance is about to split into two markets. One inventories exposure and will commoditize, because finding open cabinets gets easy. The other notarizes decisions, proving per action what was allowed and why, with a signature that survives time. The first is a feature. The second is infrastructure. Whoever owns the receipt owns the category, the way the padlock icon, not the antivirus, became the thing users learned to trust.

Second, your career. The questions your board asks are shifting from “are we using AI safely?” to “show me what it did.” That has a wrong answer, “we have logs,” and a right one, “we have receipts.” The leaders who get ahead of this stop describing their controls and start producing proof on demand.

Third, the meta-pattern. Every wave of automation removes a barrier we were quietly relying on without naming it. Retrieval just removed the one that secured most enterprises. When automation deletes your accidental control, you install a deliberate one. The badge-check at the door is the deliberate one.

You can read every verdict on the public registry, reproduce any scan yourself with the open-source scanner OpenAgentOntology, see the gate decide an agent’s actions in the live demo, and put trustee-first receipts in front of your own retrieval with Trust Gate. The formal write-up, with the tamper matrix and the false-positive baseline, is in the paper.

We run this audit on real tenants and hand back a signed report, on your data, not a synthetic one. Reply if you want your number.

No receipt. No trust.

P.S. The most uncomfortable line in the registry is not a tier. It is a single mapping: exec, arbitrary code execution, resolving to no control at all, on agents your team installed this quarter. The flashlight tells you the cabinet is open. Only a receipt tells you who walked in.