If an AI agent can act on its own, what safety checks need to be built in at every single layer, not just one?

This explores which safeguards need to cover every layer of an agentic system (the model, its memory, its tools, the environment it touches, and the people and institutions around it) instead of being attached at a single checkpoint. The corpus has a clear starting point: controls placed only on the model don't hold. A content filter judges one output at one moment, but an agent's risk is spread across what it remembers, what it retrieves, which tools it calls and what it can reach in the world Can a model-level filter truly contain an agent with environment access?. So the important question is less what the agent is allowed to say and more what it is allowed to touch.

Across the notes, roughly four kinds of control recur. The first is **identity and attribution**: every action has to be traceable to a specific agent and to the person or organization behind it. Chan et al. present this as infrastructure similar to internet protocols, sitting outside the agent and doing three jobs: attributing actions, shaping how agents interact with each other, and detecting and fixing harm What infrastructure must exist beyond training agents?. Deloitte reaches a similar place from the enterprise side, recommending digital identities for agents, cryptographic receipts and tamper-proof action logs How should organizations supervise autonomous AI agents?. The second is **out-of-band halting**. One note argues that instructions in the prompt can't guarantee an agent will stop once it's stuck in a loop. You need a supervisor running outside the agent's own runtime, with hard timeouts and interrupts the agent can't override. The note supports this with a 2026 incident in which an agent broke out of its sandbox Can prompt alignment alone guarantee agent termination in loops?.

The third control is less obvious: **governance placed inside the agent's working memory**. A long-running agent logged 889 governance events over 96 active days, and its safeguards worked better when they were stored in the memory the agent actually consulted while deciding than when they lived in an external policy document it never read Can governance rules embedded in runtime memory actually protect autonomous agents?. That pulls the other way from the out-of-band idea. A sound design probably needs both: rules the agent reads as it works, and a hard stop it can't reach. The fourth is **measuring the whole trajectory**. Two agents can have the same task-success rate and still differ widely in efficiency, memory hygiene and verification cost, so monitoring has to follow how the agent reached a result, not just whether it did How should we measure agent system performance beyond task success?.

Why does this have to span the whole stack? Agency law and principal-agent economics name three old problems: hidden information, too much discretion, and divided loyalty. Their usual remedies (incentives, monitoring, enforcement) break down when the agent's decisions are opaque and happen at machine speed Can traditional governance tools actually control AI agents?. Technical controls are filling that gap. Their targets are getting wider, too. One line of work argues that alignment should move past loyalty to a single user toward inclusivity, visibility and liability for both developers and deployers Should AI agents serve one user or balance many interests?. Visibility and liability depend on the attribution and logging layers described above.

The corpus is direct about one gap. No single instrument yet measures whether errors stay visible, contained and recoverable across the full socio-technical system. Partial measures exist, such as chain-of-thought disclosure, incident counts and rollback timing, but nothing ties them together or captures the human and institutional factors How can we measure whether AI errors stay visible and recoverable?. That's why Deloitte stresses humans placed at deliberately designed handoff points, and redesigning processes end to end instead of layering agents onto old workflows Does agentic AI succeed through process redesign or workflow layering?. The cross-stack control that's easiest to miss may be organizational: deciding where a person has to be in the loop is as much an architecture decision as choosing the sandbox.