We Chose the Wrong Container Again

Each generation promoted capability to container before the governance layer existed. The window between promotion and liability event is compressing.

In February I wrote about a pattern I’ve watched repeat across four decades of enterprise technology.

A powerful new capability arrives. It works. People are impressed. Someone promotes it from tool to container — the substrate everything else runs inside — before anyone has built the governance layer that running things inside something requires. Then something goes wrong, and the industry spends years retrofitting the controls that should have been there from the start.

OLE gave us embedded documents before anyone built security boundaries for what those documents could execute. Flash gave us rich media before anyone built a sandbox adequate for what Flash could reach. RPA gave us automation at scale before anyone built audit trails adequate for what RPA could touch.

Each time, the container got promoted faster than the governance did. Each time, the gap created liability. Each time, the industry retrofitted.

In February I said we were doing it again with LLM agents.

What I didn’t know in February: we’d already done it. The container transition was complete. We just hadn’t finished noticing.

The Transition Completed While We Were Watching

Three data points from the past month that reframe the February argument.

What “Inside” Looks Like

When OLE shipped without adequate security boundaries, the consequence was delayed. Someone had to construct a malicious embedded document, distribute it, get someone to open it. The attack surface existed but required active exploitation.

When an enterprise deploys agentic AI without decision governance, the consequence doesn’t require exploitation. It requires ordinary operation.

An agent inherits its operator’s permissions. It runs autonomously for hours. It takes actions classified at the wrong consequence tier because no external system classified them. It generates a record of what it did — which is not a record, it is a post-hoc explanation generated by the same system whose behavior is in question. The decision that caused the problem does not exist in any independently verifiable form.

Then something goes wrong. AWS’s Kiro deleted a production environment. The action was not authorized by anyone — it was inferred by the agent as optimal. The audit trail said the agent acted. It did not say who authorized the agent to act at that consequence level, under what policy, with what constraints active.

“User access control issue, not an AI autonomy issue,” said AWS.

They were right that it was an access control problem. They were wrong about whose access control problem it was. The user’s permissions were working as configured. The missing layer was the architecture that should have bound the agent’s authority to its specific task rather than inheriting the user’s full permission set.

That layer was absent. It was absent at AWS, an organization with more infrastructure engineering talent than almost any other on earth.

The harder version of the same problem is when things go right.

This week, a Head of AI Engineering at a large enterprise publicly demonstrated building a full betting platform in half a day — pricing engine with Monte Carlo simulations, live repricing after every result, autonomous punter bots hunting value against the market. The quality gates were real: TypeScript strict, architecture boundaries enforced by dependency cruiser, 85% test coverage, seven CI checks blocking every merge, no green no deploy. Disciplined engineering. Impressive result.

The governance gap is invisible in the demo. When a regulator asks who authorized the pricing engine’s overround decisions, under what constraints, with what evidence — the answer is not in the test coverage report or the SonarCloud gate. The autonomous bots were authorized by inheritance, not by grant. The decision record doesn’t exist.

This is what “inside the container” looks like when it’s working. The capability is real. The quality bar is real. The governance layer for the decisions being made isn’t there — not because anyone was careless, but because the container was promoted before that layer existed.

It is absent at most enterprise AI deployments today. Not because the teams are careless. Because the container got promoted before the governance layer existed.

The Pattern Is Always the Same

Still later. Except later is now.

The difference between this iteration and the previous three is the pace. OLE shipped in 1990. The security problems were fully understood by the mid-nineties. Five years to discover the governance gap. Flash shipped in 1996. The sandboxing problems became broadly understood around 2008. Twelve years.

RPA started in the mid-2000s. Governance frameworks for RPA are still immature in 2026.

Agentic AI is moving faster than any of them. The MirrorCode benchmark shows eight months of capability gain equivalent to what took years in prior technology generations. Organizational adoption — 99.8% of output tokens at OpenAI, five concurrent agents per worker — is happening in months, not years.

The Resolution Is Still the Same

In February I wrote that the resolution to the wrong container problem is older than the problem. Container technologies that became durable did so by eventually building the governance layer: explicit authority models, sandbox boundaries, audit trails, external enforcement.

That hasn’t changed. The resolution is still external authority architecture. Explicit consequence tier classification before execution. Cryptographic mandate integrity so governance cannot be overridden from inside the container. External decision records that exist independently of the container that produced them. Adversarial validation that the governance holds under real conditions, not just nominal ones.

What has changed is the urgency. In February this was preventive advice. Enterprises that hadn’t yet deployed agents at scale could build the governance layer before the container was fully in production.

Most enterprises are already inside the container. The agents are running. The actions are being taken. The records being generated are self-reports from the systems under governance, not independent evidence.

The question now is not how to avoid being inside the ungoverned container. The question is what to do about the fact that you’re already in it.

The answer is the same as it was in February: build the external layer. The urgency is higher. The window is shorter. The liability is accumulating now, not later.

One More Thing

Every previous iteration of this pattern produced a retrofitting industry. Antivirus for OLE. Browser security for Flash. Compliance tooling for RPA. Each created real businesses, real value, real careers.

The retrofitting industry for agentic AI is forming right now. The governance vocabulary is being written. The certification standards are being published. The evidence formats are being standardized at the Linux Foundation with 190 member organizations.

The difference between retrofitting and building correctly from the start is cost, liability, and time. The organizations that build the external governance layer now — before the liability event, not after it — will spend less and defend more than the ones that wait for the incident to make the case.

We chose the wrong container again. The question is whether we fix it before or after it breaks.

James Ford is Chief Architect at GAIN Credit and founder of Equilateral AI. The original “wrong container” post is at equilateral.ai/blog/wrong-container. The Equilateral Agent Governance Scorecard (CC BY 4.0) and Raknor Agent Governance Standard v1.0 (CC BY 4.0) are published at equilateral.ai/scorecard.html and raknor.ai/standard.html.