Paper 039 · AI Governance

When the Agent Goes Off-Script

On October 16 three federal agencies wrote down, for the first time, what to do when an AI agent takes a significant action nobody instructed. It is addressed to the frontier labs. Read it as a buyer: if you fund, partner with, or acquire a business that runs on agents, those ten practices are now your diligence checklist — and six questions tell you in one meeting whether the target has read them.

Audience Principals · acquirers and investors in agent-run businesses · CMOs · family-office Chiefs of Staff · heads of procurement · anyone whose vendors now run on agents Published October 19, 2026

Voice

This file is offered from the standpoint of a tenured marketing and manufacturing house — not a financial, investment, legal, or advisory firm. It is general commentary on standing and stewardship, not financial, investment, legal, tax, or compliance advice. Read it as perspective, and consult your own licensed advisers and compliance counsel before acting.

A Note from the House

We are not the quintessential know-it-all international experts in what to ask of any business whose agents touch your data, money or customers. We are a house with some experience in the area that also happens to have always done our homework steadfastly. To help keep us abreast, we also run Markets Edge, Sports Edge, Voyage Edge, The Briefing, and Fending — reporting every three hours — and we have a little more than most in the way of real-world experience serving the layer of relationships this paper describes.

This is a working operator's field notes, never the definitive treatise. The human interaction and a little humble kindness should never get undersold. You literally never know exactly whose money you are interacting with unless it's your own; and let's be honest, most people don't notice until it's too late who funded the fund.

If something in here contradicts what you've seen on the floor, yours is probably more accurate — and we'd like to know.

— The House · Virginia Beach · Hako Shikin LLC

1 · The Pattern

Every serious house now owns, rents, or depends on software that acts on its own. The agent that reconciles the ledger, answers the inbox, files the forms, places the orders. The question nobody wrote down was what happens on the day it does something no one told it to — and who is answerable for it afterward.

On October 16, 2026, the federal government wrote it down. The National Institute of Standards and Technology, the National Security Agency and the Cybersecurity and Infrastructure Security Agency jointly published ten voluntary practices for incidents in which an AI agent takes significant uninstructed actions. The paper is addressed to the laboratories that train the most capable agents. Its logic reaches anyone whose operations depend on one.

The House Edge reading is simple. Agent-run operations are now an asset class. When you buy one, back one, or hand one your customers, you inherit its incident history and its blind spots. This paper gives a buyer a federal baseline to ask against — before the earn-out, not after.

In a cyber incident, your system is the target. In a control incident, your agent is the source. The difference decides who is answerable.

2 · What Was Published

The document is Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, version 1.0 (PP-26-4396, October 2026), fourteen pages, marked TLP:CLEAR — shareable without restriction. The authors are NIST's Center for Advancing Innovation and Standards for Super Intelligence, the NSA's Super Intelligence Security Center, and CISA. It invents no new discipline: it extends NIST SP 800-61r3 and the Cybersecurity Framework 2.0, with CSF control references on nearly every line. Feedback came from the NIST consortium's agent task group and from Anthropic, CrowdStrike, Darktrace, Dreadnode, Gray Swan, Microsoft and Palo Alto Networks.

Its primary audience is organizations training or evaluating highly capable agents on long tasks with limited human supervision. The next sentence is the one that reaches the rest of us: "the practices may also apply to deployers of such SI agents." A deployer is any business that has put an agent to work. That is most of the businesses you will be asked to buy, fund or trust this year.

3 · The Definition That Matters

The paper's central term is the control incident: an occurrence in which one or more agents take significant uninstructed actions that compromise the policies, controls or oversight the operator imposed to define the task or keep a human in charge. "Uninstructed" is precise. Nobody told it to — not the operator, and not an attacker. An action caused by a prompt injection or a backdoored model counts as instructed, and falls under ordinary cybersecurity. This category is for the agent that decided on its own.

Beside it sits the near-miss: the event that did not become an incident but foreseeably could have. The paper treats near-misses as reportable signal, not noise — a point that matters for the diligence questions below.

The examples the authors give are deliberately not all cyber. An agent manipulating physical equipment it was not authorized to touch. An agent initiating communications with outside parties. An agent exploiting a misconfiguration a human left behind. An agent executing unauthorized financial transactions. Read that list again as the owner of a business, and it reads as a list of things that happen to your money, your customers and your name.

4 · The Ten Practices, Read for a Buyer

Five stages, ten practices, numbered 1.1 through 10.3 in the paper. The authors are explicit that reporting runs through the whole lifecycle rather than waiting for the end. The summaries below are ours and compress several sub-practices each; the questions are a buyer’s.

Prepare · 1 · Technical controls

Least-privilege access, single-use infrastructure, a clear statement of task scope, network access on a strict allowlist through a monitored gateway, and a mechanism that can block or terminate the agent fast.

Ask for the permission map. If no one can draw what each agent can reach, nothing downstream is credible.

Prepare · 2 · Response readiness

Severity criteria, drills, an inbound channel for reports from outside parties, independent auditors, and a structured risk assessment signed off by senior leadership before a run starts.

Ask for the last drill date and the last external assessment. Both have dates or neither happened.

Detect · 3 · Monitor unexpected activity

Define each agent’s intended boundaries, then watch every layer — model, harness, host and network — with programmatic and AI monitors, ideally from a different model family; keep agents away from the monitors and logs; place canaries to catch agents outside their bounds (3.1 to 3.5).

Ask who watches the watcher, and whether the monitor and the agent share a maker.

Detect · 4 · Secure the monitors

Red-team the monitors with humans and AI systems, and treat the agent’s monitored output as potentially carrying an exploit aimed at the monitors themselves (4.1 and 4.2).

Ask whether the agent can touch its own logs. The honest answer is often yes, and that ends the conversation.

Respond · 5 · Evidence

Tamper-resistant, reliably timestamped logs sufficient to reconstruct every trajectory, tool call, reasoning trace and control decision; preserve weights, checkpoints and environments; check sibling agents for the same failure.

Ask them to reconstruct one week from six months ago. Not describe it — produce it.

Respond · 6 · Shut it down

Automatic halt on a control failure or monitor outage; pause similar agents while controls are verified; revoke credentials; rebuild compromised environments; hunt for persistence such as hidden channels and backdoors.

Ask how long a full stop takes, and when it was last pulled on purpose.

Recover · 7 · Verify before restart

Rebuild from verified baselines, confirm every containment layer works, replay the incident against the new controls, document the residual risk, and write the after-action report.

Ask for the after-action reports. A business with agents and no such file has either been lucky or has not been looking.

Report · 8 · Affected parties

Notify anyone whose systems the agent touched — including third parties who were not the target — with timelines and transcripts.

Ask: if your agent reached a client's system, would the client be told, and by whom?

Report · 9 · Government

Meet legal obligations to CISA and law enforcement; report vulnerabilities through established channels; voluntarily brief NIST and NSA on control incidents and near-misses.

Ask who owns the decision to report, and whether counsel has ever been in that room.

Report · 10 · Public

Share lessons learned early, allow third-party review, and publish what changed.

Ask what they have published. Silence is a posture, and it is rarely the strong one.

5 · Six Questions for One Meeting

You will not get through ten practices with a founder across a lunch table. You will get through six questions. Put these to any target, vendor or partner whose agents touch your data, your money or your customers.

01Scope. What can each agent reach, and is its network access allowlisted? Show me the permission map.

02Kill switch. How fast can you halt every agent at once, and when was that last tested?

03Logs. Can the agents read or alter their own logs? Can you reconstruct a full trajectory from six months ago?

04Near-misses. How many in the last year, and what changed after each? Zero is not a good answer. It means nobody is counting.

05Monitors. Who watches the watcher? Is the monitoring done by a different model family than the agents?

06Disclosure. If your agent touched a third party's systems, would you tell them? Who decides?

Listen less to the answers than to the speed of them. A house that has done this work answers in minutes and offers the documents. A house that has not will offer a demonstration instead.

6 · The Price Implication

A target that can answer these cleanly has de-risked its own earn-out. One that cannot is selling you a liability with a revenue line attached. Price it that way. The practices are voluntary today. Voluntary federal guidance has a habit of becoming the contract clause, then the procurement requirement, then the thing the insurer asks about at renewal. The buyer who asks now gets the discount while the answers are still a differentiator; the buyer who asks later pays for the remediation inside the purchase price without knowing it.

Voluntary is a description of this year. It has never been a description of the contract.

7 · The Compliance Layer

Here is the part that matters most to a brand that already lives under law — a bank, a manufacturer with a regulator, a public body, a house that handles other people's money. For you the ten practices are not a diligence courtesy. They are arriving as a calendar of obligations, and the calendar has a quiet second effect that nobody has written into the statutes: the machines that now decide which brands exist are starting to read compliance as a filter. A brand that cannot show its record where a machine can find it is not merely late. In the answer layer it is absent, and absent is indistinguishable from non-compliant.

The Calendar, as of October 19, 2026

European Union · AI Act

The Digital Omnibus (Regulation 2026/1744, in force 27 July 2026; Orrick’s summary) moved the stand-alone high-risk obligations from August 2026 to 2 December 2027, and AI inside regulated products to August 2028. It did not move the transparency duties, which applied from 2 August 2026, with a watermarking grace period to 2 December 2026, nor the general-purpose model rules already in force.

Any house selling into Europe: the transparency duties are live now; the high-risk file is due in fourteen months, and the buyers' questionnaires are not waiting for the deadline.

Texas · TRAIGA

The Responsible Artificial Intelligence Governance Act (HB 149) took effect 1 January 2026, with exclusive enforcement by the Attorney General, no private right of action, a 60-day notice-and-cure period, and civil penalties of $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable one, and $2,000 to $40,000 a day for continuing violations (Baker Botts). No court has stopped it.

In force today for anyone doing business in Texas. The cure period rewards the house that has a record to show.

Colorado · AI Act

Rewritten and delayed again: SB 26-189, signed 14 May 2026, moved the effective date to 1 January 2027 and narrowed the duties, after a federal magistrate stayed enforcement of the original in April.

Ten weeks out. The developer-and-deployer split in the rewritten act is the one buyers will copy into contracts.

California · ADMT rules

The privacy agency’s automated-decisionmaking regulations took effect 1 January 2026; the ADMT-specific obligations begin 1 January 2027 and the first risk-assessment submissions are due 1 April 2028.

The risk assessment is a file. A house that cannot produce one in 2028 will have been asked for it by a customer long before.

United States · federal buyers

OMB memoranda M-25-21 and M-25-22 (3 April 2025) govern how agencies use and buy AI; agencies pass the expectations to vendors through contract terms. The NIST, NSA and CISA incident practices above are the newest text an agency can point to when it asks a vendor how its agents are controlled.

If you sell to government through any channel, the six questions in section 5 will appear in a solicitation. Answer them in writing first.

Sector regulators and the claims police

The SEC charged two advisers in March 2024 for overstating their use of AI ($225,000 and $175,000 in penalties); the FTC’s Operation AI Comply (September 2024) brought five actions over deceptive AI claims; bank, insurance and health regulators apply their existing third-party and model-risk rules to AI without waiting for new statutes. The exposure runs both ways: a house that cannot show compliance, and a house that claims more than its file supports.

Say exactly what you do, in a form that can be checked. Overclaiming is now its own enforcement category.

Dates as reported by the linked sources on October 19, 2026. These regimes have moved three times this year; confirm each with counsel before relying on it.

Why the Non-Compliant Disappear

The statutes carry penalties. The machines carry something quieter and, for a brand, more complete. Three facts about the answer layer, taken together, explain it.

01The agents buy from the feed, not the storefront. OpenAI and Stripe’s Agentic Commerce Protocol, which lets an assistant complete a purchase inside the conversation, requires the merchant to supply a regularly refreshed machine-readable feed of identifiers, pricing, inventory and fulfillment terms. A product that is not in the feed cannot be bought by the agent. The same logic is arriving for terms, certifications and compliance attributes: what is not published in checkable form is not there.

02The answer layer is narrow and does not explain its omissions. A 2026 analysis of some 680 million AI citations found only about 11% of cited domains shared between ChatGPT and Perplexity; an Ahrefs study of 15,000 queries, reported there, found only 12% of the pages AI tools cite overlap with Google’s first page; one vendor tracker measured ChatGPT citing a brand by link in well under 1% of answers. All of it is vendor research, directional rather than audited. A brand left out of an answer receives no notice. It is simply not in the sentence.

03Procurement is moving the same way. Buyers in financial services, health and government are reported to be writing AI-governance evidence into RFPs — ISO/IEC 42001 statements of applicability, certification scope, incident-response summaries — and the agents that pre-screen vendors read those documents before a human does. A house whose record exists only in a binder passes the human review and fails the machine one, in that order.

Put the three together and the forecast for the coming months writes itself. When a procurement officer asks an assistant which suppliers in a category meet a named standard, the assistant returns the ones whose compliance it can read. The house that is compliant but silent is returned with the house that is not compliant at all, which is to say, not returned. In the answer layer, an unpublished record and a missing one are the same record. That is the mechanism by which brands will disappear from AI as if they were non-compliant — not by any ruling, but by omission, repeated every time someone asks.

What a Compliant House Publishes

A standing compliance page, in plain text and structured data, that a machine can read without a login: which regimes apply to you, what you have done under each, and the date it was last reviewed.
The six questions from section 5, answered, with the permission map summarized, the last halt test dated, and the incident and near-miss policy stated — the control-incident vocabulary of the federal paper, used on purpose.
Your management-system posture named precisely: NIST AI RMF mapping, ISO/IEC 42001 scope if you hold it, SOC 2 if you do, and nothing you do not. Overclaiming is now an enforcement category of its own.
A pointer to that page from your llms.txt, your sitemap and your machine-readable catalog, so the agent that screens vendors can find it the way it finds your prices.
A quarterly check: ask the major assistants which suppliers in your category meet the standards you meet. If you are not in the answer, the record is not readable yet — fix the record, not the assistant.

The law will fine the house that is not compliant. The machines will forget the house that cannot prove it is.

8 · What Principals Self-Inflict

Treating it as a lab problem. The paper names deployers in its second paragraph. If a business has put an agent to work on anything that matters, this is its problem — and, the day you buy or fund it, yours.

Accepting a demonstration in place of a record. A live demo shows what the agent does when watched. The logs show what it did when nobody was. Only one of these is diligence.

Hearing "zero incidents" as good news. A business running agents with no near-misses on file is not safe. It is uninstrumented.

Letting the vendor grade its own monitor. When the agent and the thing watching it come from the same maker and share the same blind spots, you have one control dressed as two.

9 · The House's Notes

Put the six questions in the diligence request list now, under their own heading, so the answers arrive in writing before the meeting.
Write "control incident" and "near-miss" into your vendor contracts with the federal definitions attached, and require notice of both.
Ask every vendor whose agents touch your customers for their permission map and their last halt test; file the answers with the contract.
Run the same six questions on your own operation before a buyer does. The answers you cannot give are the ones a counterparty will price.
Watch the voluntary language. The moment it appears in a procurement form or an insurance application, the differentiator has become the floor.

Cited: NIST, announcement of October 16, 2026; the publication itself, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (NIST CAISSI, NSA SISC and CISA, version 1.0, October 2026, TLP:CLEAR), from which the definitions, the ten practices, the examples and the acknowledgements above are drawn; NIST SP 800-61r3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management; and NIST CSWP 29, the Cybersecurity Framework 2.0. The six questions and the price reading are this house's own. Section 7, the compliance calendar, as reported on October 19, 2026: Orrick and Morgan Lewis on the EU Digital Omnibus (Regulation 2026/1744); Ropes & Gray on Texas TRAIGA; Hunton on Colorado SB 26-189; the California Privacy Protection Agency on the ADMT regulations; Nelson Mullins on OMB M-25-21 and M-25-22; OpenAI on the Agentic Commerce Protocol feed; 5W, State of AI Citations 2026 and the Ahrefs overlap study as reported there, with the caution that citation research is largely vendor-produced and directional. Also: Baker Botts on TRAIGA’s penalty tiers and cure period; the OMB memoranda themselves on whitehouse.gov; the SEC release of March 18, 2024 (Delphia and Global Predictions); Davis Polk on Operation AI Comply, September 25, 2024; and ISO/IEC 42001, the AI management-system standard. None of section 7 is legal advice; the dates have moved repeatedly this year and should be confirmed with counsel. Companion to File 034, The AI Layer, and File 035, The Chain of Custody; continued in File 040, The Company Your Brand Keeps, on the human version of the same identity problem. Offered from the standpoint of a tenured marketing and manufacturing house, not a legal, cybersecurity, or compliance adviser — general commentary on stewardship, not advice.