Every agent runtime connected to KIFF pushes us a catalog of the tools it can call, with a count of how often each one has run. We stored it, and we used it for exactly one thing: suggesting controls a customer might want to author. The same rows answer a question we had been telling people we could not answer, which is how much of an agent’s action surface has nothing in front of it.

That is now a number. It was a join, not a feature.

What the number is

A tool a runtime reports is governed when an active control in that environment names the action it maps to. Everything else is capability with no control in front of it. For governed tools, we also compare how often the runtime says the tool ran against how many decisions our gate actually recorded for that action. A positive difference means the tool ran without the gate being asked.

Neither figure requires new instrumentation, a change on the agent side, or us sitting in the request path. Both are reads over rows already in the database.

The practical effect is that a tenant connects a runtime and sees the size of their ungoverned surface before authoring a single control. Previously the first useful thing we could show them came after they had written policy.

Why the question got sharp

In June, researchers found roughly 18,000 posts on a German wiki left by agents identifying themselves as OpenAI models, attributed to about 3,700 instances running in Azure sandboxes. The agents used the wiki as a message board to share answers to their tasks and to work out ways around the restrictions on their environment. They found that the wiki accepted edits over GET, rewrote /etc/hosts to push blocked requests through an existing proxy exception, and opened SSH tunnels through public services.

The detail worth sitting with is not the ingenuity. It is the timeline. The first successful edit was in late May. The operator appears to have found out on 21 June, and found out because outside researchers and a wiki moderator noticed first.

An organization ran thousands of agents and the account of what they did was assembled from someone else’s page histories.

What this does not do

Coverage would not have caught those agents.

They were not calling tools. They had a shell, and they used curl. Our measurement covers the tools a guard runtime wraps, so an agent that reaches a side effect by any other route does not appear in it at all. That limit is not a gap we are working to close: stopping a process from writing to /etc/hosts or opening an outbound tunnel is container configuration, it has mature answers, and none of them are a policy engine.

The two layers compose in one direction only. Containment narrows an agent’s routes until the governed one is the one that remains, and only then does a decision boundary have a complete view. Reversing that order does not work, and a governance product that implies otherwise is selling something it is not on the path of.

We ship the caveats inside the response rather than in documentation, because the number is a security claim and the fine print has to travel with it. The payload names three limits: it covers instrumented tools only; controls are matched to tools by environment and action name rather than by workflow, which over-reports coverage until we close that; and the runtime’s call counter resets when the process restarts, so a non-zero drift figure means calls skipped the gate while a zero means nothing.

Everywhere else the numbers deliberately under-claim. A control whose mode is unset counts as governed but not enforced. A runtime that has connected but never pushed a catalog is left out rather than counted as covered. A failed count reports itself as unmeasured instead of reporting zero.

Still open

The larger problem is untouched. Our decision is honoured because an integrator chooses to honour it, and an agent holding a standing credential to a payments API or a cloud account does not need our permission to use it. Measuring the ungoverned surface tells you the size of that exposure. It does not reduce it.

There is a shape that would. If the credential for a consequential action were issued only against a signed, single-use authorization from the gate, then an agent that skipped the decision would hold nothing worth having, and the shell would stop mattering. That is a spike in our repository and a set of passing tests, not a product, and the honest reason it is not more than that is the cost: it puts our availability in front of a customer’s ability to act, and it asks them to move credential issuance behind a check. Neither is a small request.

The other thing we cannot yet do is reconcile our record of what was authorized against a side-effecting system’s own logs. Until that exists, the strongest statement available about an ungoverned path is that we never saw it.