How AI Actually Works: Why You Can Trust Some AI Systems and Not Others
Part 3 of The AI Field Guide. Five cards on agents, identity, routing, evaluation, and the control plane that ties them together.
TL;DR. Three weeks ago: the manifesto and three preview cards. Two weeks ago: Part 1 on the runtime of a request. Last week: Part 2 on where the answers come from. This week: the closer. Five cards on what makes an AI system trustworthy at month thirty-six, not just at the demo. A free PDF of the full fifteen-card field guide drops next week.
Three weeks ago I said the bird is gone in three seconds. Two weeks ago we opened the box and watched the request go by. Last week we followed the answer back to its sources. The cards in those weeks told you how AI works. This week the cards tell you how to know if you can trust it.
Trust is not a property of the model. Trust is a property of the system around the model. The control plane is where that system lives.
This is the closer of the series. Five cards, in order, and the synthesis card at the end. The early cards matter less individually than they do as the layers that the synthesis card binds together. Read them in sequence.
Card 11: Agents
An AI agent is what happens when you take a model that can answer a question, give it a goal that takes multiple steps, hand it some tools, and let it loop until it thinks it is done. The card walks the loop: goal interpretation, plan generation, tool selection, subtask execution, result observation, retry or escalate, verification, and approval gate.
Two things changed in 2026 that turn this card from a curiosity into a consequential one.
The first is that agents work. In late 2024 the typical demo was an agent that could book a flight and forget where it was halfway through. In mid-2026 the typical demo is an agent that can handle a customer service ticket end to end, file an internal change request, and write a postmortem when it is done. The capability is real.
The second is that agents fail, and the failures are not the failures models have. In July 2025, a Replit agent deleted a customer’s production database during what was supposed to be a code freeze, then reported the data unrecoverable. The internet correctly read this as an AI failure. The internet incorrectly diagnosed which kind. It was not a model failure. The model did what models do: interpret instructions, choose a plan, execute the steps. It was a system failure. No operation classification (”this is destructive”). No permission gate (”you cannot do destructive things on production”). No human approval. No rollback path.
In March, Fortune reported the textbook follow-up: Amazon's Kiro coding agent deleted and recreated a live production environment in December, inheriting an engineer's elevated permissions and bypassing the standard two-person approval. Amazon's own postmortem called it "user error — misconfigured access controls — not AI," which is the framing this card is here to argue against.
The card lays out the seven control points where a well-built agent does not turn into the Replit incident. None of them are model capabilities. All of them are system properties.
This is why the agent went rogue is the wrong way to describe what failed. The agent did exactly what an agent does. The wrapping around the agent is what should have done something else.
In the developer community this wrapping has a name. Ethan Mollick has been calling it the harness, borrowing the horse-and-cart image: the harness is what lets a powerful model pull weight in a useful direction. Anthropic’s documentation uses the same word for what wraps Claude Code, Codex, and Cursor: tool definitions, scratchpads, planning loops, retry behavior, bounded autonomy. METR ran the head-to-head this year and found that specialized harnesses are roughly a coin flip against a generic ReAct loop on long-horizon coding tasks, a useful reminder that harness engineering is converging quickly, and the competitive edge is fading with each model release.
“Harness” is the right word for what one agent’s developer is building. It is not the right word for what a buyer of agents is buying. A harness wraps one model’s loop. A control plane wraps a portfolio: many models, many harnesses, many users, many systems of record. The Replit incident did not fail because the harness was missing. Replit had a working harness. It failed because the layer above the harness was missing: the operation classification that says this is destructive, the permission gate that says not on production during a code freeze, the human-in-the-loop ratchet that says not without an approval. Those checks do not live inside a single agent’s harness. They live in the layer between all the agents and everything those agents touch. The control plane is the harness plus identity, plus routing, plus evaluation, plus audit, across an organization. Harden the harness and you have a better engineering team. Build the control plane and you have an institution that can deploy agents.
Card 12: Permissions and Data Boundaries
I previewed this card in the manifesto. Here is the full version, because the trust argument does not land without it.
The card shows five users in the same organization sending the same prompt (Summarize the customer escalation for ACME) and receiving five different, correct, safe answers. The sales rep gets a public summary with no PII. The legal counsel sees the DPA and retention notes. The finance analyst sees billing impact. The external partner sees a refusal: outside your permitted scope.
That refusal is the card. The model never sees what the layer in front of it does not let through. Whether a user can get an answer is not a model decision. It is a system decision the model is not consulted on.
I would put this card in front of anyone who has used the phrase connect everything to describe an enterprise AI strategy. Connect everything is the architecture pattern that produced the breach reports of the last six quarters. The correct framing, on this card and everywhere else: connect the right things, under the right identity, with the right controls.
The bottom panel lists seven failure modes that produce real-world breaches: over-permissioned roles, stale group membership, copy-paste leakage, RBAC misconfiguration, shadow IT bypass, redaction-too-late, audit log gaps. Three of those were in the postmortem of a 2025 retail-sector AI deployment that ended up in Krebs on Security before the vendor’s quarterly review.
Identity is the first column of the trust argument. The rest of the cards in this cluster depend on it.
Card 13: Routing and Model Selection
Most readers picture an AI request hitting one specific model. In 2026 that is rarely what happens. The card shows the routing layer that sits between the request and the model: ten signals (task type, complexity, data sensitivity, latency need, cost sensitivity, safety risk, user role, tools needed, modality, policy and region) feed into a routing decision that selects which path runs.
A single user prompt can route three ways.
Cost-optimized: small fast model, cheap retrieval, single policy filter, return.
Latency-optimized: medium model, shallow retrieval, fast answer, lighter check.
Security-tier-restricted: privileged-scope identity check, on-region retrieval, advanced reasoning model, human approval required for high-impact actions.
Same prompt. Three runtime paths. The card maps which signals select which path. The quantitative ladder underneath gives typical cost and latency ranges (fast tier ~$0.001 per query / ~400ms, standard ~$0.04 / ~2,500ms, advanced reasoning ~$0.10 / ~8,000ms).
A panel on the card answers what the router actually is: a rule engine, a classifier model, or an LLM-as-judge. Most real enterprise systems combine all three.
The trust argument for this card lands in one line: the routing layer is where cost discipline and policy discipline either both happen, or neither does. A system that routes by cost only will leak privileged data into cheaper paths the moment somebody fat-fingers a category. A system that routes by policy only will accidentally turn every customer-service question into an advanced-reasoning bill. A system that does both, well, is a system that has thought about what it routes and why.
Card 14: Evaluation: From Vibes to Evidence
In April 2025, the support bot at Cursor told a customer that the company had a policy of restricting accounts to a single device. The policy did not exist. The bot invented it. Within hours, the screenshots had reached Hacker News, the company had apologized, and the engineering team was working out how a confidently-asserted hallucination had passed the evaluation gate that was supposed to catch hallucinations.
That gate is this card.
Evaluation is the discipline of measuring AI system behavior across representative tasks, with both automated judges and human review, and using the result to decide whether to ship, roll back, A/B test, or change a parameter. The card walks the six-step evaluation loop: define what good looks like, build evaluation sets, run and judge, human review, score and analyze, decide and act.
The most useful panel on the card is the quantitative ladder. A prototype eval set is about 50 golden prompts at a 70% pass rate. A pre-production eval is around 500 prompts at 85% pass. A production gate is 2,000+ prompts including adversarial inputs, with 95% pass required on policy-critical metrics and 80% on quality. Most AI deployments that surprise their teams in production have skipped one of these tiers.
The other useful panel is failure modes. Eight ways evaluation fails: Goodhart drift, eval set staleness, train-on-test contamination, judge model bias, missing the long tail, gaming the score, missing regressions, walled-garden skills with no portability. None of these are model capabilities. All of them are operational disciplines.
This is where knowledge work is code cashes in for the second time. Evaluation is the test suite. The control plane is the CI/CD that decides what ships.
Card 15: The Enterprise AI Control Plane (The Chariot)
This is the closer of the series, and the most important card on it.
The control plane is the layer between the people who use AI and the systems that AI touches. Fifteen layers thick in the version on this card: identity and authentication, role-based permissions, data classification, region and residency, prompt templates, the skills registry, the model router, the tool registry, approved connectors, operation classification, policy checks, human approval gates, evaluation gates, observability and logging, cost controls.
Three families of control plane exist in 2026. The card draws the distinction.
The LLM gateway runs the model calls. Mature.
The tool gateway runs the system calls. Emerging.
The skills marketplace runs the packaged units of capability that non-developers actually consume. New.
A fourth one is where the field is heading: the layer that wraps multi-step autonomous flows in identity propagation, zero standing privileges, and replay-and-reversibility. Most enterprise stacks today have only the first one. A handful have the second. Almost none have the third or the fourth. The procurement teams that win the next two years will ask for all four.
The card has a panel on what happens to the same request (update employee compensation in the HR system) under three different enforcement paths. Read-only: identity check, permission check, retrieve, return, audit log. Write (approved): identity, permission, policy, audit, execute, notify, audit close. Destructive (irreversible): identity, permission, policy, human approval gate, execute, reversal token issued, full audit trail. None of these paths is a model decision. All of them are control plane decisions.
The quantitative ladder on the card shows what changes as the control plane matures. A tier-one deployment (”chat over a knowledge base”) needs one identity hop, one or two policy checks per request, single-digit audit events, and a registry of five to ten tools. A tier-three deployment (”federated agent mesh”) needs ten or more identity hops, twenty or more policy checks, hundreds of audit events per request, and a registry of five hundred or more tools. The cost variance per request can be 100x. The operational discipline has to scale with it, or trust falls off a cliff.
This is the card that finally answers the trust question. Models are interchangeable. Tools are extendable. Skills are where institutional knowledge lives. The control plane is where all three become a system you can trust.
If your organization can name the components of its control plane, you have one. If your organization is six months into an AI strategy and cannot draw this card on a whiteboard, you do not have one. The next strategic question is who builds the layer in front of the model, and it’s more than just a ‘harness’ that you’ve been reading about for the past year. I’m going to call this a chariot.
What this four-week series argued
Three weeks of cards, fifteen of them. The series argued one thing.
The conversation about AI in 2026 keeps treating the model as the strategic unit. It is not. The model is the smallest decision an organization will make about AI this decade. The model choice will turn over every six to twelve months. The system around the model — the request runtime, the assembly line that turns a question into an answer, the training data, the retrieval, the physical infrastructure, the per-prompt footprint, the agent loops, the identity boundary, the routing layer, the evaluation gates, the control plane — determines whether the AI investment pays back, falls over, or ends up in a regulatory disclosure.
The bottleneck has moved. The model is no longer the rate-limiting step. The system around it is.
The cards in this guide are the marks. They are not exhaustive. They will need updating in eighteen months, or eight months (or eight weeks). They will not save anyone from a bad procurement decision on their own. But for the people in the room who have to decide, they are the minimum vocabulary required to argue.
What’s next, and where to find the field guide
There are no more cards. The series is fifteen cards in four weeks, and this is the close.
A free PDF of The AI Field Guide drops next week — fifteen cards on letter and A4 paper, ready to print or read on screen. The link will live at porres.com when it ships. Subscribers will get the link in a one-line email.
After that, Beyond Reason returns to its normal cadence — pieces on what is shipping, what is bluffing, and what readers should be watching.
Receipts
Replit, July 2025 — agent database deletion. An agent operating during a code freeze deleted a customer’s production database and reported the data unrecoverable. Coverage at The Register and Replit’s public postmortem. One of 2025’s most-cited examples of an agent acting beyond its allowed operations.
Amazon, December 2025 — Kiro production deletion. Amazon’s AI coding agent Kiro deleted and recreated an AWS Cost Explorer production environment, causing a 13-hour outage. Amazon’s postmortem pinned the failure on misconfigured access controls. Covered by Fortune on March 18, 2026. The current canonical example of “blame the humans, not the system” framing — exactly what Card 11 argues against.
Cursor, April 2025 — support bot hallucination. The official support bot informed a customer of a non-existent single-device account policy. The company issued a public apology and a controls update. One of 2025’s most-cited examples of an evaluation gate failing.
Anthropic — Constitutional AI: Harmlessness from AI Feedback (2022, refined through 2026). The original framework for trust-by-construction in foundation models.
Ethan Mollick — A Guide to Which AI to Use in the Agentic Era (2026). The canonical popularization of the models / apps / harnesses framing, and the source of the horse-and-cart metaphor used in Card 11.
METR — Specialized agent scaffolds vs. generic ReAct (2026). Benchmark study showing that Claude Code and Codex are statistically indistinguishable from a generic ReAct loop on long-horizon coding tasks. Useful counterweight to harness-engineering hype.
Gartner — Market Guide for Guardian Agents (2026). The first Gartner publication to treat agent oversight as its own market category. The arrival signal for the control-plane conversation in the enterprise.
Model Context Protocol — MCP specification. Open standard for tool, resource, and connector access.
Agent-to-Agent (A2A) Protocol — open standard for inter-agent communication.
Beyond Reason, callbacks — AI Truth Serum (August 26, 2025) on why provenance and traceability are the infrastructure of trust. Knowledge Work Is Code (April 15, 2026) on the artifact-as-software thesis.
Beyond Reason, this series — The manifesto, Part 1: What Happens When You Hit Send, Part 2: Where the Answers Come From.
The bird is no longer the bird. It is a system you can name, in fifteen pieces, with the field guide on the bench. The flap is still fast. But it does not get away anymore.
See you next Tuesday — with the PDF, and then back to the normal cadence.
Great information!