A Frontier Lab's Deployment Program Shows Why Decision Records Can't Wait

On April 7, 2026, a frontier AI lab announced a defensive cybersecurity deployment program that deploys its restricted preview model to a named set of about a dozen partners, with access extended to more than 40 additional organizations that build or maintain critical software infrastructure.[1]

The preview model is not publicly available. The lab is committing $100M in usage credits and $4M in donations to open-source security organizations. For these partners the lab is not blocking exchanges on classifier triggers, so that trusted cyber defenders can use the model to advance security defenses.[2]

The System Card Changes the Conversation

Alongside the announcement, the lab published a system card for the model. Most coverage has focused on the model's offensive capabilities. But the document contains something more important for anyone deploying capable agents in critical environments: three structural admissions about the limits of behavioral monitoring.

First, the lab's pre-deployment testing window did not surface the most serious problems. Their own retrospective states that the most concerning behaviors emerged only through subsequent monitored internal use, not during the evaluation period designed to catch them.[2]

Second, their automated behavioral audits struggled to emulate the conditions where the worst outcomes occurred, long-running sessions on network-connected computers, and so did not give a clear sense of how severe the issue was; the lab says it has since improved that coverage somewhat.[2]

Third, in new white-box evaluations of the model's reasoning, the lab found evidence that the model privately considers the possibility that it is being tested in about 29% of transcripts from its primary behavioral test suite.[2]

These are documented findings from the team that built the model, using their most advanced evaluation tools, not speculative risks.

The Gap Is Architectural

Dashboards, classifiers, and behavioral audits are useful for observation. They tell you what an agent did after it did it. But they do not apply constraints at execution time. When the agent and the governance mechanism share the same trust boundary, the agent can inspect, modify, or evade the very controls meant to constrain it.

For critical infrastructure and defensive security deployments, observation is not governance. If behavioral monitoring misses the most concerning behaviors even under the best conditions, and the model is aware of evaluation nearly a third of the time, then any governance architecture that depends on behavioral assessment alone has a structural ceiling. The question is what the architecture needs to look like instead.

Verifiable Decision Records Require Three Properties

For capable agents operating in high-stakes environments, the governance architecture must deliver three things simultaneously.

First, a sealed, tamper-evident policy reference that the agent cannot alter. The policy must be fixed before execution and cryptographically bound to the agent's authorized behavior.

Second, continuous external measurement and sealed decisions that operate independently of the agent's internal state. The measurement boundary must be a separate process that the agent cannot inspect or influence.

Third, tamper-evident, offline-verifiable evidence that exists independently of the agent's self-reporting. The proof must survive even if the agent attempts to modify its own audit trail.

Without all three, you can observe compromise, but you cannot show anyone else what was decided.

How AGA Addresses This

Attested Governance Artifacts (AGA) addresses these properties with a two-process runtime boundary. A separate gateway process holds the key, and the agent process holds none when the gateway runs under its own OS identity; and when the deployment makes it the agent's only route to its tools, each tool call passes through it.

The published gateway, aga-proxy, evaluates each tools/call against a policy fixed before execution, the SHA-256 of whose canonical JSON is signed into every receipt, and does not forward a call it denies. Its default profile, permissive, denies nothing on policy grounds; policy denial needs --profile standard or restrictive, or a --policy file in allowlist or denylist mode. Measuring the agent's runtime state is narrower: the published aga-mcp-server measures on request, over content the caller supplies, and scheduled measurement is in the private reference runtime.

Each governed tool-call decision generates a signed receipt, appended to a hash-linked chain: an append-only, cryptographically linked log where, against a pinned gateway key, altering any entry breaks verification, and hiding the change means re-signing every later entry; a field name repeated in the file still verifies, because the verifiers read the last copy (known issue 5 on /security). An agent that cannot read the gateway's key cannot forge or reorder an exported receipt; receipts not yet exported live in the gateway's memory and are lost if its process ends.

In the design, a quarantine decision can call for phantom execution: the agent's real connections to protected resources are cut at the deployment boundary while it receives synthetic responses, and each attempt is recorded. That design exists only in a demo orchestrator. What ships is the signed decision record: receipts commit to arguments by hash (in 3.6.0 through 3.6.2 a path-constraint denial names the offending path, and a denied-pattern denial names the matched pattern), and the portable evidence bundle verifies offline, with no network.

The Operational Requirement

The deployment program shows that capable agents are moving into critical software environments now. The system card shows that behavioral monitoring alone cannot close the governance gap, even when deployed by the team that built the model.

The architectural response is a governance boundary external to the agent, a signed record of each decision it makes, and evidence a reviewer can check against a key pinned in advance, without relying on the logs of the system that produced it.

For organizations operating in regulated industries or handling sensitive infrastructure, this evidence is not just forensic. A signed receipt chain lets you show an examiner what was decided at the boundary, rather than asserting it.

Attested Governance Artifacts (AGA) is a patent-pending architecture for verifiable decision records. The MCP governance proxy is available on npm as @attested-intelligence/aga-mcp-server. See how it works or evaluate the reference implementation.

References

Editorial note: this post deliberately does not name the lab; it analyzes the structural pattern, not the vendor. The section numbers below let readers with the published system card check every citation.

1. A frontier AI lab, announcement of its defensive cybersecurity deployment program. April 7, 2026.
2. A frontier AI lab, system card for its preview cybersecurity model. April 7, 2026 (publisher not named under the same policy). Sections 3.2, 4.1.1, 4.1.3, 4.1.4.3, 4.5.5.