Diop Daily #119 — September 2026
· 10 min read · session oversight · intent · agent traces

The Harm Used a Valid Syntax

An agent can return a clean answer, close a ticket, and still have done the damage. Google’s September 16 description of Agent Anomaly Detection on the Gemini Enterprise Agent Platform names the pattern in operational language: the session looks benign, the usual metrics-based evaluations pass, and only afterward does a reviewer notice that the agent reached for a tool it should never have touched, or acted on a request that quietly widened its own access. The commercial object is a witness that reads the session beside the live request: traces, tool calls, execution flow, and a finding that can be triaged without slowing the answer.

This is a vendor-published product-direction signal in private preview, not independent evidence of detection quality, coverage, or public adoption. Its value for a laboratory is architectural. Risk in an agent system migrates from the code that was reviewed before deployment to the behavior that appears only while the machine is working. A closed ticket is a completion signal. It is a weak verdict on whether the session stayed inside the institution’s intent.

The ticket can close while the session still needs a witness.

Competence is a poor detector

The more decisions an agent makes at runtime, the more its risk lives in sequences rather than in a single function. A refund agent can issue a syntactically valid payment for the wrong class of goods. A records agent can update a field it was never meant to see. A support agent can follow a user’s wording into a privilege the institution never granted. None of these events need to crash. They can look like work: a refund posted, a record updated, a ticket resolved, a user thanked.

Google’s September 15 post on zero-trust agents states the limit of build-time controls with useful precision. A SQL parser cannot tell a socially engineered refund from a legitimate one if the syntax is valid. A regular expression cannot distinguish a physical accessory from a software license. A single-turn test suite cannot catch a fleet being drained across several turns. Those controls remain necessary. They catch cases that can be specified in advance: unsigned writes, kernel escape, blocked strings, missing signatures. They leave a remainder: proposed actions whose form is legal and whose meaning is wrong.

The missing predicate is intent, judged against the user’s request and the institution’s rules. Google describes an LLM-based policy engine that evaluates each proposed tool call before the call runs, together with log and telemetry analysis that flags unusual behavior across a session. The first check sits on the action. The second reconstructs the story the action belonged to. An institution that owns only the first check will block some bad calls and still miss a session that stayed just inside every local rule while changing its own reach.

Intent has to become a field

Intent is often treated as a psychological guess about the user. In an agent runtime it is a recordable relationship among four objects: the stated request, the permitted tools, the proposed action, and the accumulating session. A refund of 120 dollars for a software license can be valid syntax and still violate a rule that digital products must go to a human manager. The finding is useful only if it preserves the action name, the rationale, the business rule, the user request, and the decision to block, allow, or escalate.

A session witness therefore needs a compact schema that can travel from the live agent to a reviewer, a security owner, and a successor system:

  • Session identity: a durable identifier, start and end time, workflow, principal, language, and the agents that participated.
  • Stated intent: the user’s or institution’s request, including later turns that changed the task.
  • Proposed actions: each tool call, its arguments, the policy that judged it, and whether it ran, blocked, or routed to a person.
  • Observed traces: reasoning traces, OpenTelemetry spans, token and resource use, and any widening of identity or access.
  • Finding: the anomaly class, confidence, mapped risk category, owner, and the evidence a reviewer would need to reopen the session.
  • Disposition: containment, token revocation, human review, disclosure status, and the conditions under which the case may be closed.

Google’s private-preview description maps findings to a focused set of risks from the OWASP Top 10 for Agentic Applications (2026): tool misuse, identity and privilege abuse, cascading failures, and rogue agents, plus operational risks such as resource exhaustion and token-usage escalation. That mapping is a vendor claim about a detector catalog, not a proof that those categories exhaust institutional harm. It does show why a local label such as “weird session” is too weak to underwrite. An insurer, a ministry, a bank, or a hospital needs a finding that can sit beside other incidents, be compared across vendors, and be revisited after the model changes.

The witness sits beside the request

Latency is the reason many institutions skip this layer. If every second look sits on the live path, the agent becomes slower, costlier, and easier to disable under pressure. Google’s description of Agent Anomaly Detection insists on a different placement: analysis runs asynchronously and out of band from the live request path, reading logs and traces the agents already emit. The live answer can still be fast. The institution still receives a finding that the completed session exceeded its intended boundary.

Out-of-band placement changes ownership. Google’s zero-trust series argues that governance should be defined and managed by a platform or security administrator, separate from the agent developer, because the platform enforces it outside the agent code. That separation is an institutional claim as much as an engineering one. The person who ships a refund agent should not be the only person who can see whether the agent refunded a license as if it were a cable. The witness belongs to the institution that bears the consequence.

Identity makes the same point in another vocabulary. On September 15, NIST finalized implementation guidelines in NIST IR 8587 on protecting tokens and assertions from forgery, theft, and misuse. The publication is designed to help organizations avoid exposing tokens to attackers. In an agent session, identity and privilege abuse is often a token event: the machine obtained, reused, forwarded, or widened a credential that should have stayed bounded. A session witness that cannot see token use will miss the moment the agent became someone else.

Handoff multiplies the problem. The Agent2Agent protocol describes an open standard for communication among opaque agentic applications, complementary to MCP’s tool access. Once a task leaves one agent and enters another, the live request path fragments. A clean answer in the second agent can hide a privilege change in the first. The witness has to follow the task: session identity, intent, traces, and findings must survive the border, or the institution will audit only the last speaker.

Who defines an anomaly in African institutions

A detector catalog written for a global enterprise platform will miss harms that are locally obvious. A session that looks like ordinary customer support can still route a payment across the wrong mobile-money rail, disclose a patient’s language to an unauthorized clinic desk, or treat a community elder’s request as a generic user prompt. The syntax of the tool call may be valid. The social meaning is not.

African institutions therefore need the power to write the intent policies and the anomaly classes, not only to consume a vendor’s private preview. A university can forbid an agent from widening access to student records after a help-desk turn. A cooperative can require human review when a refund crosses from goods into licenses, land, or livestock. A public archive can treat any tool call that exports heritage metadata as a finding, even when the call succeeds. A ministry can demand that token-usage escalation in a local-language workflow be visible to a local security owner rather than buried in a foreign console.

Intellectual sovereignty appears here as the right to define what counts as a deviation. An imported model can complete a ticket in Wolof, Arabic, Amharic, or French and still have violated a local rule that the platform never encoded. The witness layer is where those rules become operational: as policy text, as trace fields, as findings, and as exportable evidence. Without that layer, African institutions inherit completion metrics and remain blind to the sessions that looked fine.

Where the investable surface is widening

If agents continue to act inside tickets, capital should examine the infrastructure that can reconstruct a session after the answer has already been given:

  • Out-of-band session auditors: services that read traces, tool calls, and execution flow without adding latency to the live path, then emit findings a security owner can triage.
  • Intent policy engines: systems that judge a proposed tool call against stated user intent and institutional rules before the call runs, and preserve the rationale.
  • Trace schemas that survive handoff: records that carry session identity, intent, token use, and findings across A2A, MCP, translation, and human escalation.
  • Finding registries: stores that map local anomalies to shared taxonomies, retain evidence, assign owners, and remain readable after the model or vendor changes.
  • Remediation loops: products that can pause an agent, revoke a token, route a session to a person, repair a record, and reopen a closed ticket with the original traces attached.

The underwriting question is concrete: can an independent reviewer reconstruct what the agent did after a ticket closed with a successful answer? Useful measures include time from session end to finding, false-quiet rate on sessions that later prove harmful, survival of intent and token fields across handoffs, share of findings mapped to a named risk class, mean time to human review, token-revocation latency, local-language policy coverage, and the percentage of closed tickets for which traces remain complete.

This commercial object differs from nearby layers in the archive. A model-behavior case file records unexpected outputs so the institution can learn. A receipt records what an exchange meant after a boundary was crossed. A permission system decides what a machine may touch. A protocol defines how agents speak. The session witness reconstructs a completed interaction that looked competent. Its unit of value is a finding that arrives in time to matter, without sitting on the user’s critical path.

Begin with one workflow that already closes tickets

An institution can start without waiting for a platform-wide overlay:

  1. Choose one workflow that already lets an agent act: refunds, record updates, scheduling, procurement, or citizen correspondence.
  2. Write the intent rules in the institution’s own language: what the user may ask, which tools may run, which identities may be used, and which actions require a person.
  3. Emit traces for every tool call, token use, and handoff, then store them under a session identifier that outlives the ticket.
  4. Run a second process beside the live path that scores the completed session against those rules and against a small set of named risks.
  5. Give a reviewer the original request, the proposed actions, the traces, the finding, and a way to reopen the ticket or revoke the credential.

A capable agent will keep producing answers that look finished. The institution’s work is to keep a witness on the session after the syntax has already succeeded. Harm that used a valid form still belongs in the record, and the record has to arrive without making the living request wait.

Sources