The Linux kernel asked for the model’s name on every AI-assisted commit in January, cut it to the word LLM in August, and removed the tag in October. The human sign-off line next to it never moved. A provenance field lasts as long as something fails without it.
English Wikipedia lets software edit its pages on three conditions: its own account, a person named on that account’s page, and an approval for each task. The site can read all three. An agent pipeline’s audit line, actor and model ID, is readable only by the people who run the pipeline, and the site it wrote to is the reader with no copy.
The safe way to rename a column keeps the old name alive as an alias until the last consumer moves. For a reader that binds to names, the alias is a second column with the stale meaning, and the rename isn’t done until the step most shops never schedule.
A model vendor’s deprecation page puts a retirement date on every model it serves, with about sixty days between the notice and the day requests start failing. An approval bound to a hash of the spec voids itself when the spec changes and never hears about the executor changing.
Dry-run is the default in the operational layer I built around an unattended coding agent, and I’ve been reading more into that flag than it can deliver. A dry run is faithful up to the first side effect the agent reads the result of. After that it’s a run through a world the agent made up.
Last month’s GxP post ended on an open question about agent-written changes swamping per-change assurance. Manufacturing hit that wall a hundred years ago and wrote down its answer, and the answer has an entry fee agent pipelines can’t pay yet.
The agent pitch prices a change by what it costs to produce. A validated GxP system never priced changes that way, and the regulated world already renegotiated the real price once, before agents showed up.
The pitch for autonomous coding is a multiplier on how fast you write code. But writing was never the part a human has to stand behind, and the part they do stand behind got no cheaper, and probably got worse.
When an agent generates a query from the schema alone, it binds to the column name, not the steward’s definition. A misleading name used to be a nuisance a new hire tripped over once. Now it’s a hazard that ships the wrong number every run.
The whole agent-reliability project is trying to engineer the one thing a tool can’t have: accountability. Data governance already named this. The agent is a custodian, and we keep trying to promote it to owner.