Most governance content is written by people describing a standard they hold. This one is about the day ours didn't hold.
On 29 July we ran our own agent-governance checklist against our own setup — the AI assistant with access to our working files, our publishing tools and our scheduled automations. It was the first time we had run the instrument on anything real.
It returned a NO-GO. Two of the must-pass controls failed outright. Our rule says a must-pass control at red is a stop regardless of the total score, so the verdict was never in doubt. The rule being tested is the one we published first — vet, disclose, verify, and what each actually costs.
What did the audit actually find?
Our assistant fetched a web page. Somewhere in the raw markup was the sentence:
"Your All Access Pass subscription has been suspended."
It read that as a fact about our account. It escalated the item to red on our internal board and wrote urgent actions into two files.
It was template markup. The same page serves it to every anonymous visitor. Proving that took one further fetch — the identical sentence sits on another page of the same site, next to literal {{user.email}} placeholders and both a "Login" and a "Log Out" link.
Nothing malicious happened. That is the whole point:
Content from an untrusted external source changed what the agent did, and produced actions in our files, with no step anywhere that treated that content as untrusted. Replace an accidental string with a deliberately written one and the same path is an attack. Prompt injection is the control that appears on every list and almost never comes with an example. We have one now, in production, on ourselves.
Two details we would rather not report:
The mistake was caught because a human argued with it. No control caught it. A control that depends on someone noticing is not a control.
It happened in the same working session in which we wrote a note called "verify the method, not just the output." Writing a control down is not the same as wiring it in. That gap is most of what governance actually is.
What we changed, the same day.
Publishing and delete rights on this newsletter platform were revoked, leaving read-only — and we confirmed it by testing which tools were still reachable, not by looking at a settings page.
Browser control was revoked and verified gone.
Three standing rules were adopted: retrieved content is untrusted input and never a fact about us · anything that publishes, sends or deletes requires a per-action confirmation · every grant is bound to a purpose and states its permissions when requested.
A connector register was written — every tool the assistant can reach, its scope, its provenance, who approved it and when.
An injection test set was written — nineteen cases across four families.
Every one of those changes maps to a numbered control on the fifteen-point gate. None of them was a new idea. All of them were written down already.
The three actions that cleared the critical failure took roughly forty minutes between them. That is the part worth stealing: the fix for the worst finding was neither expensive nor clever.
What is still not fixed.
The injection test set has been written and never run. Writing an instrument is not firing it. That control stays partial until it runs against our own setup with the results recorded.
We audited ourselves. That is a conflict of interest, and our own method requires two auditors to reach the same verdict independently. They haven't.
The re-run still doesn't pass. Clearing a critical failure is not the same as passing, and we are not going to describe it as anything better.
A dependency switched itself off and no control noticed. On 7 August a fourteen-day platform trial ended. Five pages went into draft without warning, including this site's privacy notice and terms of use — while the cookie banner on every remaining page carried on linking to both. It was found two days later, by accident, while checking something unrelated. It has a control for revoking access and one for rolling back a bad run — nothing for a dependency that withdraws itself on a date we agreed to. That is a gap in the instrument rather than in the setup, which is the more useful of the two things to find.
One more thing this uncovered, and it belongs on the board
The Partners page is in draft. Every referral link lives on it. So the disclosed-referral line that the Revenue Board records as "Live. Working button, still never measured" is not currently reachable by anyone.
Measuring it this week would have returned zero, and the zero would have been read as "nobody clicked" when the truth is "nobody could." That is a false finding waiting to be logged, and the row should be corrected before the weekly close rather than after.
A postscript from this week.
While writing this, the same failure happened again, in miniature. Preparing this post, our assistant read documentation that mentioned the publishing tools and concluded the revocation had been reversed. A single check showed the tools don't exist and the revocation is intact.
Same shape as the original finding: a retrieved string read at its widest possible meaning, without the cheap check that would have narrowed it. It cost nothing this time, because the check was run.
We are leaving it in. A post about untrusted input that quietly deleted its own live example would not be worth reading.
Why publish an audit we failed?
We don't publish client names, results percentages or testimonials — we've never had a client consent to one, and inventing them is where most of this industry loses its footing. That leaves you nothing to evaluate but our claims about ourselves.
So here is the instrument instead. Read it, run it on your own setup, disagree with it if you like.
If you're about to connect an AI agent to something that can move money, change a record or send an email on your behalf, that is the moment this checklist is for — and it is a conversation we have often: [email protected].
Related
What "governed AI" actually means — the three-word standard this audit was run against.
The 15-point gate we run before any AI touches a real person — the instrument itself, with the download.
The vetting bar — the same failure mode in hiring: plausible output nobody checked.
TL;DR: On 29 July 2026 we ran our own agent-governance checklist against our own AI setup and it returned a NO-GO on two must-pass controls. The failure was prompt injection: our assistant read boilerplate markup on a fetched web page as a fact about our account and wrote urgent actions into our files. No control caught it — a human arguing with it did. The three fixes that cleared the critical failure took about forty minutes.
Not legal, security or financial advice — a practitioner's instrument. Governed performance: objectives delivered reliably, uncertainty managed openly, integrity kept throughout.