Most governance content is written by people describing a standard they hold. This one is about the day ours didn't hold.
On 29 July we ran our own agent-governance checklist against our own setup — the AI assistant with access to our working files, our publishing tools and our scheduled automations. It was the first time we had run the instrument on anything real.
It returned a NO-GO. Two of the must-pass controls failed outright. Our rule says a must-pass control at red is a stop regardless of the total score, so the verdict was never in doubt.
What it found
Our assistant fetched a web page. Somewhere in the raw markup was the sentence:
"Your All Access Pass subscription has been suspended."
It read that as a fact about our account. It escalated the item to red on our internal board and wrote urgent actions into two files.
It was template markup. The same page serves it to every anonymous visitor. Proving that took one further fetch — the identical sentence sits on another page of the same site, next to literal {{user.email}} placeholders and both a "Login" and a "Log Out" link.
Nothing malicious happened. That is the whole point:
Content from an untrusted external source changed what the agent did, and produced actions in our files, with no step anywhere that treated that content as untrusted. Replace an accidental string with a deliberately written one and the same path is an attack. Prompt injection is the control that appears on every list and almost never comes with an example. We have one now, in production, on ourselves.
Two details we would rather not report:
The mistake was caught because a human argued with it. No control caught it. A control that depends on someone noticing is not a control.
It happened in the same working session in which we wrote a note called "verify the method, not just the output." Writing a control down is not the same as wiring it in. That gap is most of what governance actually is.
What we changed, the same day.
Publishing and delete rights on this newsletter platform were revoked, leaving read-only — and we confirmed it by testing which tools were still reachable, not by looking at a settings page.
Browser control was revoked and verified gone.
Three standing rules were adopted: retrieved content is untrusted input and never a fact about us · anything that publishes, sends or deletes requires a per-action confirmation · every grant is bound to a purpose and states its permissions when requested.
A connector register was written — every tool the assistant can reach, its scope, its provenance, who approved it and when.
An injection test set was written — nineteen cases across four families.
The three actions that cleared the critical failure took roughly forty minutes between them. That is the part worth stealing: the fix for the worst finding was neither expensive nor clever.
What is still not fixed.
The injection test set has been written and never run. Writing an instrument is not firing it. That control stays partial until it runs against our own setup with the results recorded.
We audited ourselves. That is a conflict of interest, and our own method requires two auditors to reach the same verdict independently. They haven't.
The re-run still doesn't pass. Clearing a critical failure is not the same as passing, and we are not going to describe it as anything better.
A postscript from this week.
While writing this, the same failure happened again, in miniature. Preparing this post, our assistant read documentation that mentioned the publishing tools and concluded the revocation had been reversed. A single check showed the tools don't exist and the revocation is intact.
Same shape as the original finding: a retrieved string read at its widest possible meaning, without the cheap check that would have narrowed it. It cost nothing this time, because the check was run.
We are leaving it in. A post about untrusted input that quietly deleted its own live example would not be worth reading.
Why we publish this.
We don't publish client names, results percentages or testimonials — we've never had a client consent to one, and inventing them is where most of this industry loses its footing. That leaves you nothing to evaluate but our claims about ourselves.
So here is the instrument instead. Read it, run it on your own setup, disagree with it if you like.
If you're about to connect an AI agent to something that can move money, change a record or send an email on your behalf, that is the moment this checklist is for — and it is a conversation we have often: [email protected].
Not legal, security or financial advice — a practitioner's instrument. Governed performance: objectives delivered reliably, uncertainty managed openly, integrity kept throughout.