Christian Johannsen

Agreed, and the run correlation point is the sharpest part of this. Right now the provenance stops at the artifact: upstream commit, hardening log, version tag, all in the OCI layer, none of it tied to the run that produced the weird output. That makes behavior drift hard to attribute. Worth flagging that effective permissions do not exist as a field yet. A skill's real reach is whatever the agent grants plus whatever the instructions talk the model into. That is a gap to close rather than data to expose. On isolation, same page. Hardening shrinks blast radius, it does not replace execution boundaries or an approval path.

Never, which is the uncomfortable version of the answer. One cleanup in week one, nothing after. The cadence question is the one I'd redirect, though. Stale sources were a retrieval bug, not a freshness bug: date filter plus an explicit allowlist, ten minutes, and the corpus could stay as messy as it liked. Scheduling refreshes would have bought trustworthy output by making the upkeep term worse, which is the thing the arithmetic was already losing to.

Good catch on the gateway line! It was overstated, and I've rewritten it. The narrower claim: the good gateways do read content, they just classify one payload at a time, and aggregation is a judgment about a set. On the identity: real control, but scoped credentials bound what an agent can reach, not what it can synthesize from what it legitimately reached. If a task needs CRM and payroll, the scoped token carries both, exactly the combination worth flagging. Cross-session accumulation also survives rotation, since retention happens in outputs and memory, not tokens. And "never had the broad scope" assumes scope is knowable before execution, which dynamic tool discovery undercuts. Identity separation shrinks the scope; aggregation control governs what's left inside it. Different layers from my perspective.