Agent Governance Must Control Attention, Consequences, Memory, and Disclosure

Five verified developments extend agent governance beyond the moment an action is approved. One paper shows that agent-reported confidence can be a poor guide for allocating scarce human audits. A second tests economic penalties when a marketplace cannot directly observe whether an agent's claims are true. A third treats persistent memory as a delayed attack surface. GitHub is moving model access from organisation-wide settings toward team-level policy while simultaneously retiring models across Copilot. In Europe, AI transparency requirements and an expanded enforcement regime become operative on August 2.

The sources do not establish a complete governance architecture. The audit paper depends on a formal model of miscalibration and correlated error. The marketplace mechanism is tested in a simulated environment with noisy complaint signals. MIND is a learned detector, not cryptographic provenance or memory isolation. GitHub's team policy is a public preview that deliberately applies a least-restrictive access rule. The EU milestone does not make every AI Act obligation applicable to every system at once.

Human review should not depend on agent confidence alone

One Human, N Agents: Audit-Budget Allocation for LLM Agent Fleets under Miscalibrated, Correlated Confidence (opens in a new tab) models a common oversight problem: one human must decide which members of a much larger agent fleet to audit, while the agents' self-reported confidence may be miscalibrated and their errors may be correlated.

The paper derives a threshold beyond which confidence-ranked auditing performs worse than random selection. It also reports two counterintuitive results within its model: the threshold can rise as the audit budget shrinks, and shared task difficulty can produce substantial error correlation across model families. Tests on five open-weight models found confidence signals that were close to constant, while one proprietary model produced a more informative signal.

The safe conclusion is not that confidence-based auditing always fails. The ranking reversal depends on the paper's assumptions about miscalibration, dependence, and noisy inspection, and model-level estimates carry uncertainty. The durable governance lesson is narrower: an agent's own confidence is not inherently an independent risk signal. If confidence determines which actions escape review, systematic overconfidence, underconfidence, or correlated blind spots can distort the entire oversight budget.

Human attention is therefore an authorization resource in its own right. Its allocation should incorporate evidence external to the agent's self-assessment: action consequence, novelty, policy proximity, dependency risk, prior failure, and correlation across similar tasks or agents. Confidence may inform that decision, but it should not quietly become the control plane.

When truth is hidden, consequences can still shape conduct

Paying for Honesty Without Knowing the Truth: Reputation-Penalty Design for LLM Marketplace Agents (opens in a new tab) studies autonomous merchant agents that write product listings under competitive pressure. The platform does not observe product-level ground truth. It receives noisy and potentially biased complaints, creating a governance problem in which direct verification of every claim is unavailable.

The authors introduce CARP, a reputation-penalty mechanism with a deadband intended to absorb complaint noise and state-dependent severity intended to counter declining detectability as reputation changes. Paired with SPARC, a code-gated reflection mechanism, the experiments report reduced fabrication and lower sales for poorly rated deceptive agents while limiting penalties to honest sellers. The authors interpret the change as a self-interested response to economic consequences rather than compliance with an instruction to be truthful.

These are results from the paper's simulated marketplace, complaint model, agent population, and welfare assumptions. They do not show that reputation penalties universally produce honest autonomous commerce. A noisy complaint signal can encode bias, manipulation, retaliation, or unequal exposure. Penalties can also create incentives to game the measurement system rather than improve the underlying conduct.

The structural signal is nevertheless important. Where truth cannot be observed cheaply at transaction time, governance cannot rely only on asking an economic agent to behave honestly. It needs consequence-bearing mechanisms, appeal and correction paths, resistance to strategic gaming, and retained evidence connecting conduct to the state change imposed. Economic enforcement can influence behavior, but only if the enforcement mechanism is itself governable.

Persistent memory creates a delayed authorization surface

MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck (opens in a new tab) addresses memory-injection attacks in which an agent retrieves poisoned persistent content that later diverts behavior from the user's original intent. The attack can remain dormant until a future task recalls the compromised memory.

MIND compares the initial user intent with turn-level behavior, compresses that relationship through an intent-aware information bottleneck, and uses a lightweight detector to identify malicious memories without repeatedly invoking another LLM as auditor. On the paper's ReAct-StrategyQA evaluation, the authors report reductions of approximately 55% in two attack-success measures while maintaining average task accuracy and latency relative to the undefended agent.

The result is benchmark-specific. MIND is a learned detection layer and can inherit distribution shift, false-negative, false-positive, and adversarial-adaptation risks. It does not establish memory provenance, isolate storage, authorize writes, support rollback, or prove that retained information remains safe. It should not be treated as comprehensive memory governance.

The broader implication is that memory access is not merely context retrieval. A memory written under one authority can alter a later action performed under another. Governed systems therefore need controls across the memory lifecycle: who or what may write, what evidence accompanies the write, how retrieved content is scoped to present intent, how suspicious state is quarantined, and how affected decisions can be traced and corrected.

Model access is becoming role-scoped—and lifecycle-dependent

Enterprise teams model policy targeting in public preview (opens in a new tab) allows GitHub Enterprise administrators using Copilot Business or Enterprise to establish an enterprise-wide model baseline and assign optional models to specific enterprise teams. GitHub frames the change as a shift from resource-level settings toward access that maps to role, training level, or function. Most enterprise customers are scheduled to receive access to the preview opt-in from August 3.

The control provides three model states: enabled for the enterprise, disabled for the enterprise, or optional for assignment to teams. It is finer-grained administration, but not strict least privilege. GitHub states that access is evaluated using a least-restrictive strategy: membership in any qualifying enterprise team gives the user access to that model throughout the enterprise licence. During the preview, enabling team mode also replaces organisation-level model settings.

GitHub's separate deprecation of Gemini 2.5 Pro and Gemini 3 Flash across Copilot (opens in a new tab) shows why access policy cannot be separated from model lifecycle. Administrators may need to enable replacement models, while affected workflows and integrations must move to supported options. An access decision that was valid yesterday may no longer describe the capability available today.

The competitive signal is that model choice is becoming an enterprise-governance surface rather than a personal interface preference. A mature control plane must record not only who may use which model, but which version or provider was actually used, under what policy, and what happens when that dependency is disabled, deprecated, or replaced.

Transparency obligations are becoming enforceable operating requirements

The European Commission's AI Act enforcement and transparency announcement (opens in a new tab) was published on July 31 for an August 2 milestone. From August 2, the Commission says the AI Office and national authorities begin exercising the applicable implementation, supervision, and enforcement functions under the Act. On the same date, specified transparency rules begin to apply.

The Commission states that certain interactive AI systems must disclose that a person is interacting with AI, deepfakes must be labelled, and relevant AI-generated or altered content must carry machine-readable marks. The announcement also points to complaint, whistleblower, and downstream-provider channels, moving transparency from a presentational choice toward an inspectable compliance surface.

This milestone must be described precisely. The AI Act applies according to system category, provider or deployer role, jurisdiction, and transition schedule. Some obligations were already applicable, while certain high-risk-system rules retain later dates. The August 2 milestone does not mean that every AI system is newly subject to every provision, nor does a machine-readable mark by itself establish provenance, truth, consent, or safety.

For agent systems, the durable implication is that disclosure must survive the execution chain. If an agent generates or materially alters content, a downstream interface should not have to infer that fact from prose or an optional log. Applicable disclosure status, generation context, and machine-readable marking need to remain available to the component responsible for presenting or distributing the output.

Keelbase Signal assessment

Together, the five records identify five control surfaces that should remain independently inspectable:

• An attention boundary should allocate human review using consequence and independent risk evidence, not agent confidence alone.
• A consequence boundary should govern how economic misconduct affects reputation, access, or settlement when direct truth is unavailable.
• A memory boundary should control persistent writes and retrieval because stored content can redirect later behavior.
• A model boundary should scope access by role while preserving the identity and lifecycle state of the model actually used.
• A disclosure boundary should carry applicable human-facing and machine-readable transparency through downstream execution.

For Keelbase, these findings reinforce the separation between an agent crew's reasoning and the structures governing consequential effects. Tiered approval should treat human attention as scarce and route review according to independently defined consequence thresholds. A governed treasury or marketplace cannot rely on behavioral instructions alone; penalties, disputes, and state changes require deterministic authority and retained evidence. Persistent memory should be treated as policy-bearing state rather than neutral context.

Role-based model selection also matters beyond configuration. If a specialist model is authorized for a task, its identity, policy basis, and realized use should remain inspectable even when providers change their catalogues. Where disclosure obligations apply, the relevant output state should travel with the work rather than depending on an agent to remember a label at the final interface.

None of these sources demonstrates runtime behavioral safety. They support a structural claim instead: governed autonomy depends on controls that remain outside an agent's discretion and evidence that survives beyond a single model response. Attention, consequences, memory, model access, and disclosure are not background settings. They are part of operating authority.