The Model Can Act; Can Anyone Audit It?

The agentic enterprise has discovered a familiar truth: once software can take actions, it needs more than a tasteful chat interface and a venture-backed noun. It needs permissions, observability, failure containment, and someone responsible when the tool call goes sideways. Fortinet’s acquisition of Virtue AI is a useful market signal precisely because it is so unromantic: the security perimeter now includes prompts, models, agents, MCP tools, API calls, and the infrastructure beneath them. Fortinet’s purchase is aimed at red-teaming, discovery, runtime monitoring, validation, and guardrails across that mess.

That is not merely an opportunity for the vendors who have rebranded the firewall as an AI assurance platform. It is an admission that the architecture has changed. A conventional application usually has a relatively legible set of code paths and identities. An agent can ingest an instruction, retrieve context, select a tool, generate parameters, and act through someone else’s API—all while confidently narrating its own innocence. Virtue AI says it tests agents in more than 50 sandboxed environments and scans MCP tools and source code; whether those claims survive real deployments is unknown, but the threat model is recognizably real.

The saner response is not to bolt an agent onto every workflow and then buy a second agent to watch it. As George Bezerra argues, deterministic logic remains appropriate for stable rules and execution, ML for calibrated prediction and routing, and LLMs for work such as explanation. The industry’s recurring design error is treating a model’s ability to produce a plausible sentence as evidence that it should own a business process. Those are not adjacent skills. They are barely acquaintances.

The useful enterprise architecture, then, is less a sovereign agent than a supervised assembly line: typed interfaces, constrained tools, deterministic policy checks, observable state, and an LLM assigned to the parts where language is actually the problem. Security is not the department that arrives after the demo; it is the design review asking why the demo had production credentials in the first place.

The cleanest technical argument against indiscriminate agentification is not philosophical. It is that the older tools have objectives. A recommender trained on clicks, saves, and abandonment signals is optimized for engagement prediction; an LLM trained to continue text is not, simply by wearing a lanyard that says personalization. Bezerra recounts resisting precisely that substitution under board pressure, and later describes an agent replacement that brought higher latency, unreliable output, missing confidence scores, and punishing token consumption. The account is opinion and anecdotal, but it will sound less like heresy to anyone who has had to operate the result.

The moderation example is the more instructive pattern. Use ML probabilities to route work because calibration matters; use the LLM to explain the decision because humans need reasons, not merely scores. This is a division of labour, not a turf war between the 2017 stack and the 2026 stack. Similarly, for enterprise queries, a semantic layer plus a deterministic backend can retrieve the intended metric without asking a stochastic text generator to reinvent SQL—and perhaps the company’s revenue definition—on every request.

The benchmarks around GPT-5.6 Sol make this distinction sharper, not weaker. OpenRouter’s model page presents a million-token context window, strong coding and agentic benchmark rankings, and heavy usage from coding and agent applications. It also reports meaningful differences by provider in latency, throughput, availability, and tool-call errors. The fastest route is not automatically the most reliable one; a provider’s stronger result on one displayed benchmark can coincide with a weaker result on another. Benchmark shopping has evolved into cloud procurement, which is at least an honest improvement over tarot.

For CTOs, the implication is mundane and therefore expensive to ignore: evaluate the system, not the model card. Measure task success, calibrated escalation, latency tails, tool-call failures, repeatability, and cost under your traffic mix. A temporary input-token discount is not a unit-economics strategy. Nor is a 1M-token context window a substitute for deciding what information the model should be allowed to see.

The industry likes to describe data as the new oil, a metaphor that has aged badly enough to qualify as a spill. Spirit Airlines’ liquidation offers the more accurate version: data is an asset that can be auctioned after the company has ceased to be an institution. Google won a $10 million auction for a purportedly deidentified trove including 100 million emails, 500 million Microsoft Teams items, 17 million OneDrive files, more than 30 million recorded customer-service calls, and operational records spanning flights, crew pairings, fuel slips, and parts purchases. The Register’s report says Google reportedly intends to use it to improve AI services.

The filing reportedly describes the material as deidentified, and Google promised to scrub personally identifiable information it finds. Those are meaningful controls, but they are descriptions of a process, not a demonstrated outcome. The supplied reporting provides no detail on the deidentification method, audit regime, or how that promise will be enforced. At this scale, the harder question is not whether a data field contains an obvious name. It is whether the corpus retains enough relational texture—communications, timing, transactions, operational context—to make identity or sensitive circumstance recoverable in combination.

This is where the AI supply chain’s favourite abstraction fails. Training data is often discussed as if it were inert feedstock, like gravel delivered to a model factory. But customer-service calls and workplace messages are records of people navigating disruptions, debts, complaints, schedules, and ordinary life. Liquidation may transfer the database’s ownership; it does not magically simplify the ethics of its subsequent use. Deidentification can be necessary. It should not be treated as a ceremonial incantation that turns a human archive into a bag of neutral tokens.

The technical lesson is also a governance lesson: provenance must remain attached to capability. Teams buying, licensing, or ingesting large corpora need to know not only whether they are legally permitted to process them, but what was stripped, what remains linkable, what purposes are authorized, and how downstream models can be tested for memorization or disclosure. The exciting part of AI is apparently making knowledge useful. The grown-up part is remembering where the knowledge came from.

There is one domain where talk of frictionless intelligence should be met with immediate suspicion: military targeting. In an Opinio Juris analysis, Sarah Shoker and Jessica Dorsey argue that AI-enabled decision-support systems—not just fully autonomous weapons—can compress the time available for human judgment under international humanitarian law. Their concern is not that a model has become sentient. It is that a sociotechnical system of data, interfaces, operators, command structure, and tempo can turn a nominal human check into an ergonomic gesture.

The authors cite reporting that some Israeli soldiers in the recent Israel-Hamas conflict had 20 seconds to validate a target from a list of 37,000, and that the United States credited AI systems with generating roughly 1,000 targets a day in Iran. They also note that public evidence that AI systematically reduces civilian casualties remains poor and contested. These operational claims and casualty figures are reported through sources discussed by the authors, not independently established in their article; that uncertainty is precisely why the demand for verification cannot be answered with a dashboard screenshot.

What applies in enterprise engineering applies with infinitely higher stakes here: evaluate the whole system in context, before deployment, and test the failure modes that the workflow creates. The authors call for independent oversight, context-specific pre-deployment assessment, lifecycle governance, and enough transparency for states to show compliance with duties of distinction, precaution, and proportionality. The Department of Defense has described legal and safety practices as “operational risks…not simply bureaucratic inconveniences.” That formulation is correct, though it carries the air of someone discovering that the seatbelt is also an operational risk to the windshield.

The connective tissue across this issue is therefore not that every model is dangerous. It is that capability without accountable boundaries becomes an organizational accelerant: more tool calls, more data ingestion, more targets, more decisions per hour, and less time to establish whether the system was entitled to act. The mature question is not whether an LLM can be placed in the loop. It is whether the loop still contains judgment, evidence, and a real ability to stop.