The strategic resource of the agentic era is neither the model nor the data, but the institutional capacity to declare, arbitrate, and make binding the invariants that judge trajectories.
A patient followed for a long-term condition accumulates weak signals: a delayed response to an outreach, a documented drop in adherence, a biological score in the grey zone. None of them, taken alone, crosses the clinical alert threshold. Six links then chain together, all authorized, traced, compliant. A qualification agent groups comparable files, an outreach agent writes to the patient, his silence becomes a signal, a scoring agent reclassifies the file as presumed disengagement risk, an archiving routine shifts it out of the active caseload, and the referring clinician no longer sees it. Composed result: the patient leaves active follow-up without any actor having decided to remove him.
The problem is not that an agent went off the rails. It is that no one went off the rails and the result is unacceptable. Imputing responsibility when many hands concur in a result without any one of them deciding it is the problem of many hands, which Nissenbaum placed at the head of the barriers to accountability in computerized systems (Nissenbaum, 1996, after Thompson, 1980). What is new is that the list of hands is no longer known in advance. Change the setting for a wrongly frozen bank account, a supply chain, an insurance denial: the structure holds, only the cost varies.
The dominant narrative speaks of Shadow AI: unapproved tools, data injected into a public model. The problem is real but visible, and a catalog, an access policy, and a little discipline reduce most of it. This note begins where Shadow AI ends, when all actors are legitimate and the causality of the whole no longer reconstructs. The distinction is one of level: Shadow AI is a problem of undeclared authority; composed trajectories are a problem of distributed causality.
Four competing readings reason at the link and miss the object. Governing by catalog still authorizes trajectories no one has assessed. Extending Zero Trust to AI is the most serious to set aside cleanly, because it is right within its register: it governs accesses transaction by transaction (NIST SP 800-207), it does not reconstruct the causality of a composition and knows only one gesture, allow or deny. Invoking a management failure is vague. Speaking of the consumerization of IT underestimates what the agentic adds, compositionality. If one circumvents despite the catalog, it is because the perceived risk of a composed trajectory is computable by no actor from its local position: asking the user to compute it is delegating an impossible calculation.
The AI agent is not an unprecedented category of actor, and the ontological quarrel is lost without one needing to win it. What is new is not the object, it is the regime of delegation. The three classic actors fall under a static delegation: a human answers, an application is versioned under contract, a service is bounded by its API, the delegated scope is fixed in advance and traced back to a responsible party. The agentic introduces a dynamic delegation: the scope of the act is composed at execution time, the agent chains its own decisions, invokes others, and the chain that would link each decision to a human responsibility reconstitutes poorly, sometimes no longer at all.
The objection from safety is known and just: sound policies composing a faulty result bear old names, normal accident (Perrow, 1984), organizational accident (Reason, 1997), loss of control in the sense of STAMP (Leveson, 2011). The kinship is real but displaces the problem. In a power plant, the system undergoes emergence: fixed components produce, by their coupling, a state no one foresaw. In an agentic architecture, the system fabricates itself compositions absent from its plan. Classic complex systems produce emergent states; agentic systems produce emergent trajectories. This is the responsibility gap Matthias named (2004), proper to automata whose behavior is no longer predictable by their operator.
A composed execution trajectory is an ordered set of acts linked by causal dependence and converging on a result opposable to a third party. Each link, in isolation, satisfies an existing control; it is their composition that produces the result the sum of the controls had not foreseen. The error not to commit is to confuse ordering with imputing. To reconstruct is to produce three layers, not the first alone. Lamport’s happened-before relation (1978) gives a partial order of possibility, B may have depended on A: necessary, since one does not impute along a chain one cannot order, but it imputes nothing. The structural model of Halpern and Pearl (2005) gives the actual cause, testable by intervention: the silence turned signal is an actual cause of the reclassification if, held fixed, it changes the outcome. Imputation to a named human responsibility is a third question, normative, presupposing a duty and a foreseeability, and belongs to legal causation (Hart and Honoré, 1985).
The link is governed by authorization; the trajectory is governed by reconstruction. An admission of method, on pain of overpromising: none of these layers is read, all are reconstructed, and the causal model is relative to the choice of variables, hence disputable. This does not make causality incontestable; it makes it disputable in defined terms, which is all a doctrinal note can promise.
An inexplicable trajectory has no price as long as it does not cross a third party; the day it crosses one, the price reveals itself, at the worst moment. An incident whose chain does not reconstruct mobilizes the legal, technical, and business functions for weeks with no guarantee of resolution: the cost is not the incident, it is the investigation without end. In litigation, the organization that cannot reconstruct its own trajectory sees the burden of proof turn against it; an inspection ends in a reservation as soon as traceability is missing. The cost of an inexplicable trajectory is not the product of a probability by a severity: it is an open liability, with no known bound, that the organization cannot quantify for lack of being able to reconstruct. A liability one cannot value, one cannot provision for, and what one does not provision for, one discovers when it falls due. This is the metric that moves the subject from the architecture seminar to the audit committee.
Not all emergence is suspect. An emergent composition can be creative or faulty, and without a criterion one kills the useful while believing one suppresses the harmful. Two axes separate them. Opposability: a composition is opposable if its causality reconstructs complete and within the applicable deadline; this axis is endogenous, the organization measures it alone. Alignment with declared invariants: an invariant is not a learned synonym for a rule, it is a predicate expressed in a temporal logic over the events and states of the trajectory, evaluated by a runtime monitor. The declared invariant is the specification, the compiled monitor is its execution, and it is this bridge that distinguishes it from a principle. Most desirable invariants are safety properties monitored over execution prefixes (Alpern and Schneider, 1985); but the decisive invariant of the opening case is a bounded response, whose violation is the non-occurrence of a required event before a deadline and is detected only by an active timer, never by a log. There is the formal reason, no longer merely narrative, for event sourcing’s blindness to silence.
Four quadrants result. Q1, aligned and opposable, the creative and governable composition, a target to grow. Q2, aligned but not opposable, the zone of non-certification to re-instrument. Q3, not aligned but opposable, faulty and identified, one sanctions and corrects the policy. Q4, neither aligned nor opposable, the worst case, and any architecture that makes it possible must be held faulty by design.
Read as shares, these quadrants are a photograph, and a trajectory moves. The grid is governed as a flow: Q2 migrates toward Q1 by instrumentation, Q3 toward Q1 by policy correction, Q4 must die out. The true metrics are three velocities: the absorption velocity from Q2 to Q1, the correction velocity from Q3 to Q1, the mean residence time in Q4. Three maneuvers follow. Institute the trajectory as an object of policy distinct from the transaction, with an identifier, an owner, a lifecycle. Instrument causal reconstruction as a technical primitive and not only as a legal requirement, for a legal requirement that is not instrumented is not a guarantee, it is an exposure. Reverse the repressive logic: grow Q1 and drive Q4 to zero rather than reduce the volume of emergences. The metaphor is not the Red Queen but the vacant niche: generative AI occupies functions no control had ever populated, faster than controls can instrument them. The gesture is to substitute before redirecting, replacing the improvised trajectory with an equivalent hardened workflow, in the manner of the AI Workflow Store proposed by Geambasu et al. (arXiv 2605.10907 v2, 12 May 2026), cited as a research horizon and not as off-the-shelf infrastructure.
The quadrant presupposes declared invariants, and someone must declare them. Writing the invariant is not the difficulty: the predicates each fit on one line, any architect would produce them in an afternoon. The difficulty is to designate the one whose formulation makes law. The same invariant, “no account closure results from the absence signal alone,” protects the customer if written by the regulator, protects the bank if written by its risk committee, and binds no one if written by the model’s vendor in its terms of use. The text is identical; the authority that posits it changes everything. Five claimants, five real legitimacies, and no body to arbitrate.
One must resist the geometric facility that would make legitimacy a third axis. It would be an error of theory: opposability and alignment judge a trajectory, legitimacy judges the authority that wrote the alignment axis. It is not one more dimension in the same space, it is a question about the origin of one of the axes. And even “who holds the pen” is not the terminal question. Organizations know how to produce rules; what is lacking is the arbitration when they contradict each other and the authority to revise them when the field belies them. The strategic resource is neither ownership of the models, nor of the data, nor even the right to trace: it is the institutional capacity to declare, arbitrate, and revise the invariants against which every trajectory will be judged.
Sovereignty over invariants splits in two. There is de jure sovereignty, the recognized right to declare and revise the rule, and de facto sovereignty, the effective power to make it binding. The two do not always lodge in the same place. The invariant “no patient leaves active follow-up without a traced validation” may well be written by a legitimate authority, but it is worth only what the monitor that executes it is worth, and that monitor runs on the infrastructure of the patient-record vendor, not on the regulator’s. Declaring the invariant is a right; enforcing it is a power. The force of a rule does not pass through the moment it is written, but through the control points where it becomes effective, implementation, price, usage, what Lessig named in a single stroke, code is law (Lessig, 1999). The capture of normative power is the moment when de facto sovereignty migrates away from de jure sovereignty, when the invariant that actually applies is no longer the one a legitimate authority chose, but the one the implementer encodes, the insurer prices, or the dominant model makes the only practicable one.
This note reads the law, it does not write it: the AI Act poses the requirement of responsibility chains between providers and deployers (article 25 in particular) without delivering its operational translation for composed agentic systems. The thesis is falsifiable. If a correctly instrumented organization detects and corrects its problematic compositions within the obligation deadline that binds it, with a trajectory-incident rate below one percent per month, then this note merely restates available knowledge and it is wrong. The refutation protocol is explicit: take N real agentic trajectories, measure for each whether the chain reconstructs complete and within the applicable deadline, with and then without the instrumentation described, and compare. Until this protocol is run, the dispute stays doctrinal. Trajectory governance is not the enemy of agentic innovation: it is its condition of durability.
Doctrinal notes and explorations on AI in regulated systems. Once or twice a month. One-click unsubscribe.