Token Observe vs doing nothing

Three tests, and if all three hold, wait. First, can one person name every agent your organisation runs, without asking anyone. Second, is every action an agent takes reversible by the person who notices it — a draft a human sends, a suggestion a human accepts, a summary a human reads. Third, has nobody outside engineering asked you a question about them with a date attached. An estate that passes all three is being governed adequately by the fact that it is small, and the correct next step is to keep it small deliberately rather than to buy a control.

The advice that goes with waiting is cheap and worth taking: write down the list. Not in a governance tool — in whatever your team already reads. An agent, a named human owner, one sentence of purpose, and which provider it calls. That list is the thing that makes the eventual decision easy, and it is also the artefact whose absence makes the first incident expensive. Every regulatory framework that asks anything about AI systems starts by asking for an inventory, and the reason a spreadsheet eventually fails is not that it is a spreadsheet, it is that nothing enforces against it, so it is updated by whoever remembers while the runtime is updated by whoever ships.

What waiting does not buy is a free option on the past. Records that were never kept cannot be reconstructed later, and the product’s own compliance note puts the point without softening it: retrofitting logging onto agents that have been running ungoverned for a year is the expensive path. That is an argument for starting the record early, not for buying a platform early — those are different decisions, and only the second one costs money.

Token Observe governs what routes through it. Agents that never present a credential to the gateway are outside it, and the documentation puts them under what the product does not evidence rather than in a footnote. The shadow-AI radar exists for exactly that gap and is deliberately reconciliation-based — bills, network egress, service-account keys, IDE and CLI telemetry, and the deployment’s own caller and price consistency — so it tells you those agents exist if you have fed it, and chasing them down inside your organisation remains your work. Where a source has gone silent, coverage travels with every clean result, because a dead feed must never be indistinguishable from a clean estate.

Several other things stay yours after purchase, and they are listed in the support boundary rather than discovered: your infrastructure, your model providers’ incidents, the models’ behaviour, your own agents’ code, and authoring the policies themselves, which is a professional services engagement rather than support. Compliance outcomes are yours too — the mapping documents say the entries mean this feature helps evidence that clause, not installing this makes you compliant, and deciding risk tiers, running an impact assessment and notifying regulators remain the deploying organisation’s duties.

And the record has limits that are stated where the claim is made. Evidence exports are SHA-256 digest-sealed and carry the audit-chain verdict, but they are not themselves signed; durable origin evidence comes from the keyed audit chain plus an Ed25519 anchor retained off-box. The chain is tamper-evident rather than tamper-proof: what an anchor buys is that any copy you kept off-box beats any rewrite made after you took it, and key theft, pre-anchor history, collusion among all sinks, and proof of when all remain open.