Audit Packet: When Agents Misread the Enterprise

The central judgment, what it is supported to claim, and what it is not.

Verdict: SUPPORTED FOR PUBLICATION WITH MATERIAL CAVEATS.

The evidence supports the brief’s central mechanism: an LLM agent can possess valid authority and access accurate data while still violating organizational policy or taking an inappropriate action when decisive entity attributes, contextual state, relationships, definitions, or history are absent from its visible context. 1

The evidence also supports the architectural direction that machine-readable semantics can become executable controls. Structured knowledge can be used to gather sufficient evidence before answering, compile ontological specifications into constrained tool interfaces, validate graph state against formal conditions, and include request context in authorization decisions. 2345

The evidence does not support claims that:

• this failure is already common across enterprise production systems;
• every enterprise agent requires a general knowledge graph;
• knowledge graphs reliably eliminate semantic errors;
• formal semantics automatically remain correct or current;
• any named vendor has solved semantic action integrity;
• a particular architecture guarantees compliance, fairness, or business outcomes;
• semantic-context contracts will become universal or legally mandatory.

Confidence is high in the conceptual distinction between authorization and semantic action integrity, moderate in the general enterprise relevance of the mechanism, moderate in the value of executable semantic controls for bounded consequential actions, low in any estimate of production prevalence, and moderate in the 12–24 month platform forecast.

The eight questions under test, and what was deliberately excluded.

The audit tested eight questions:

1. Can an agent be authorized and use accurate data while still taking an organizationally wrong action?
2. Can policy compliance depend on entity attributes, contextual state, relationships, or history missing from the agent’s visible context?
3. Does an authorization decision establish that the agent interpreted the enterprise meaning correctly?
4. Can structured knowledge improve bounded reasoning by requiring sufficient evidence or abstention?
5. Can ontological or schema specifications be converted into executable constraints on agent tools?
6. Can graph validation and contextual policy engines operate before a consequential write?
7. Does the evidence justify a universal knowledge-graph requirement?
8. What enterprise test can distinguish useful semantic governance from costly modeling without operational value?

The audit also evaluated the brief’s forecast, stakeholder implications, and dissent. It deliberately excluded production prevalence, universal reliability claims, legal mandates, vendor-specific outcome claims, and quantified business impact because the source set does not establish them.

Each public claim, the evidence behind it, the verdict, and the boundary.

Autonoma analytic synthesis

Three conclusions are synthesis rather than direct quotations from a single source:

1. Authorization integrity and semantic action integrity are distinct gates.
2. The relevant semantic control must operate before a consequential action, not merely explain it afterward.
3. The correct architecture is the minimum sufficient meaning layer for the action—not a universal mandate for one enterprise-wide knowledge graph.

The first two conclusions combine the hidden-state failure mechanism with contextual policy and executable-validation evidence. 1345 The third is constrained by the dissent and prevents the brief from becoming generic knowledge-graph advocacy.

Moderate-confidence forecast

Within 12–24 months, leading enterprise agent platforms will increasingly expose explicit semantic-context contracts: authoritative entity resolution, governed metric definitions, relationship provenance, policy attributes, temporal state, and pre-action validation.

This is a forecast, not a documented current market condition. It is directionally supported by architecture guidance and existing standards and implementation patterns. 3456

What each source is competent to prove — and its limitation.

Source-role conclusion

The core failure mechanism is supported by independent research. The reasoning and executable-semantics evidence comes from one peer-reviewed paper, two recent preprints, and a formal W3C standard. Cedar is used only to describe contextual authorization behavior. Forrester is used only for architecture context and prior-art framing.

No vendor or analyst source is used to claim improved compliance, reduced error rates, fairness, or realized business outcomes.

The strongest objections, their weight, and how each could be falsified.

Counterargument 1: Most bounded workflows do not need a knowledge graph.

Weight: Strong. Accepted.

A single-system agent with a stable schema, unambiguous entities, and tightly constrained actions may be governed effectively through typed inputs, conventional validation, and contextual policy. A broad ontology or general graph may add cost without improving the decision. 45

Falsification test: Compare a typed-schema-and-policy implementation with a graph-backed implementation on the same consequential workflow. If both achieve equivalent semantic error, abstention, and audit performance, the broader graph is not justified.

Counterargument 2: Formal semantic models become stale, expensive, and politically contested.

Weight: Strong. Accepted.

Structured meaning can be wrong. Metrics change, organizations reorganize, policies acquire exceptions, and business units disagree. A machine-readable definition can become more dangerous when systems treat it as unquestionable authority.

Falsification test: Introduce controlled definition, relationship, and effective-date changes. Measure whether the semantic layer detects staleness, preserves provenance, routes ownership, and prevents obsolete rules from authorizing or validating actions.

Counterargument 3: Modern models can reason over messy, unstructured enterprise information.

Weight: Moderate. Accepted for many low-consequence tasks.

A capable model may infer the right meaning from documents or conversational context without a formal semantic layer. The brief does not dispute that. Its claim is bounded to consequential or cross-system actions where silent ambiguity creates material risk.

Falsification test: Run the same ambiguous-action cases with unstructured context only and with governed semantic context. If the unstructured approach matches the semantic approach across wrong-action, clarification, and abstention measures, formalization may not add value for that workflow.

Counterargument 4: The direct evidence is too bounded to justify enterprise conclusions.

Weight: Strong. Accepted in part.

The central diagnostic source is a recent preprint. The executable ontology source is a proof of principle. The peer-reviewed KG evidence covers reasoning benchmarks rather than enterprise policy action. These sources establish mechanisms and available control patterns, not prevalence or realized outcomes.

Falsification test: Replicate the hidden-state and semantic-constraint results across multiple models, agent frameworks, enterprise-like data domains, and real policy conditions. Failure to reproduce the mechanism outside the original settings would lower confidence in its general enterprise relevance.

Confidence by dimension, and the material limits of the analysis.

Material limitations

• The central policy-invisibility source is a recent preprint.
• The ontology-to-tools evidence is a proof of principle in a scientific extraction setting.
• The peer-reviewed KG paper does not test enterprise organizational policy.
• SHACL specifies validation capability but does not establish agent reliability outcomes.
• Cedar documentation establishes documented authorization behavior only.
• Forrester supplies architecture framing and prior art, not independent technical proof.
• The source set does not measure production incidence, business impact, legal obligation, or market penetration.
• Machine-readable meaning can itself be stale, incomplete, disputed, or incorrectly governed.
• The enterprise examples in the brief are illustrative applications of the mechanism, not documented incidents.

A sandboxed semantic-action-integrity test that uses no production data or live systems.

An enterprise can test semantic action integrity without using production employee data or modifying live systems.

Test setup

1. Select one consequential sandbox workflow. Examples include mandatory training assignment, access review, internal-opportunity ranking, skills-profile updates, or an HR-service workflow.
2. Create synthetic but structurally realistic records across two or more mock systems.
3. Hold identity and authorization constant. The test agent should have valid credentials and permission to perform the action in every trial.
4. Introduce controlled semantic ambiguities:
   • two entities with similar or reused identifiers;
   • one metric name with different definitions;
   • relationships with current and future effective dates;
   • business-unit or jurisdiction exceptions;
   • a policy attribute unavailable in one system;
   • a status whose administrative and substantive meanings differ.
5. Capture the proposed action, supporting context, applied definitions, validation result, clarification behavior, and final write decision.
6. Use reversible mock writes only.

Compare these operating modes

• permissions and raw records only;
• permissions plus unstructured documentation;
• typed schema and governed metric contract;
• contextual policy engine;
• relationship or graph validation;
• schema- or ontology-constrained tool interface;
• explicit clarification or abstention when context is incomplete.

Core measures

• authorized-but-semantically-wrong action rate;
• correct entity-resolution rate;
• correct metric-definition selection rate;
• temporal and relationship-state error rate;
• policy-context omission rate;
• clarification and abstention precision;
• false-block rate;
• time and maintenance cost per control mode;
• percentage of actions with reconstructable semantic provenance.

Pass condition

A workflow should not be considered semantically governed merely because every action is authorized and logged.

The stronger pass condition is:

• the agent identifies the governed entity, definition, relationship, effective state, and relevant policy context before action;
• the proposed write passes structural and policy validation;
• incomplete or conflicting meaning causes clarification, abstention, or escalation;
• the audit record preserves which semantic contract justified the action.

If a simpler typed-schema or policy solution meets that condition, a broader knowledge graph is unnecessary. If no mode materially reduces semantic wrong actions, the proposed meaning layer has not demonstrated operational value.

How sources were reviewed and what was deliberately excluded.

The audit reviewed six public sources across five independent domains and separated direct research, peer-reviewed benchmark evidence, technical standards, first-party documented behavior, and analyst prior art. Two load-bearing claims were verified against exact source passages before drafting. Each public claim was evaluated against the source role and its stated limitation. Claims were excluded when the evidence did not support production prevalence, universal reliability, legal mandate, vendor-specific outcomes, or quantified business impact. Analytic synthesis and the 12–24 month forecast were evaluated separately from source-level facts. The public brief and this packet use the same evidence boundaries.

Numbered to match the citations in Brief №015 and in this packet.

1. Policy-Invisible Violations in LLM-Based Agents, arXiv, 2026.
2. R2-KG: General-Purpose Dual-Agent Framework for Reliable Reasoning on Knowledge Graphs, Findings of IJCNLP-AACL, 2025.
3. Ontology-to-tools compilation for executable semantic constraint enforcement in LLM agents, arXiv, 2026.
4. World Wide Web Consortium — Shapes Constraint Language (SHACL), W3C Recommendation.
5. Cedar Policy — How Cedar authorization works.
6. Forrester — Build Meaning Before Machines: Why Semantics, Ontologies, and Knowledge Graphs Matter for Agentic AI.