When Agents Misread the Enterprise

Enterprise agent governance has concentrated on identity, access, and authorization: identify the agent, limit its tools, approve the action, and preserve an audit trail. Those controls answer an essential question—may this agent act? They do not answer a different question—does the agent correctly understand what the enterprise means?

An agent can read accurate records, authenticate successfully, and remain within its assigned permissions while still taking the wrong action. The failure can begin with an unresolved entity, a metric whose definition differs across systems, a relationship whose effective date has changed, or a policy condition that exists outside the agent’s visible context. Recent research describes policy violations that become invisible to an agent when relevant entity attributes, contextual state, or session history are missing. 1

This is not ordinary hallucination. The underlying data may be current and the action may be permitted. The agent is wrong because the meaning required to interpret the data is absent, ambiguous, or not enforceable at runtime.

For consequential agents, semantic infrastructure therefore becomes an action-time governance control. That infrastructure does not have to be a universal enterprise knowledge graph. It may be a governed entity registry, typed schema, metric contract, relationship model, policy engine, temporal rule, or validation layer. The control requirement is narrower: before an agent changes a consequential system, the organization must make the minimum necessary meaning machine-readable—and require the agent to clarify, abstain, or fail closed when that meaning is incomplete.

1. Valid authority does not establish semantic correctness. An authorization system can determine whether a principal may perform an action on a resource in a given context. It cannot guarantee that the agent has identified the right entity, applied the right metric definition, understood the relevant relationship, or recognized the policy state that makes the action appropriate. 15
2. Semantic ambiguity becomes a governance failure when it reaches the action boundary. Missing context is tolerable during low-consequence exploration. It is not tolerable when an agent is about to change access, assign training, update a talent profile, trigger a workflow, rank an opportunity, or write to a system of record.
3. The most useful semantic controls are executable. Structured evidence, constraints, and ontology-aligned tool interfaces can limit which actions are available, validate graph or record state, and encourage clarification or abstention when evidence is insufficient. 234
4. A full knowledge graph is not a universal requirement. Many bounded workflows can be governed with typed schemas, policy attributes, metric contracts, and pre-action validation. The appropriate design is the minimum sufficient meaning layer for the consequence and ambiguity of the action—not the largest possible semantic model.

Permission is not understanding.

Most access-control systems are deliberately narrow. They ask whether a principal may take an action on a resource under stated conditions. Cedar, for example, frames authorization around the principal, action, resource, and context of a request. 5 That is the right abstraction for permission. It is not a complete model of organizational meaning.

Consider a hypothetical learning agent authorized to assign mandatory training. The roster is accurate, the employee exists, and the agent has permission to create an enrollment. But the system may not expose that the employee is on temporary assignment, that the compliance requirement belongs to a different legal entity, or that the role change becomes effective next month. The write is authorized. The assignment is still wrong.

The same pattern appears across enterprise decisions:

• “Headcount” can mean active employees, paid workers, budgeted positions, or employees plus contractors.
• A person identifier can refer to a worker, account, candidate, beneficiary, or historical record.
• A manager relationship can be current, proposed, delegated, or effective only within a specific process.
• “Completed” can mean attendance, assessment submission, verified proficiency, or administrative closure.
• A policy can depend on geography, employment class, business unit, effective date, exception status, or purpose.

None of these problems requires fabricated data. The agent can retrieve the correct field and still apply the wrong organizational interpretation.

Recent diagnostic research makes the hidden-state mechanism explicit: policy compliance can depend on entity attributes, contextual state, or session history that is absent from the agent’s visible context. 1 The direct evidence is bounded and does not establish how common this failure is in production. It does establish why permissions alone cannot close it.

Autonoma Intelligence’s synthesis is that enterprise governance needs two separate gates:

1. Authorization integrity: Is this agent permitted to attempt the action?
2. Semantic action integrity: Does the agent possess and correctly apply the meaning required to make this action appropriate?

An action should not proceed merely because the first gate passes.

Meaning becomes an executable control.

Enterprise semantics often live in documentation, analyst knowledge, data dictionaries, architecture diagrams, and meetings. Those resources can help people interpret systems. They do not automatically constrain an agent at the moment of action.

The stronger pattern is executable meaning.

The W3C Shapes Constraint Language provides a standard way to validate RDF graphs against stated conditions. 4 Cedar demonstrates how policy decisions can incorporate principal, action, resource, and request context. 5 Recent research has also explored compiling ontological specifications into tool interfaces that agents must use, turning semantic structure into a constraint on execution rather than a reference document consulted afterward. 3

Independent benchmark research on knowledge-graph reasoning adds a complementary control: an agent should generate an answer only after it has collected sufficient evidence, rather than forcing a confident conclusion from an incomplete graph. 2 The study does not prove enterprise policy compliance or business outcomes. It supports a narrower design principle—structured grounding can be coupled to evidence sufficiency and abstention.

Together, these mechanisms suggest a practical semantic action contract for consequential agents:

• Entity resolution: Which exact person, role, business unit, product, policy, metric, or record is involved?
• Definition binding: Which governed definition applies to each metric and status?
• Relationship provenance: What relationship connects the entities, who asserted it, and for what purpose?
• Temporal validity: When did the state become effective, and is it still current for this action?
• Policy attributes: Which jurisdiction, class, exception, purpose, and risk conditions affect the decision?
• Pre-action validation: Does the proposed write satisfy structural and policy constraints?
• Uncertainty behavior: Must the agent clarify, abstain, or escalate when the contract cannot be satisfied?

The contract does not need to expose the entire enterprise ontology to every model call. It should supply the smallest authoritative context required for the proposed action and preserve the provenance needed to audit that interpretation later.

This moves semantic governance from a data-management aspiration into the control plane. The question is no longer whether the organization has a glossary or knowledge graph. It is whether the agent is prevented from acting when the decisive meaning is missing.

The semantic contract moves into the runtime.

The near-term market signal will not necessarily be a product labeled “enterprise semantic governance.” It will appear as operational features:

• governed entity and metric APIs;
• schema-aligned tool interfaces;
• request-time policy attributes;
• provenance-aware relationship services;
• graph or record validation before writes;
• explicit clarification and abstention states;
• audit traces showing which definition and context justified the action.

Forrester has already argued that agents without explicit context can misinterpret joins, metrics, and relationships. 6 Standards and implementation patterns show that parts of the remedy already exist. 345 The missing step is packaging those capabilities as a routine runtime dependency for consequential agents.

Moderate-confidence forecast: Within 12–24 months, leading enterprise agent platforms will increasingly expose explicit semantic-context contracts: authoritative entity resolution, metric definitions, relationship provenance, policy attributes, and pre-action validation.

This is a directional forecast, not a claim about current market penetration. Timing and adoption remain uncertain, and many platforms may implement the control through schemas or policy services rather than a general knowledge graph.

The enterprise design test is straightforward: can an agent prove which meaning it applied before it mutates a consequential system? If the answer is no, the organization has authorized an action without governing its interpretation.

Watch for these externally observable signals:

1. Agent platforms expose governed entity and metric-definition services at runtime.
2. Policy decisions bind principal, action, resource, entity relationships, temporal state, and request context.
3. Tool interfaces are generated or constrained from approved schemas, ontologies, or business contracts.
4. Agents explicitly clarify or abstain when evidence or semantic context is insufficient.
5. Organizations validate graph, schema, relationship, or policy state before consequential writes.

Weight: Strong. The strongest counterargument is that many enterprise workflows do not need a general ontology or knowledge graph. That is correct.

A tightly bounded agent working with one system, one stable schema, and one unambiguous action may be governed adequately through typed inputs, conventional validation, and a policy engine. Modern models can also reason successfully over messy documents in many low-consequence tasks. Building a broad semantic layer can add cost, delay, and organizational complexity without improving the decision.

Formal semantic models create their own risks. Definitions become stale. Business units disagree. Relationships change faster than governance processes. A machine-readable model can acquire false authority simply because it is structured.

The appropriate response is therefore not a universal knowledge-graph mandate. It is proportional semantic governance:

• apply the control to consequential or cross-system actions;
• encode only the meaning needed for the decision;
• attach provenance and temporal validity;
• make ownership explicit;
• test whether the structure reduces wrong actions;
• require the agent to abstain when the semantic contract cannot be satisfied.

The brief’s claim fails for a system that can demonstrate that its consequential actions are semantically unambiguous, correctly validated, and safely bounded without a broader meaning layer. That is a legitimate architecture, not an exception to be dismissed.

The most dangerous enterprise agent may not be unauthorized. It may be authorized, confident, and wrong about what the organization means.

That is why the next control plane cannot stop at identity and permission. Before an agent changes the enterprise, it should be able to answer: Which entity? Which definition? Which relationship? Which effective state? Which policy context?

When those answers are unavailable, “do not act yet” is not model weakness. It is governance working.