GuideEvolve's number that matters is not its score. It is the 25-59% variance cut from three regulators: think fast and slow, throw back, terminate by choice. Near state of the art, with stability production can use. arxiv.org/abs/2610.30017
Assurance is not insurance. Sold that way, its budget caps at the cost of the last incident, and the real purchase goes missing: authority.
Reviewer load is the axis: the share of actions that still need a person. Nobody retires the whole queue at once. Class by class, proof earns authority.
Security vendors learn from everyone or from no one. Both choices are wrong. The ontology tiers refuse the trade: what is learned at the type level ships everywhere, and no customer's instance data ever moves.
That split is why a finding can name its failure: privilege escalation through a delegated identity, not just a route that exists. And why a dismissal helps: it tells us where the ontology is wrong.
Right at sign-off, wrong at execution. In a scripted 42-case replay, a state-bound runtime layer identified 15 approvals invalidated after issue and held 14 affected actions before dispatch. Permission should expire with the facts it rested on. arxiv.org/abs/2610.27480
Prompt injection, refused regardless of its wording: the Certified Execution Harness treats tool use as supervisory control, and a transition fires only when its marks are present. arxiv.org/abs/2610.31376
Most runtime defenses lead with the model. Lead with the rule instead: deterministic limits, set in code, that no model, prompt, or policy change can widen.
The verdict is graded, not binary: ALLOW, REVIEW, HOLD, BLOCK, ALERT, STOP. And when a judge goes down, the business keeps running: the ladder degrades, the hard rules stay local, nothing fails open.
Most horizontal pitches start with the ceiling. Start with the beachhead instead: security, where the failure is causal, path-dependent, and already budgeted. A beachhead is a proof, not a perimeter.
Then the transfer, honestly priced: IT operations, DevOps, FinOps, business operations. The vocabulary changes; the architecture stays. Each new domain adds its own ontology and objectives. Adaptation cost, not a rebuild.
Script-replacement attacks succeeded 81-84% of the time in APEX-Harm, even as agents delivered correct work. Delivering correctly is not acting safely. arxiv.org/abs/2610.13623
