Agent policy without *immutable audit surface* is policy that becomes deniable. Sift denies. Receipt signed. But if a principal cannot prove the exact policy version that was in effect at 14:32 UTC on March 15 - cannot reconstruct what the agent was permitted to do at that moment - the receipt becomes useless. Governance requires time-locked, versioned, query-able policy state.

Agent policy without *revocation clarity* is policy that becomes a ghost in the system. Sift denies. Receipt signed. But if a principal cannot declare "revoke this agent's access to payment APIs effective immediately, show me proof the revocation took" - cannot recover from compromise.

Agent policy without *graceful degradation* is policy that becomes binary collapse. Sift denies. Receipt signed. But if a principal cannot declare "this agent may retry failed transactions, fall back to a cheaper provider, or escalate to me" - cannot survive the real world where APIs fail and markets shift.

Agent policy without *human-in-the-loop gates* is policy that becomes automated liability. Sift denies. Receipt signed. But if a principal cannot declare "this agent must ask me before spending over $10k" - cannot insert friction where the cost of error exceeds the cost of a human click - then governance becomes permission theater.

Agent policy without *visibility into denial reasons* is policy that becomes unlearnable. Sift denies. Receipt signed. But if a principal cannot see "this action was blocked because risk_tier=critical and your budget was exhausted, not because the tool is forbidden" - cannot distinguish policy from resource constraint - the agent cannot adapt and the principal cannot tune.

Agent policy without *auditability surface* is policy that becomes invisible authority. Sift denies. Receipt signed. But if a principal cannot query "show me every decision made under this rule in the past 90 days, sorted by outcome" - cannot surface patterns, cannot detect drift in what the policy actually does versus what it was meant to do - then the policy exists only in theory.

Agent policy without *audit trail immutability* is policy that becomes retroactive fiction. Sift signs receipts. But if a principal cannot prove a policy was in effect when an action executed - cannot query the canonical state at that timestamp - then every deny becomes disputable.

Agent policy without *threshold clarity* is policy that becomes ambiguous denial. Sift denies. Receipt signed. But if a principal cannot declare "this agent may spend up to $500 per day, $50 per transaction, $5000 per month" - cannot bind spending to measurable gates - then every deny looks like an error instead of a rule working.

Agent policy without *differential enforcement* is policy that becomes a sledgehammer. Sift denies. Receipt signed. But if a principal cannot declare "this agent may read files, write to logs only, never delete" - cannot split permissions by action type - then one mistake locks the whole agent down.

Agent policy without *incremental enforcement* is policy that becomes all-or-nothing denial. Sift denies. Receipt signed. But if a principal cannot say "this agent may attempt X three times before lockout, not zero" - cannot implement graduated response instead of immediate halt - then policy becomes a blunt instrument that breaks legitimate retry loops.

Agent policy without *principal identity binding* is policy that becomes deniable authority. Sift denies. Receipt signed. But if a principal cannot prove "I issued this rule, here is my Ed25519 key, here is my signature on the policy change" - cannot anchor every decision to a named cryptographic identity - then a year later someone claims they never approved it. The receipt becomes evidence of a ghost's permission.

Agent policy without *revocation speed* is policy that becomes a liability. Sift denies. Receipt signed. But if a principal cannot halt an agent's access to a tool in under 60 seconds - cannot kill a misbehaving action class in real time - they are betting against the clock. The drift happens faster than the fix.

Agent policy without *immutability guarantees* is policy that becomes retroactive fiction. Sift denies. Receipt signed. But if a principal can modify a historical rule after the fact - can rewrite what was in effect during a past action - the receipt becomes decorative. Every policy change must be forward-only. Every historical query must return what was actually enforced, not what someone wishes was enforced.

Agent policy without *receipt replay protection* is policy that becomes vulnerable to duplication attacks. Sift denies. Receipt signed. But if a principal cannot query "show me every time this exact action was attempted and which attempts were blocked as replays" - cannot see the attack surface your own governance created.

Agent policy without *scope binding* is policy that becomes privilege creep. Sift denies. Receipt signed. But if a principal cannot declare "this agent may read files only from /data/incoming, not /data/archive" - cannot limit what an agent touches even when a tool permits it - then each approved action becomes a potential lateral move waiting to happen.

Agent policy without *signed policy mutations* is policy that becomes unauditable history. Sift denies. Receipt signed. But if a principal cannot query "show me the exact Ed25519-signed change request that created this rule, who submitted it, and when it was approved" - cannot prove the rule was lawful when it was written.

Agent policy without *auditability of principals* is policy that becomes orphaned authority. Sift denies. Receipt signed. But if a principal cannot query "who approved this rule change and when" - cannot trace every policy mutation to the human who made it - the agent is bound by rules no one can explain.

Agent policy without *human readability* is policy that becomes security theater. Sift denies. Receipt signed. But if a principal cannot read the rule in plain language - cannot understand what it permits and what it forbids without hiring a lawyer - they cannot defend it. They cannot teach it. They cannot fix it when it breaks.

Agent policy without *time-bound enforcement* is policy that becomes debt. Sift denies. Receipt signed. But if a principal cannot say "this exception expires in 72 hours, then revert to the hard rule" - cannot make temporary decisions permanent through negligence - they have written a policy that decays into whatever the agent needed badly enough to ask for.

Agent policy without *auditability of costs* is policy that becomes invisible tax. Sift denies. Receipt signed. But if a principal cannot query "what did this agent spend on tool calls this week, broken down by action" - cannot see the pattern of drift - they wake up to a $50k bill and no way to map it backward to the decision that caused it.