The silent drift problem

Agent behavior does not fail loudly. It drifts — a rephrased instruction here, a skipped verification there — until the output no longer resembles what the owner approved.

The failure is invisible by design

Procedural fixes assume the drift is visible. It isn't. Each individual step looks reasonable. The problem is cumulative and quiet, which is exactly why a human skimming outputs will miss it and a checklist will pass it.

The only reliable observer

The only reliable observer is the person with authority to stop the line. Not because they are smarter than the model, but because they hold the one thing the model cannot: the mandate to say no and have it stick.

The chip is the record

That is what the flip is for. The status chip is not decoration; it is the record of a human decision. When you can point at a published row and name who approved it and when, drift stops being a mystery and becomes an audit.