A camera, a lock, and a notarized logbook are three different objects

Put a camera above a door. Now something happens at that door at three in the morning.

The camera did its job perfectly. It recorded the whole thing in high definition, timestamped, from two angles. What it did not do, could never do, and was never built to do, is stop any of it. A camera narrates a burglary. That is the entire job description.

Almost everything currently sold as AI agent security is a camera.

This is not an insult. Cameras are genuinely valuable, they are usually the right first purchase, and a company with no camera has no idea what is happening. But a camera is one of three objects you need, and the other two are not versions of it. They are different things that do different work, and no amount of camera gets you either.

The three questions#

Any AI agent operating on a real system has to be able to answer three questions. They map exactly onto the three objects.

What did it do? That is the camera.

Who approved it? That is the lock.

Can you prove it? That is the notarized logbook.

If any of the three comes back silent, the agent runs on trust. And trust is a fine answer for one agent that you wrote, until the count reaches four and two of them are vendor agents you never deployed.

The camera: what did it do#

Observability. Traces, dashboards, an activity feed, discovery that finds the agents nobody registered.

Its value is real and it is the thing most companies are missing, so it is correctly the first thing most vendors build and most buyers want. It answers the question that feels most urgent, which is "what is even running here."

Its limit is structural, not a maturity gap. A camera reports. Reporting happens after. You can make the camera continuous instead of a quarterly snapshot, you can make it real time, you can put a model behind it that flags the frame. It is still a camera, and the action still happened.

The tell that you are being sold a camera as a lock: the demo shows a dashboard turning red. Ask what the agent was doing while the dashboard turned red. If the answer is "finishing," you bought a camera.

The lock: who approved it#

A decision point in front of the irreversible action. The agent asks, or the resource refuses, and either way the thing does not happen until somebody or some rule says it does.

The word "irreversible" is doing the work. Nobody wants an approval prompt in front of reading a file, and any product that puts one there gets uninstalled in a week. The lock belongs in front of the small number of actions you cannot take back: the push to main, the migration, the money, the email that leaves the building, the delete.

Two honest properties of locks that vendors tend to skip.

A lock has a failure mode, and you have to pick one. When the deciding service cannot be reached, either the action proceeds or it does not. Fail open keeps your engineers working and leaves a window where nothing is enforced. Fail closed holds the guarantee and turns a vendor's bad afternoon into your outage. Both are defensible. Not having chosen, per surface, is not.

Not all locks are the same lock. A check that lives inside the agent's own tool asks the tool to cooperate, and a tool that cannot reach the check proceeds. That is best effort, and it is bypassable by anyone who wants to bypass it. A refusal that happens at the credential or at the resource is a different object: there is no check to fail, because the key simply does not open that door. When someone says "we block that," the follow-up is where does the refusal physically happen.

The logbook: can you prove it#

A record of what was decided, that nobody can rewrite afterwards, including you.

That last clause is the whole thing, and it is the one people flinch at. A log you can edit is a log your auditor has to take on faith, and the reason it must resist you is not that anyone thinks you are dishonest. It is that a record which could have been changed proves nothing, regardless of whether it was.

Append-only in a database means "we do not offer a delete button." A hash chain means each entry commits to the one before it, so altering anything breaks verification for everything after it, visibly, forever. Those are very different guarantees and they get described with the same sentence.

Three follow-ups worth asking about any logbook:

• Does it live on your infrastructure or the vendor's, and what happens to two years of evidence the day you leave?
• Can you verify it, or only read it?
• Is it one record, or one per vendor silo? Three tools each keeping their own log is not an audit trail. It is three narratives you get to reconcile under time pressure.

Why they get collapsed#

Because "visibility and control" is two words and it sells.

The collapse is not usually a lie. It is that the camera is the part that demos beautifully, the lock is the part that is hard and politically expensive to install, and the logbook is invisible until the day it is the only thing that matters. So the demo is a camera, the deck says control, and nobody finds the gap until the gap is an incident.

The other reason is that all three genuinely feel like the same product to a buyer. They are bought by the same person, for the same reason, and they appear in the same dashboard. They are still three objects, in the way a smoke detector, a sprinkler, and a fire report are three objects that all concern fire.

The test#

One question, in any demo, ours included.

Show me the moment. Not the alert afterwards. The moment where the agent tried, and it did not happen, and tell me where that refusal physically occurred.

If the answer is a notification, it is a camera.

If the answer is a check inside the agent's own tool, it is a lock, best effort, and you should ask what happens when that check times out.

If the answer is that the credential does not open that door, that is the strongest version, and it works no matter whose agent it is or where it runs.

Then ask the second one: show me the record of that refusal, and show me how I would know if it had been edited.

A camera, a lock, and a notarized logbook. Three objects. Any vendor selling you one of them is selling something worth having. Just know which one you bought.

If you want to see all three against your own stack, that is what we do.