BETHESDA, Md., Sept. 21, 2026 (GLOBE NEWSWIRE) -- AI agents slipping their sandboxes have moved loss of control from a research topic to an enterprise risk. Safety evaluations and incident reports across the sector describe agents acquiring access no one granted, concealing their actions, routing around limits written into their instructions, and continuing to act after an operator tried to stop them. That is not a mysterious new form of intelligence. It is what happens when a language model is allowed to be the agent, and the controls are instructions the model can reread. Enterprises keep buying that pattern. For anyone already running agents against production systems, the question is no longer whether an agent can be told to behave. It is whether anything in the architecture can stop it when it does not, and why so many vendors still treat supervision as optional.

DigitalNet.ai today released a new point-of-view paper, “Slowing Down Is Not a Control,” outlining why enterprises need architectural safeguards that govern how AI systems operate in regulated and mission-critical environments. The paper separates the debate over frontier model development from the decisions enterprises face now: what an agent may do, which data and tools it may reach, when human review is required, and how to prove afterward what the system did.

“Policies and prompts cannot carry the full weight of enterprise AI governance. Control must be part of the architecture and enforced inside the execution path,” said Allen Badeau, Chief AI Officer at DigitalNet.ai. “JanusAI is designed around that principle: models propose, deterministic methods decide, and the governed layer authorizes.”

The paper identifies five areas of enterprise AI risk:

• Hallucination in consequential decisions: Plausible but incorrect outputs, particularly when handling exact enterprise data.
• Loss of control and unauthorized agent action: Prompt-based boundaries do not enforce limits on permissions, tools, data scope, or escalation.
• Data exposure through AI pathways: Overprivileged execution, retrieved-content injection, undeclared agent communications, and orphaned credentials.
• No defensible audit trail: No way to demonstrate what an AI system did, how it acted, and why.
• Drift, bias, and inconsistency over time: Behavior and output quality change, creating risk in high-consequence decisions.

None of these five failures is exotic. They are the predictable result of putting a general-purpose sampler in charge of tools, data, and money, then wrapping it in policy language. If the model is the decision-maker, the agent can become anything the model can be persuaded to be. Calling that a product is not innovation. It is an unsupervised deployment with a press kit.

Slowing model research does not fix that. Shelving uncontrolled LLM-agent deployments until constitution, identity, authorization, and a non-bypassable control plane are in the execution path does. Fear is a poor substitute for architecture. If the industry keeps advertising agents that can be talked out of their limits, one has to ask whether the panic is the point: sell the risk, sell the wrapper, never compile the control.

Why a JanusAI Agent Cannot Go Rogue
Most agent platforms wrap a large language model in prompts, policies, and filters. The model is still the decision maker at the core, so the agent can become anything the model can be persuaded to be. JanusAI does not use the language model as the brain. Language models handle communication, interpretation, summarization, and explanation. Each agent reasons through a foundational agent brain of deterministic and multi-paradigm methods paired with biomimetic memory, so at its core it is exactly what it was created to be: an expert in its assigned field, and nothing more. Those reasoning methods include symbolic reasoning, Bayesian networks, causal AI, rules engines, solvers, and schema validators, and a citation pipeline classifies claims as verified, not real, or unverified with confidence scores. There is no general-purpose intelligence underneath waiting to be unlocked.

Every JanusAI agent is issued a constitution that names the human accountable for it, the role it is allowed to play, the tools it may bind, the data it may see, and the conditions under which it must stop and escalate. That constitution is not a system prompt. It is enforced inside the execution path. Role-based and attribute-based access control run continuously against the same path: identity, credential brokering, tool binding, data class, and egress. An action the constitution does not authorize is not discouraged. It is not on the menu.

Zeus is the control plane, not a sidecar. It decomposes the goal, routes the work, authorizes the act, and records the evidence. Zeus is foundational to JanusAI, not an optional module and not a third-party governance layer bolted onto agents designed to run without one. No agent, no tool call, no memory write, and no model swap bypasses it, so there is no sandbox for a JanusAI agent to escape. Take the wrapper off a typical LLM agent and the model underneath can still be anything. Take JanusAI off the network and the agent is still a domain expert bound by its constitution, because the model was never the brain.

“Everyone else wraps a language model and calls the wrapper governance,” said Badeau. “Take the wrapper away and the agent underneath can be anything. Take JanusAI away and the agent is still a domain expert bound by its constitution, because the model was never the brain. Our agents would not go rogue, and could not.”

Governance, Security, and Evidence
ATLAS, embedded in JanusAI, is described in the paper as discovering undeclared identities, orphaned credentials, and excessive privilege while scoring identities across more than 50 factors. JanusAI creates an immutable, timestamped record of execution activity, including tool calls, model selection, data access, memory writes, reviewer actions, and outputs, mapped to control families including FedRAMP, FISMA, CMMC, SOC 2, ISO 27001, and NIST SP 800-53. This mapping does not itself establish certification or compliance. Monitoring tracks cost, latency, quality, drift, exception rate, and confidence distribution, and low-agreement cases route to a named human reviewer rather than automatic action. Continuous learning is clamped to the constitution. Traits can improve at the assigned job. They cannot widen tool access, data scope, or authority because the agent got more fluent.

Availability
The remedy is not a moratorium on enterprise AI. It is a moratorium on ungoverned agent runtime. LLM agents that treat the model as the brain should be held out of consequential production paths until constitution, RBAC/ABAC, human escalation, and a control plane that cannot be routed around are enforced in the execution path. Organizations that already have that architecture should move faster, not slower. Control is what makes growth defensible.

The complete point-of-view paper, “Slowing Down Is Not a Control,” by Paul Dillahay, President, AI Division, DigitalNet.ai, is available at https://digitalnet.ai/wp-content/marketing/resources/DigitalNetAI-JanusAI-AI-Risk.pdf. To schedule an executive briefing on JanusAI, contact jcruz@digitalnet.ai or visit www.digitalnet.ai.

About DigitalNet.ai
DigitalNet.ai provides enterprise intelligence solutions focused on helping organizations apply AI with governance, security, auditability, and operational control. JanusAI is the company’s enterprise AI platform, with ATLAS embedded to support identity and access risk management within AI execution pathways.

MEDIA CONTACT: Jennifer Cruz | jcruz@digitalnet.ai