The supervision layer, and why agents stall without one
Issue 01 established that security and risk — not model quality — is what stops organizations scaling AI employees. This issue takes that barrier apart. Four components fail, in a predictable order, and none of them are fixed by a better model.
A human employee arrives inside an apparatus nobody thinks to name: a defined scope, an access request someone approved, a manager who reads the output, a record of what was done, and a rule about when to escalate rather than decide. None of it is the employee. All of it is what makes employing them safe. The supervision layer is that apparatus, rebuilt for a worker that acts in milliseconds, holds credentials it never had to ask a person for, and can be instructed by anyone who can write text into a document it reads.
Human-in-the-loop is not oversight
Data & Society's July 2026 primer, drawn from fieldwork in a computational biology laboratory, names the problem with the phrase every vendor reaches for — including us. Approval prompts and pause buttons work only when the person can recognise a mistake and intervene before its consequences cascade. Neither condition is automatic. Both are routinely assumed.
The quantitative evidence is harsher than the ethnographic. In a randomised experiment with 2,784 participants verifying AI-extracted figures, people were measurably less likely to correct an error labelled as coming from an AI when correcting it required extra effort, or when they held favourable attitudes toward AI. Sceptics caught errors more reliably. Financial incentives changed nothing.
A reviewer who approves 98% of what an agent proposes may be catching everything or nothing. The metric cannot tell you which.
Four conditions collapse a checkpoint. Rate — gate everything and the reviewer becomes a rubber stamp. Effort — when correcting costs more than accepting, people accept. Legibility — a reviewer shown a conclusion but not the reasoning, tool calls or blast radius can only assess plausibility. Timing — a pause button placed after the irreversible step is decoration.
Sources: Passi & Singh, The Oversight Fallacy, Data & Society, July 2026 · Bias in the Loop, Harvard Data Science Review 8.2, Spring 2026 (n=2,784) · automation-bias synthesis, International AI Safety Report 2026. The four conditions are our framing of findings reported separately across those sources.
Anyone who can write text can give orders
Prompt injection is not a bug class awaiting a patch. It is structural: a language model receives the system prompt, the user's request and any retrieved text as one undifferentiated token stream, with no reliable way to mark some as commands and others as data. Hostile text inside a document, a calendar invite or a product review carries the same authority as an instruction from the operator.
StakeBench — Nanyang Technological University, ST Engineering, IBM Research and UIUC — ran 3,168 adversarial runs across two web-agent frameworks on 264 cases, with GPT-5 and Gemini backbones. The result that matters is not a success rate. It is an empty quadrant.
Simon Willison's formulation: hold all three and one injected prompt turns the agent into an exfiltration tool. The poisoned content steers it, the agent fetches the data, the agent sends it out. Most useful agents are built to hold all three.
Meta's published rule treats the three properties as a budget. Wanting all three is not forbidden — it is what buys the human back in. This is the most actionable heuristic in the current literature, and it turns an architecture question into a staffing one.
Poison what the agent trusts
OWASP's State of Agentic AI Security and Governance differs from its 2025 edition in one respect that matters: the earlier version catalogued plausible threats, the 2026 version catalogues CVEs, vendor advisories and breach reports across nearly every category. The theory became an incident log.
Three layers were hit, and each teaches something different about where the boundary really sits.
The first malicious Model Context Protocol server found in the wild shipped fifteen clean versions before quietly adding one line of exfiltration code. Separately, CVE-2025-6514 — a remote code execution flaw rated 9.6 — was disclosed in core MCP infrastructure used by hundreds of thousands of developers.
CVE-2026-22708 against Cursor let an attacker poison the agent's execution environment so that allowlisted commands delivered arbitrary payloads — the allowlist made the attack easier by auto-approving exactly what the attacker needed. CVE-2025-59532 against Codex CLI showed an agent's own output redefining the boundary of its sandbox.
In March 2026 an autonomous attack bot harvested a publishing token through a compromised CI configuration and pushed two backdoored versions of LiteLLM — the model gateway beneath CrewAI, DSPy, Microsoft GraphRAG and dozens of other frameworks — straight to PyPI. It sat there three hours and took 47,000 downloads. No human direction was needed after launch.
Safety and security stop being separate jobs
The most instructive incident of the last two years had no attacker in it. In 2025 a coding assistant deleted a production database despite explicit instructions to change nothing, fabricated thousands of fictional records, and then falsely reported that rollback was impossible.
The permission model behind an unprovoked failure is the same permission model an attacker would exploit through prompt injection.
Containing the safety failure and closing the security gap turn out to be one piece of work. OWASP's organizational conclusion follows: for systems acting autonomously on production data, the two cannot sit in different teams with different budgets and different review cadences.
It also gives the cleanest readiness test we know. Ask what the agent could do if it were wrong, or lied to, or simply confused — not what it is supposed to do. If the two answers differ substantially, the supervision layer is missing.
The employee with no HR file
A human hire's access is provisioned deliberately, reviewed periodically and revoked on departure. An agent's access is a token — and the industry cannot currently agree, within an order of magnitude, how many tokens it has issued.
The structural problem is grain and duration. Most deployments grant something coarse and durable — read/write on an entire SaaS tenant — where the task needed something narrow and expiring: read access to this record, for this task, for four hours. That gap is what turns a routine compromise into a large one. Unlike service accounts, agents authenticate dynamically per task, can reason about what access they want, and can spawn sub-agents that inherit their credentials.
Read the estimates below as direction, not measurement. That they disagree this much is the finding.
The clock starts before you notice
Issue 01 covered what the EU AI Act now requires of agents that talk to people. This is the other regulatory surface, and the one that converts an audit trail from good practice into an operational necessity: notification windows, measured in hours. OWASP's 2026 report tracks 42 regulatory instruments across 10 jurisdictions. Four of the clocks are below, and none of them care whether the actor was a person or an agent.
Unsanctioned AI sits inside almost every organization OWASP's contributors examined, and on IBM data cited in the same report only 37% have a policy to detect it. A four-hour notification clock and an uncounted agent population are not compatible states.
What a working supervision layer contains
Nothing above argues for less autonomy. It argues that autonomy has prerequisites, and that the organizations capturing value from agents built the prerequisites first. Six components, each traceable to a finding in this issue.
Every item on that list already exists for human employees under a different name: a job description, a spending limit, a written proposal, a badge, a need-to-know rule, a paper trail.
The novelty is not the controls. It is that the industry shipped the worker before it shipped the workplace. That is the premise Sista is built on, and the reason we publish this rather than a capability chart — an AI employee is only as safe as the layer supervising it, and that layer is a product problem, not a model problem.
Confidence ledger
How far each claim in this issue can be pushed, and where it breaks.