A declared footprint is a prospectus. The kernel is the audited financial statement — and the two rarely reconcile by 2am on a Tuesday.
Why Estate Legibility Matters Now
The first move every serious citizen-development program makes is to catalog the estate. When an employee ships a vibe-coded app or a Copilot agent, a watermark captures it at publish time: who built it, what data sources it declared, what its access footprint is supposed to be. That catalog is genuinely valuable — it turns raw app velocity into a legible asset you can reason about, consolidate, and bill against. Without it, you are running a book with no position ledger.
But legibility is not control. A declared footprint is a self-report — it is what the builder said the agent would touch, frozen at the moment of publish. It is a prospectus, not a fill. The gap between what an instrument is marketed to do and what it actually does under live conditions is the oldest source of loss on any desk, and agents are no exception.
| Estate legibility metric | What the catalog captures | What it cannot capture |
|---|---|---|
| Declared data sources | ~90% of intended connections | Runtime egress the builder never declared |
| Access footprint at publish | Point-in-time snapshot | Drift three sprints later |
| Ownership | Builder + business unit | Whether the agent still behaves as owned |
The reframe is simple: the watermark tells you what an agent should touch. Only the kernel tells you what it did.
Declared Footprint vs. Kernel Ground Truth
Treat the two layers the way you would treat a trade ticket versus the clearinghouse record. One is an intention; the other is what settled. Both matter, but you would never mark your book off the ticket alone.
| Dimension | Watermark / declared footprint | Kernel ground truth |
|---|---|---|
| Source of data | Builder self-report at publish | Process, file, and network syscalls at runtime |
| Time horizon | Point-in-time snapshot | Continuous, live |
| Answers the question | “What is this agent for?” | “What did this agent do?” |
| Failure mode | Silently goes stale | None — it is the event itself |
| Primary use | Reuse, cost, consolidation | Risk, enforcement, evidence |
| Analogy | Prospectus | Audited statement |
Neither layer is optional, and neither substitutes for the other. A catalog with no kernel check is a book marked to model. Kernel telemetry with no catalog is a tape with no names attached — you see the fills but you cannot attribute them to a strategy. The value is in the reconciliation.
The Drift Between Declared and Actual
Here is the failure mode that catalogs alone cannot see. An agent is published on Monday with a clean, narrow declared footprint. Over the next three sprints the builder wires in one more connector, points it at a shared drive “just for testing,” and adds a scheduled run. None of that updates the watermark, because the watermark was captured once, at publish. The declared footprint says the agent touches two sanctioned sources. The kernel says it opened a labeled-sensitive file at 2:14am and made egress to a domain nobody registered.
The recurring drift patterns we see in the signature pipeline:
- Scope creep post-publish — the agent accretes connectors and permissions the catalog never re-captured.
- Off-hours behavior — scheduled or unattended runs touching data no human would approve interactively.
- Copy-and-widen — a low-risk app cloned into a higher-blast-radius context, inheriting a stale, reassuring watermark.
- Silent connector substitution — a declared “internal API” quietly repointed to a broader data source.
Each one is a small position. Individually they look benign. In aggregate they are uncorrelated tail risk — a portfolio of self-reported footprints that no longer marks to the disk.
Scoring the Reconciliation Gap
You do not need a philosophy to manage this; you need a number. Treat the divergence between declared and actual as a measurable exposure and size your governance to it, the way you size margin to volatility.
Reconciliation Risk = (Footprint Drift × Data Sensitivity) + (Off-Hours Activity × Reversibility)
| Factor | Low (1) | High (5) |
|---|---|---|
| Footprint drift | Actual matches declared | Actual touches undeclared sources |
| Data sensitivity | Public / synthetic | Labeled, regulated, NPI/PHI |
| Off-hours activity | Interactive, attended | Scheduled, unattended |
| Reversibility | Read-only | Irreversible writes / egress |
An agent scoring high on drift and sensitivity is not a catalog entry that needs a refresh — it is a position that has moved against you and needs to be marked now. The score tells you where to point enforcement first, instead of enforcing everywhere and lighting the fleet on fire.
What This Requires Architecturally
The catalog and the kernel are complementary control points, not competing products. This is a co-sell, not an overlap. Watermark the estate for reuse and cost; enforce at the endpoint for risk. The reason the catalog stays honest is precisely that something below it is checking it against the disk.
| Control point | Layer | What it delivers | What it is not |
|---|---|---|---|
| Watermark / catalog | Publish-time metadata | Legibility, reuse, cost attribution | Not enforcement — it is a self-report |
| Kernel ground truth | OS runtime | Proof of what an agent actually did | Not a substitute for estate legibility |
| Reconciliation | Both, correlated | Drift detection: declared vs. actual | Not a dashboard you screenshot |
| Copy-on-write containment | Kernel | Let the agent run; contain what it touches | Not block-on-deny productivity tax |
The distinction that matters most: a declared footprint is inferred and can be stripped, edited, or left to rot. Kernel evidence — process, file, label, action, verdict — is the event itself. One is attestation; the other is proof. When the auditor, the board, or your own incident review asks “what did this agent actually touch,” a screenshot of a catalog is an assertion. A kernel artifact is evidence.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Inventory the declared footprints in your citizen-dev / agent catalog | Baseline of what each agent claims to touch | Low — the data already exists |
| 2 | Turn on kernel ground truth on the dev estate | What each agent actually touches at runtime | Low — agentless-first, then endpoint |
| 3 | Reconcile the two and rank by the risk score above | A ranked drift report, worst offenders first | Medium |
| 4 | Enforce copy-on-write containment on the top decile | Contained high-drift agents, productivity intact | Medium |
The sequence matters. Legibility ships first because the catalog already exists. Kernel proof ships next because it is the layer that makes the catalog trustworthy. Enforcement is targeted, not universal — you contain the agents whose realized behavior has diverged from their prospectus, and you leave the rest alone.
The Bottom Line
A catalog tells you what your agents are supposed to do; only the kernel tells you what they did, and the gap between the two is where the loss lives. Legibility and enforcement are two layers, not one — the watermark makes the estate readable, kernel ground truth makes it provable, and reconciliation between them is the actual control. Buy both. Catalog the estate for reuse and cost; enforce at the endpoint for risk. The prospectus is not the fill, and no board has ever accepted “we marked it to the ticket” as an answer.
If your team is sizing agent governance for the coming budget cycle, request a working session. We will walk through your environment, reconcile your declared agent footprints against kernel ground truth on a sample of your dev estate, and scope a deployment. Ninety minutes, and you will see exactly where your catalog and your disk disagree.