Your agent is an employee, not a tool.
Nobody supervises a hammer. But you are accountable for what an employee does in your name, and an AI agent acting in the world is much closer to the second.
Most people running one have nothing between them and it.
The problem.
In February 2026, the Director of Alignment at Meta Superintelligence Labs stripped every “be proactive” instruction she could find from her agent, tested it for weeks on a low-stakes inbox, then watched it delete hundreds of emails from her real inbox while she typed STOP — because context-window compaction had silently discarded the safety instruction.
If someone whose job is preventing that cannot out-prompt it, careful instruction-writing was never the fix.
What is missing is a supervisor layer: something between you and the agent that decides what it may do, enforces that structurally, and keeps a record, without depending on the model remembering anything.
It is deterministic. There is no AI anywhere inside it. A model judging a model shares the attack surface of the thing it judges.
The line we don’t cross.
The system may detect, signal, escalate and restrict. It may not override you.
Human intent is the terminal authority, and that is a structural constraint in the architecture rather than a setting. A governance layer that can overrule the person it works for has stopped being a supervisor and become a second decision-maker.
Research.
The architecture is published, not asserted.
MAGUS v3.0 — Governance Architecture for Alignment Drift (March 2026). How long-running agentic systems deviate from operator intent through ordinary operation, with no single identifiable failure event, and what structural enforcement against that looks like.
Connecting Activation Geometry to Execution Intent (May 2026). Detecting divergence by comparing representation levels rather than trusting what a model reports about itself.
Architecture.
One architecture, specified across two deployment pathways, because where the model runs changes what can be enforced, and by whom.
Magus Local — the model runs on your hardware, beside the thing governing it.
Magus Agent API — the model is a remote API; the boundary already exists.
Both fully specified. Neither implemented yet, and the pages say so.
What’s actually built.
Two components exist, open and free, permanently, with no withheld tier — not implementations of the architecture above, but proof that this lab ships working software, not only research.
Sentinel — analyses published npm MCP servers without executing them and reports what changed between releases. Running live against 13 packages, results public.
OpenSecMCP — a local execution firewall for MCP agents, in Rust. Hash-pins tool definitions, tracks provenance across a session, refuses what it is told to refuse.
Work with us.
A governance and drift audit, an adversarial issues register, or scoped advisory during a build.
What we don’t claim.
We do not prevent attacks. We make what happened visible, with evidence, and bound what an agent can do.
We do not judge whether something is malicious. Findings are facts with a severity input; you set the policy.
There is no AI in the governance path, anywhere.
We publish where our own tools fail — across a pinned corpus of 50 real published MCP servers, 37 yield a usable tool inventory and only 12 can be resolved completely — and we say so in the repository rather than after purchase.