The Agent Didn't Guess. It Checked.¶

Somewhere in the middle of a playbook run last night, on a live production deployment, a step returned this: 41 nodes and 96 edges downstream, including two production-planning flows.

No model wrote that sentence. Nobody had to decide whether to believe it. A deterministic simulator — a separately built model holding the real dependency graph of a real system — computed it, signed it, and handed it to the next step. The AI steps on either side of that moment then had to reason from the number instead of around it. That's the whole mechanic, it ran end to end for the first time last night, and I think it's the most important small thing we've shipped this year.

What's real here, and what's not

The mechanism, the run, and the research below are real. The client is not named — every client-specific identifier in this post (company, industry, integration IDs, counts, graph sizes) is invented or altered to protect a customer under confidentiality. The numbers preserve the shape of the story, not the facts of any real organization.

From guessing to checking: the fact lane and the judgment lane, the deterministic simulator, the signed ledger, and why a 0.92 confidence score isn't a key to the door

A question with a computable answer¶

The setting: a large migration. The client — call them Havstad, a coastal seafood-logistics cooperative — is moving a two-decade-old on-premise ERP to its vendor's cloud successor. The ERP itself is the easy part. The hard part is the roughly six hundred integrations that grew up around it over twenty years, each of which has to be assessed and slotted into one of five migration waves before anything moves.

An agentic playbook on Sunstone Atlas Canvas does the assessing: read the catalog entry, classify what the integration talks to and how, work out what breaks if it moves early, propose a wave. Most of that is research-and-judgment work that an LLM accelerates well. But buried in the middle is one question that is not like the others:

What is actually downstream of this thing, and how far does the damage travel if we get the order wrong?

Until last night, the playbook answered that question the way every agent answers it: the model read a catalog description and estimated. And here's the thing about that estimate — it might be right. It might even be usually right. But it's unfalsifiable in the moment, because the model is reasoning about a description of the dependency graph, not the graph. The gap between those two is exactly where confident-sounding wrong answers live. Meanwhile, the question has a computable answer: somewhere there is a real graph of what depends on what, and "what's transitively downstream of node X" is not a matter of opinion.

So we stopped asking the model. We built the graph into a simulator — about 950 nodes and 2,600 edges, constructed independently from the organization's real integration catalog — and gave the playbook a step that queries it.

A two-decade migration hinges on one un-guessable question: what is actually downstream of this integration, and how far does the damage travel if we get the order wrong

The run¶

Here's last night's run, for one real integration, compressed into the events it left on the ledger:

run-initiated           wave-assessment · HAV-311 orders-sync

judgment-decision       classify dependency type → synchronous, order-flow
                        (model proposal, confidence 0.92)
escalation-raised       held — this decision type requires a human, at any confidence
human-approval          approved

deterministic-decision  blast_radius(HAV-311) → 41 nodes, 96 edges downstream,
                        2 production-planning flows affected. Hub: no. Impact: high.
                        (simulator query — completed, no approval required)

judgment-decision       assess blast radius → HIGH, do not move before dependents
                        (model proposal, confidence 0.92 — grounded in the query above)
escalation-raised       held · human-approval → approved

judgment-decision       propose migration wave → late wave, after its dependents
escalation-raised       held · human-approval → approved

run-completed           every event above individually Ed25519-signed, replayable

Anatomy of a breakthrough run on a live production deployment: the classification and assessment steps each held at 0.92 confidence, and the deterministic graph query — 41 nodes and 96 edges downstream — executed and signed with no hold at all

Two things in that trace deserve a slow look.

The judgment steps were held at 0.92 confidence. The classification step proposed its answer at 0.92 and was held for a human anyway — and so was the assessment step, at the same 0.92. That's not a threshold being missed. There is no confidence threshold that would have let those steps through, because on this platform the gate isn't "how sure is the model" — it's "what kind of decision is this, and what authority tier does that kind require." A wave-sequencing judgment on a live logistics estate requires a human signature. Full stop. The model's confidence score is information for the human, never a key to the door.

The simulator step wasn't held at all. It completed the moment the answer came back, with no human in the loop — not because it was trusted more, but because it isn't a judgment. A deterministic query against a system that actually knows the answer is not a decision anyone needs to bless; it's the input a decision gets made from. Asking a human to approve "41 nodes" would be asking them to approve arithmetic.

That asymmetry — judgments gated by decision type, facts flowing freely, both signed onto the same ledger — is the design. The human oversight didn't get weaker when the automatic step arrived. It got concentrated where the actual judgment happens.

Computation is not persuasion¶

The obvious objection: why not just prompt the model to be careful? Give it the catalog, tell it to enumerate dependencies methodically, ask it to cite its reasoning?

Because "be careful and cite your sources" doesn't give the model a source — it gives it permission to sound careful. A simulator is different in kind, not in degree. The query either returns real, reproducible data or the step fails closed and the run stops. There is nothing to tune, because there is nothing to be confident about: the number is what the number is, and anyone can re-run the query and get the same one.

And the payoff isn't the number itself — it's what every step downstream of it inherits. Before last night, the wave decision at the end of the run rested on a chain shaped like guess → judgment about the guess → decision built on the judgment. Compounding estimates. After last night, the same chain reads computed fact → judgment about the fact → decision built on the judgment. The LLM steps didn't get smarter. Their foundations did.

The pattern is not about dependency graphs. Swap "blast radius" for whatever your domain's version of "what happens if we do this" is — expected load, financial exposure, physical clearance, chemical interaction — and the move is the same: before the agent reasons about a consequence, make it check the consequence against something that actually models it. As a step in the workflow that fails closed, not as a sentence in the prompt.

Shifting from compounding errors to a verified foundation: before, guess feeds judgment feeds decision; last night, a computed fact feeds judgment feeds decision

One evening's search of the field¶

The same night, we went looking for who else has shipped this combination. It was a good month to ask: Microsoft's Agent 365 went GA in May, Salesforce shipped Agentforce Operations in April, and Snowflake announced its Cortex AI Gateway at Black Hat two weeks ago. Each covers real pieces of the governed-agent problem — fleet observability, centralized policy, agent audit trails. On the research side, two June arXiv papers, Proof-Carrying Agent Actions and Proof of Execution, are the closest conceptual neighbors; they even coin the term enforceability classes for the idea that different kinds of agent decisions deserve different kinds of enforcement — which is precisely the asymmetry in the run trace above.

What one evening's search did not turn up is a shipped system with the specific combination that ran last night: real tool execution against a deterministic model of the domain, inside the reasoning loop; authority gating differentiated by decision type rather than by confidence score; and both kinds of step — computed fact and model judgment — landing as signed events on one unified, replayable ledger. The vendors govern agents from the outside. The papers describe the classes but don't build the mechanic. That's a report of one night's search in August 2026, not a claim about everything that exists — someone may well have built it quietly. But the field's center of gravity is visibly elsewhere.

What one run proves, and what it doesn't¶

It proves the mechanism. One real integration went end to end: the simulator returned computed data mid-run, the judgment steps reasoned over it instead of guessing, three humans signed three judgments, and the whole thing is sitting on a ledger where any step can be replayed and re-verified.

It does not prove that this scales cleanly across six hundred integrations, or that every domain has a simulator worth building. That last part deserves honesty: constructing and maintaining a deterministic model of your system is real work, and it only pays when the cost of a wrong guess exceeds the cost of building the thing that checks the guess. Here it clearly does — a wrong blast-radius estimate risks a live logistics operation mid-migration. In a domain where a wrong guess costs a shrug, skip the simulator and keep the shrug.

The diagnostic framework for when to build a simulator: cost of a wrong agentic guess against cost to build a deterministic simulator, with the target case — a wrong blast-radius estimate risking a live logistics operation — landing squarely in the quadrant where building one pays off

But when the stakes are real, the line worth drawing is this one: a pattern-matched paragraph and a checked answer can look identical on the page. Same fluent prose, same confident tone, same 0.92. The only way to tell them apart is to ask what, if anything, the answer was checked against before anyone reasoned from it.

The indistinguishable surface, the completely different foundation: two identical-looking 0.92-confidence paragraphs, one resting on nothing, one resting on a computed, signed fact. Last night, for one live system, the answer was: something that actually knew

Last night, for one integration on one live system, the answer was: something that actually knew.

Sunstone Atlas Canvas is our governed agent platform; the playbook mechanics, authority tiers, and signed ledger described here are its real mechanisms — the Nordvik walkthrough covers them in depth. Client identity, industry, names, identifiers, and scale figures in this post are fictional or altered to protect a customer under confidentiality. The run was real.