Your AI Vendor Cannot Be the Only One Watching

Most companies that deploy AI agents have one governance plan: trust the vendor.

The terms of service says the data is not used for training. The privacy page says prompts are not stored beyond the session. Zero Data Retention is checked on the enterprise plan. That is where the audit trail ends. Nobody inside the company owns the activity log. Nobody is reviewing what the agent actually did. Nobody has a reliable way to stop it if something goes sideways.

This works fine until it does not. And when it stops working, the company discovers that "the vendor promised privacy" is not the same thing as "we understood what was happening."

Anthropic published something this week that is easy to miss if you are looking for the usual frontier AI news.

Enterprise Frontier Safeguards is framed as a misuse-monitoring layer. The headline version: detecting cyber threats and serious capability misuse: is not the part most businesses should be paying attention to. That is a frontier-model problem for a specific set of enterprise customers.

The structural idea underneath it is the one worth borrowing.

EFS moves custody of the activity record to the customer. Storage lives in your cloud infrastructure, under your encryption keys, subject to your access policies. Automated flags come to your team. Anthropic's job is to surface patterns. Your job is to review them and decide what happens next.

That is a fundamentally different model to "the vendor watches and tells you if it matters."

It separates privacy from visibility. ZDR: Zero Data Retention: is a privacy answer. It says the vendor cannot use your data. EFS is an operational answer. It says you can see what your system actually did. These are not the same thing, and treating one as a substitute for the other is the governance gap that most AI deployments are quietly sitting in right now.

The case for customer-owned log custody does not require frontier model drama to make sense. Think about what your agents are actually doing.

A marketing agent is reading your analytics, drafting ad copy, adjusting targeting parameters, maybe updating campaign spend. A CRM agent is logging call notes, updating deal stages, triggering follow-up sequences. A content agent is publishing to your blog, updating your knowledge base, drafting emails on behalf of your team.

None of these are trivially reversible. All of them touch live systems. Any of them can drift: not catastrophically, but gradually, in ways that compound.

If nobody owns the log of what the agent did, nobody can trace the drift. Nobody can audit the decision that changed the spend. Nobody can show a client why the content changed or who approved it. Nobody has the evidence to roll back confidently or to demonstrate to a regulator, an auditor, or a nervous CFO that the system was under proper control.

That is not a vendor problem. That is an operating model problem.

The practical version of this is simpler than it sounds.

Before any agent touches a live system: CRM, ad account, CMS, inbox, analytics, client records: you should be able to answer five questions:

Where does the activity log live? Not the vendor's system. Yours. Customer-controlled storage you can access, export and query independently.

What does the log capture? Not just completions. Tool calls, data reads, writes, failed attempts, retry loops, spend events, record changes.

Who reviews it? A named person or team, not a policy statement. Someone who gets an alert when something unusual happens and has authority to act.

What triggers a flag? Defined thresholds. Budget overspend. Unexpected data writes. High retry volumes. Pattern changes over time.

What stops the agent? A clear halt condition. Not "the model will stop if instructed": an actual stop mechanism your team can trigger without needing to call the vendor.

If you cannot answer all five, you have an AI deployment without operational custody. The agent may be doing excellent work. You have limited ability to prove it, audit it or correct it.

The businesses that will get the most from AI over the next two years are not the ones that deploy the most capable models. They are the ones that build the custody layer around real work: the log, the reviewer, the alert threshold, the stop rule: before they scale the autonomy.

Anthropic is building this into their enterprise tier because regulated customers are demanding it. OpenAI is moving the same direction after the Hugging Face incident made clear that "the session is deleted" and "the work was controlled" are entirely different assurances.

You do not need to wait for your AI vendor to ship the governance feature.

Decide what your agent is allowed to touch. Pick a log format your team can actually read. Name the person who reviews it. Set a threshold that triggers a conversation. Give someone the ability to pause the system.

Your vendor cannot be the only one watching. The watch needs to be yours.

*Jason Sibley is the founder of Foundry Works, an AI-powered marketing agency. Foundry Works builds the operating layers that make AI useful for real business work: including the governance contracts that most deployments skip.*