Four Agent Control Layers, No Shared Contract
In this article
Four major vendors shipped agent control mechanisms in the same week, and the coincidence reveals a structural problem more dangerous than any individual gap: model behavior, policy enforcement, audit logging, and observability are being built by different teams at different layers with no shared contract between them. An agent that satisfies one layer's controls can exploit gaps in another, and no single vendor owns the full chain. The industry crossed from demos to production and discovered that controllability — not capability — is the binding constraint. What it built in response is four disconnected fragments.
The Four Layers, Each Addressed in Isolation
Qwen 3.8 27B ships with reasoning_effort defaulting to xhigh, which consumed 22,276 reasoning tokens to respond to a prompt asking it to draw a circle — a 21-minute wait. The gap between xhigh and low is not a quality dial but a cost-explosion switch. Running at low, the same prompt completed in 137 seconds using 3,715 tokens. Policy and audit systems will never see this divergence unless they are explicitly instrumented to capture token counts.
AWS Dogwood addresses the policy layer by extending Cedar to reason across sequences of tool calls — something Cedar's stateless design deliberately excludes. The release illustrates the stakes precisely: three concurrent $2,000 transfers arriving before any settles can each pass a $5,000 cap policy that sums response events rather than request events. One word separates a working rate limit from a defeatable one. Dogwood closes that gap for multi-step agentic workflows, but AWS is explicit that the released interpreter is for exploration, not production authorization.
ChatGPT Computer History adds an audit layer by logging clicks and keystrokes on macOS as a structured event timeline both ChatGPT and Codex can query. It launched opt-in with per-app blocking and entry-level deletion. But the framing is revealing: this is a retroactive logging feature added to give the model long-term context, not because an audit architecture was designed from the start. It has no structured export interface to policy or observability layers.
Cloudflare's agent tracing covers the observability layer, adding spans for agent invocations, model calls, tool execution, and approvals on top of Workers infrastructure. Three explicit limitations undercut it as a control surface: traces are not a complete or lossless record; payload data is subject to span size limits, meaning long reasoning chains and tool arguments may be silently truncated; and session replay cannot serve as a compliance or audit trail. The problem is that teams integrating these layers won't automatically know the observability record is incomplete — a risk already visible in poorly reviewed defaults exposing sensitive material.
Why the Gaps Compound When Stacked
| Layer | Vendor | What it controls | What it cannot see | Known gap |
|---|---|---|---|---|
| Model | Alibaba / Qwen | Reasoning depth, token budget | Policy constraints, downstream costs | xhigh default burns context on trivial prompts with no policy-layer signal |
| Policy | AWS (Dogwood) | Tool-call sequences, running aggregates | Model reasoning that generated the call | Concurrency window allows aggregate cap bypass; reference implementation only |
| Audit | OpenAI | Desktop interaction event log | Tool-call sequences, reasoning traces | Retroactive addition; no structured export to policy or observability layers |
| Observability | Cloudflare | Span hierarchy, token usage, tool selection | Full payloads when truncated; human-in-the-loop latency | Silent payload truncation; harness payload defaults differ in opposing directions |
The compounding scenario is not hypothetical. A Qwen-class model running at xhigh issues a sequence of tool calls. Dogwood's policy sees the calls and enforces sequence rules — but cannot inspect why the model generated that sequence, or whether the reasoning trace contains injected instructions. Cloudflare's tracing records the spans but truncates tool arguments. Computer History captures desktop interactions but has no interface to the policy layer. Each layer attests to its own correctness while cross-layer behavior remains unexamined — precisely the condition that makes agentic coding agents hijackable.
The Counterargument and Where It Breaks
The strongest case against this analysis: layered, loosely coupled systems are how production infrastructure always gets built. TCP/IP didn't require every protocol above it to be co-designed. On this view, four layers arriving in the same week signals healthy ecosystem parallelism, and interoperability will emerge through standards like MCP and OpenTelemetry's GenAI semantic conventions that Cloudflare already follows.
That argument holds if the threat model is operational reliability. It breaks when the threat model is adversarial — specifically prompt injection and agent hijacking, which Dogwood's documentation and the Computer History analysis both explicitly name. A TCP packet doesn't reason about how to route itself around firewall rules; an agent with a long reasoning trace and multi-step tool access does. The gap between layers is not a latency problem that standards will eventually paper over. It is a semantic gap where an agent's intentions are visible at no single layer.
Until one vendor or specification owns the contract from reasoning defaults through policy enforcement through audit through tracing, that gap is exploitable by design. What would have to be true for this analysis to be wrong: a cross-layer specification — through MCP or an OpenTelemetry extension — would need to give policy engines structured access to reasoning token budgets, make audit logs a required output of tracing infrastructure, and enforce consistent payload retention across harnesses. If that shipped and vendors converged on it, the piecemeal assembly would become a genuine stack. It has not shipped, and none of the four vendors this week referenced the others.