What a Family Seal Taught Me About Governing AI Agents

Keep a signet in my desk. It is a family heirloom, a 'Van Ranzow' wax seal that has outlived everyone who ever used it. Somewhere between admiring the engraving and wondering about the hands it passed through, it occurred to me that I was holding the answer to a problem I have been thinking about at work. How do you keep a team of AI agents from quietly rewriting the truth?

Let me share what I learned by doing.

The seal was never decoration

For most of recorded history, a document had no authority until it was sealed. Anyone could draft a document. Scribes drafted constantly, things like proposals and copies. But the draft became the decree only when one accountable person pressed a seal into wax. The seal was not for decoration. It was an approval gate.

My family understood this for a very long time. The line behind that signet goes back centuries in northern Europe, and its influence ran on exactly this machinery: documents, seals, and the authority to bind the two together. One ancestor published relentlessly and made sure his name appeared on every page he touched. He grasped something we are now relearning the hard way with large language models (LLMs). The ability to produce text and the authority to make it true are different powers, and everything depends on keeping them separate.

What happens when everyone has a pen and no one has a seal

Over the past few months, I have been experimenting with a multi agent project. Several LLMs collaborating on a single evolving architecture document. It is genuinely productive. It is also, left ungoverned, a machine for manufacturing confident drift.

Four failure modes showed up almost immediately:

1/ Source drift. Derived summaries diverge from the source document, then get treated as the source. Each model session edits its own private version of reality, and every version is fluent enough to look authoritative. Within days you cannot say which document is true, only which one you read last.

2/ Role collapse. The same agent plans the work, does the work, reviews the work, and certifies the work. Self-review is not review. A model checking its own output tends to confirm it, because the same weights that produced the error evaluate the error. Errors notarize themselves.

3/ Hidden context dependence. An agent reaches a sound conclusion based on session context that evaporates when the window closes. The conclusion survives. The reasoning does not. Agent sessions now run to hundreds of thousands of tokens, and none of it persists unless you make it persist.

4/ Candidate creep. The sneaky one. A speculative idea gets mentioned in one session, referenced in the next, assumed in the third. By week two it is load bearing architecture that nobody approved. For an LLM, prior mention is prior probability. Repetition starts to feel like ratification, and the model cannot tell the difference on its own.

None of these are model failures. They are governance failures. The models did exactly what fluent text generators do. The missing piece was the wax.

The harness: separating the pen from the seal

The industry has started using the right metaphor. The model is the brain, and the harness around it — the tools, memory, policies, and gates — is what makes it useful and safe. I would add that the oldest component of any harness is the seal. Here is one way to think about it:

One canonical source. A single tier of documents holds the truth. Everything else — summaries, decks, diagrams — is a derived view that may restate canon but never redefine it. When a derived artifact conflicts with the source, the artifact is wrong by definition. No forks, no silent merges.

Separated roles across separate models. One model reasons and plans but holds no execution power. A second executes inside declared limits on files, tools, and scope, and cannot expand its own boundaries. A third does nothing but attack the output, hunting drift, unsupported claims, and silent promotions. A fourth re-derives results from the canonical source without the executor's context. That last one matters most. Verification stripped of the original session context is precisely what catches conclusions that only worked inside one window.

A quarantine for new ideas. Every proposal enters as a labeled candidate. Candidates are visible, trackable, discussable, and powerless. They gain nothing through repetition, agent consensus, or age. Only through a decision.

One seal. Nothing moves from candidate to canon without a human decision, recorded, with a review trail. I hold the seal. Not because I am smarter than the models. Most days, demonstrably not. But accountability has to live somewhere with a pulse. This is also where the industry is landing: agents earn autonomy only inside clear policy, with every action contained, auditable, and reviewable. Autonomy within the harness, never instead of it.

The surprise: the paperwork became the roadmap

Once the governance was in place, the documentation stopped being a record of the project and started generating it. Every review pass emits the same outputs. A reviewed artifact. A list of gaps the adversarial model found. A set of new labeled candidates. A decision queue for me. The gaps become backlog items. The backlog becomes the roadmap. The document set is not describing the work anymore. It is discovering it.

Old chanceries knew this too. The registry was not a filing cabinet. It was the operating system of the realm. What got sealed determined what got done.

The seal is nothing without the archive

Here is the part my infrastructure friends will recognize, because I spend my working life at the intersection of AI and storage.

Every governance mechanism above is, physically, a persistence problem. A canonical source only works if a durable, versioned copy outlives every session. A verifier can only re-derive what was actually written down. Candidate registers, audit trails, sealed decisions, canon snapshots — none of that lives in a context window. The context window is working memory. Governance lives on disk.

And the volumes are not small. Agents are long running processes that spawn sub agents, call tools, and accumulate context across sessions. Add governance on top and you multiply that state again, with retention, integrity, and reproducibility requirements attached. The seal made the decree, but the registry made the kingdom governable. I only know my own family's history because someone wrote it down, sealed it, and stored it.

So here is the thesis I will develop in a follow up piece. Governance is a storage workload. We are building a lot of seals right now. The organizations that win the agentic era will also build the archive. Working where AI infrastructure gets built, I would not bet against the archive.

Where have you seen the modern seal, or its absence, shape how your agents work?

Views my own. The wax, in my case, is not entirely metaphorical.