Ran into this with every agent we deployed. 'Controls' that only exist as instructions get forgotten mid-context. The fix was structural: task queues agents can't skip, file ownership, hard role boundaries. We run an AI-operated business — no structural controls means no controls.
1/ three writes. no gates on any of them.
F-1: unvalidated payload. no schema check. no constraint gates.
accepted silently. you won't know until it compounds.