Four hours of looking, one written agreement
Netflix wrote down what its systems mean and cut incident hunts to one query, more than half of firms hold no baseline for machine identities, and four UK regulators say an agent's autonomy changes nothing about who answers for it.
How we Build
Netflix wrote down what its systems call things, and a four-hour investigation became one query
Netflix’s own account says why a routine regression took four hours to diagnose. Its telemetry, alerting, incident and deployment systems each answer a quarter of the question, and none of them agrees with another on what an application is called. The answer it built is an Observability Ontology on the W3C stack. Every fact is written as a triple and checked against SHACL shapes before it enters the graph, which twelve namespaces divide into one operational domain each, behind a quad store Netflix built for the purpose. The root-cause agents now query the graph alongside live signals, so a question that once spanned three tools is one query.
Our statement asks that meaning be encoded once, owned, and that a locally invented definition be refused. The refusal is the point. Netflix’s SHACL shapes are the refusal written as a build step: a fact that does not conform does not enter the graph. What is better evidenced today is the scale the practice survives. Netflix serves two billion requests a day through one written agreement. The account’s own caution is worth repeating: the join across its systems used to live in one engineer’s head, and that engineer was the bottleneck.
Meaning is encoded once in a semantic layer somebody owns: every metric resolves from one governed source, field meanings and valid joins are declared, and a locally invented definition is refused.
How we Assure
Half of the people securing firms cannot say what normal looks like for an AI agent
Abnormal AI asked 525 security professionals across six countries; 85 per cent were CISOs or SOC leads at organisations of more than a thousand staff. Forty-six per cent cannot establish a safe baseline for agentic AI activity. Fifty-three per cent hold no baseline for machine identities at all. The obstacles they rank highest are trust and the definition of normal, with staffing, budget and tooling below. More of their planned behavioural-monitoring spending is aimed at agents than at any other technology.
Our security principle names identity as the place where agents add most risk. This sample supports it from the other side. The identity the principle names first is the one most organisations have not instrumented. One qualification stays attached. Abnormal sells behavioural monitoring, so the survey probably describes its own market too, and the numbers are practitioners reporting on themselves.
Identity is where agents add most risk.
Four UK regulators state that an agent’s autonomy changes nothing about who answers for it
The CMA, the FCA, the ICO and Ofcom issued a joint statement on 30 October saying that existing competition, consumer, data protection, online safety, payments and cyber security law applies to personal AI agents. Their own sentence is that an AI agent’s autonomy does not diminish the responsibility of the organisations that deploy it. Firms are told to show how a user understands the agent’s authority and who is accountable. They are also told to say how personal data is used, how the commercial interests behind an agent’s recommendations are disclosed, and how redress works. The duty is on the deployer.
Our ethics position has been that there is nobody inside the agent to hold responsible. Accountability attaches to the people and organisations that designed and deployed it, and four regulators have now said the deploying half of that, in writing, backed by a promise to use their powers. The statement is scoped to personal agents in consumer markets and says nothing about the enterprise, and the logic does not change with the setting.
There is nobody in the agent to be responsible, so accountability attaches to the lineage and to the people who designed it.