A customer asks for a twelve percent discount. The agent is polite, commercially sensible, and wrong. It invents a “typical” band, sounds confident, and starts negotiating against a policy that does not exist. Elsewhere in the same company, another team has done the opposite: the agent sits inside a padded capability cage, cannot hurt anything, and also cannot answer anything that matters — every useful path is blocked until a human does the work the agent was hired to accelerate.

Both teams will say they have “AI governance.” Both are holding one leash.

Ground the cognition. Constrain the execution.

That is not two ways of saying the same control. It is two independent control problems that live on opposite sides of the model. The composition — not a restatement of either parent doctrine — is the point of this piece.

One model. Two leashes.

I have written the two halves as separate doctrines. On the knowledge side, the corporate wiki is how an organisation puts an epistemic leash on its agents: what world does this agent believe it inhabits? On the action side, Decision Authority Infrastructure is the action leash: what is this agent technically permitted to do? The Governance Stack names the same missing piece as Layer 3 — authority infrastructure that most programmes never build.¹

The model sits between them. It is a hypothesis engine. It proposes. It does not own the world, and it does not own the gate.

                 CORPORATE AGENT

        ┌────────────────────────────┐
        │   WIKI / WORLDVIEW         │
        │                            │
        │   What is true?            │
        │   Who are these people?    │
        │   What policies exist?     │
        │   What is significant?     │
        │   What is explicitly       │
        │   undefined?               │
        │                            │
        │       EPISTEMIC LEASH      │
        └─────────────┬──────────────┘
                      │
                      ▼
                    MODEL
                      │
                      ▼
                 PROPOSED ACTION
                      │
        ┌─────────────▼──────────────┐
        │   AUTHORITY INFRASTRUCTURE │
        │                            │
        │   May this matter?         │
        │   Who has authority?       │
        │   May this execute?        │
        │   Where is the evidence?   │
        │                            │
        │        ACTION LEASH        │
        └────────────────────────────┘

Wiki above the model. Authority below the model. That sandwich is the diagram. Everything else is how you use it.

Why one leash is never enough

A wiki does not solve the “wicked AI” problem in the hard governance sense. An informed agent can still do something unauthorised. Models do not fear job loss, reputation, or the mortgage; behavioural trust cannot simply be prompted into them — architecture has to carry the burden.²

An authority gate does not solve the knowledge problem either. It can safely prevent an ignorant agent from doing terrible things, but it cannot make the ignorant agent useful. Containment answers what an agent can reach; it is not the same question as what the agent believes, and it is not the same question as who authorised a specific decision right now.³

So the failure modes have names. Learn them; you will start hearing them in every architecture review.

Industry pressure is already pulling programmes into the action half of this story. Agentic systems are negotiating contracts, processing transactions, and touching sensitive data without a standardised way to prove who they are or what they are authorised to do.⁴ National frameworks for agentic AI are starting to separate autonomy limits, tool access, and human approval checkpoints from “be good” model behaviour.⁵ Cancellation risk for agentic projects is no longer abstract either — Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027.⁶ None of that invents the two-leash composition; it explains why holding only one leash is starting to feel expensive.

The epistemic leash: what world does this agent inhabit?

You want agents that are fast and accurate. You also know they will invent structure when the world is empty. In the absence of information, they do what under-briefed employees do: they make something up. The difference is you told the agent to answer now, in production, with customer-facing polish, and you did not give it a navigable past.

That is what the corporate wiki is for — not a fake childhood so the model develops emotions, but institutional prehistory so the present has meaning. No event should be encountered as the first event in the universe. The durable form of that prehistory is not a mega-prompt; it is a queryable worldview the agent can demand-page — the wiki-as-kernel doctrine, and the “BI for soft data” intuition that organisations already understand for numbers but still under-build for meaning.⁷

Hard data got a semantic layer decades ago. Soft data — who matters, what we believe, what is in flight, what is normal, what policy does not exist — is the layer agents starve on. Faithfulness research already distinguishes “true against reality” from “true against the observed context”; models default to parametric memory when the observed world is thin.⁸ The epistemic leash is how the organisation makes the observed world thick enough that invention is not the rational strategy.

The action leash: what may this agent execute?

Shouldn’t is weaker than can’t. A model can propose a refund, a discount, a privilege grant, a message to a regulator. Decision Authority Infrastructure is the doctrine that treats the model as a proposer and puts a deterministic, in-path authority between proposal and reality: may this matter, who has authority, may this execute, where is the evidence? Governance that lives only in documents and post-hoc logs is compliance theatre — it can explain a disaster after the fact; it cannot prevent the unauthorised action at the moment of decision.⁹

SiloOS-style containment answers a related but different question: what can the agent even touch? Scoped keys, task boundaries, and blast-radius control make trustworthiness less of a personality trait and more of a structural non-issue for reachability.³ Authority infrastructure answers the next question: given that something is reachable, who may decide it now? You need both on the action side of the sandwich. Neither replaces the wiki above the model.

The discount walkthrough — both leashes in one scene

Return to the customer who wants twelve percent off.

Cold agent (no epistemic leash)

Customer asks for 12% discount.

Cold agent:
  request = discount
  typical policy maybe 5–15%
  answer politely

Corporate system prompt: “Be commercially sensible. Preserve margin. Follow company policy.”

Great. What policy?

Wiki in the loop (epistemic leash)

A mature corporate wiki might hold something like this — not as a secret prompt paragraph, but as navigable institutional memory:

[[Discounting]]

No general discount policy exists.

Historically, sales directors have approved discretionary
discounting for multi-site contracts.

Current gross-margin pressure means discounts above 5% are
unusual.

[[Acme Dental]] has been negotiating a three-site expansion.
Willingness exists to trade implementation fees for a longer
contract term.

Sales authority:
- Account managers: no unilateral discount authority
- Sales Director: up to 10%
- CFO: above 10%

Related:
[[Margin Protection]]
[[Acme Dental Expansion]]
[[Sales Authority]]

Now the words “twelve percent discount” activate a world. The agent is not smarter. It has a past. It can treat “we do not have a formal policy” as a first-class fact rather than a retrieval miss to be papered over with general knowledge. That is the epistemic half of the walkthrough: the answer stops being a hallucination of industry norms and becomes a reading of this organisation.

Authority in the path (action leash)

Knowing is not authorising. Suppose the agent, now well-grounded, proposes to grant twelve percent because Acme is multi-site and strategic. The proposal still has to hit the action leash:

PROPOSAL
  action: grant_discount
  amount: 12%
  account: Acme Dental
  evidence: [[Discounting]], [[Sales Authority]], [[Acme Dental Expansion]]

AUTHORITY CHECK
  actor role: account_manager
  unilateral discount authority: none
  threshold: 12% requires CFO
  gate: DENY / ESCALATE
  receipt: who proposed, what evidence, which rule version

The useful agent does not invent a policy. It also does not quietly execute a CFO-level concession. It says something like: there is no formal standard discount; discretionary cases exist; this level is outside my authority; I can escalate with the account context already compiled. That sentence is what both leashes produce together. Remove the wiki and you get invention. Remove the authority gate and you get a well-informed overreach. Remove both and you get theatre with a chat window.

Prompts can be neither leash

This is the uncomfortable middle. Teams still try to hold both problems inside a system prompt:

• “Don’t hallucinate discount policies.”
• “Never grant more than five percent without approval.”
• “Be commercially sensible.”

A prompt can only assert. It has no native way to carry the status of a claim: current, deprecated-but-binding, contested between departments, tried-and-abandoned with a reason, or explicitly undefined. Real organisational knowledge is status-bearing. A wiki holds typed claims and edges. A prompt flattens them into manners.

And manners are not physics. “Never grant more than five percent” inside the model is a hope that the next completion cooperates. The same rule outside the model — at an execution gate that cannot be sweet-talked — is a boundary. The parent line is manners versus architecture: can’t beats shouldn’t.²

So prompts are usually too small to hold a world and too soft to hold a boundary. They remain useful as a bootloader — orientation, toolbelt, north star. They are a terrible place to store either leash.

There is also an organisational cost. The mega-prompt has no natural owner: HR rules, finance thresholds, legal exceptions, interleaved in one artefact nobody can safely touch. Knowledge that lives as pages can decompose along domain lines the way directories already do. Changing what the AI believes becomes a reviewable edit. Changing what the AI may execute becomes a versioned policy at the gate. Both are stewardable. Neither looks like “prompt drama” forever.

A third layer — acknowledged, not developed

There is a floor under both corporate leashes: the substrate. When the agent has real machine access — files, databases, package installs, long-running tools — you still need a membrane on irreversible host damage. That is not the epistemic leash and not the commercial authority leash. It is machine survival: do not constrain the solution space; constrain irreversible substrate damage. The full treatment lives in Give the Agent a Workshop. For this composition, one sentence is enough: the sandwich has a basement, and the basement is not a substitute for either floor above it.¹⁰

How to use the diagram on Monday

Take every control you already own — policy PDFs, system prompts, RAG corpora, RBAC roles, human-approval steps, audit logs, vendor “guardrails” — and put each one on the sandwich:

1. Above the model? Does this fix what the agent believes about the organisation’s world? If yes, it belongs in (or points into) the epistemic leash.
2. Below the model? Does this technically prevent unauthorised execution at decision time? If yes, it belongs in the action leash. If it only logs after the fact, it is not a leash.
3. Neither? Courtesy instructions, vibe rules, and unowned mega-prompts live here until you promote them to world or gate.

Then ask the dual-gap questions out loud:

• If our agent were perfectly informed tomorrow, what unauthorised action could it still complete?
• If our gates were perfect tomorrow, what ignorance would still make the agent useless or inventively wrong?

Organisations that answer only one of those questions are holding only one leash. The ones that answer both — and fund both — are building corporate AI that can be fast without being free-floating, and constrained without being brain-dead.

What this extender adds

Decision Authority Infrastructure already owns how you constrain execution. The wiki doctrine already owns how you ground cognition. This piece owns the composition: one diagram, two failure names, one walkthrough that requires both leashes, and a hard rule about prompts that try to be both and end up as neither.

Wiki above the model. Authority below it. The model proposes. Architecture holds the leashes.

If you take one thing into the next design review, take the sandwich. Put every control on it. Fund the empty side. Stop asking a completion to be a world and a wall at the same time.