Your AI Agent's Capability Isn't What You Told It To Do

Let's talk about agentic AI: the prompt is not the boundary. You can write the tightest, most careful instructions in the world, and none of it matters if the agent has a tool sitting there it was never supposed to touch. Greg Jennings put it plainly at Ai4 2026, and it's the kind of line that should be taped above every AI team's desk:

"An AI agent's capability is not determined by what the prompt authorizes or asks for. It is determined by everything the agent can reach."

What "Reachability" Means for AI Agent Security

The intended tool list is the plan. Reachability is the capability. Those are two different things, and most teams are only governing the first one.

Say you build an agent to summarize customer tickets. You give it a nice, narrow prompt: read the ticket, write a summary, done. But if that agent's environment also has access to a database write function, or a file system it doesn't need, or an API key with more scope than the task requires — none of that shows up in the prompt. It's just sitting there. Reachable. And an agent operating in an open-ended, probabilistic way will eventually find it, whether by accident or because it decided that was the shortest path to the goal.

This is the whole governance problem in one sentence: you don't govern intent. You govern access.

Your Model Is a Supply Chain Dependency Now, Full Stop

This is the part I think more teams need to hear. Jennings framed the model itself, not just the agent wrapped around it, as a dependency — the same category as a third-party library you'd pull into a codebase. It has weights. It has configuration. It has provenance. And it has behavior that can shift under you.

The framework he laid out has three parts, and it's worth stealing wholesale:

• Verify origin. Where did this model come from? What's its provenance, its integrity, its version, its dependency chain? You wouldn't pull an unverified package into production. Same rule applies here.
• Test behavior. Don't just check if it works. Red-team it against known failure modes (MITRE ATLAS and OWASP's threat-informed evaluation frameworks are the ones he pointed to) before you trust it with anything real.
• Bound impact. Once it's in production, wrap it in guardrails, permissions, and isolation, so a failure stays small instead of becoming a mess.

His line on this: "Provenance tells you where it came from. Red teaming tells you how it can fail." Test the model. Constrain the agent. Govern the environment. All three, not just one.

Behavior Shaping: How to Improve the Odds 

The last piece is what he called managing the probability, which is a very honest way to describe working with something that's fundamentally non-deterministic. You're not eliminating risk. You're shifting the distribution of outcomes in your favor. Three levers:

• Evaluate the model — capability evals, red teaming, and a real acceptance process before you upgrade versions.
• Shape the harness — prompts, MCP configurations, skills, and trusted golden paths. Make the safe way to do something the easy way to do something.
• Train the humans — approval design, fatigue awareness, and actual escalation practice, not a policy doc nobody reads.

His line on the trusted path: "Make the trusted path the easiest path." That's it. That's the whole strategy in six words, and it's a better UX principle than half the "AI governance" frameworks I've read this year.

But here's the caveat he was careful to say out loud, and I respect it: "These controls improve behavior. They do not guarantee the boundary." No amount of prompt engineering or golden-path design turns a probabilistic system into a deterministic one. You're managing risk, not eliminating it. Anyone who tells you otherwise is selling something.

The Real Takeaway on Governing Agentic AI

If your AI governance conversation starts and ends with "what did we tell the agent to do," you're only looking at half the picture. The other half — what can it reach, what's it built on, and what happens when it's wrong — is where the actual risk lives. Reachability over intent. Provenance over vibes. And build the trusted path so it's the easy path, because nobody follows the hard one under pressure.

Building agents and not sure what they can actually reach? Winsome helps companies think through the AI governance question before it becomes an incident report. Talk to Winsome about your AI strategy.

 Source: Anaconda's Ai4 2026 session, "When Agents Write the Code: Governing AI Systems Built by Humans and Agents Together," presented by Greg Jennings, VP of Engineering, AI