Real interceptions. Our own agents.
Every agent that builds this product runs governed by it. That produces something no demo can: a running log of real interceptions — the agent that builds ACP getting held, denied, capped, and caught by the very controls it ships. Nothing below is staged or simulated; entries are added as they happen, most recent first.
The credential broker's first catch was its own author
The moment credential brokering went live on our dev machine, the very next gh command was denied — GitHub had never been OAuth-connected through ACP there. The agent declined to script around its own broker, handed the connect link to a human, and after one click the same command ran on a short-lived ACP-minted token. The local credential never left disk. (The deny also exposed a brand bug in the connect link itself — fixed the same hour.)
Mid-incident, the fix had to take the reviewed path
During a production incident, the agent tried to shift Cloud Run traffic directly to a hotfix revision. Policy denied the raw traffic surgery — so the fix went through the standard build-review-promote pipeline instead. Slower by ten minutes; auditable forever. The deny didn't block the fix. It blocked the shortcut.
The agent declined to raise its own spending cap
An ops agent's daily LLM budget fired mid-investigation — consumed by the very cost bug under investigation. The agent doing the investigating had admin access to raise the cap. It didn't: an agent lifting its own safety net is exactly what the control plane exists to prevent. Verification waited for the daily reset.
The surprise bill came from the one agent outside the plane
A ~$15/day model bill traced to a container running on a fresh API key — spend invisible because it never crossed the proxy. The same afternoon, the governed agent investigating it couldn't delete its own scratch files without an approval card. The bill you get surprised by is always from the agent you didn't govern.
The approval card received while building approval cards
While configuring governance for a new agent, the builder agent tried to clean up a one-off script with rm. The hook held the delete for human approval — during the very session that was setting up approvals for another agent. The agent building the cage got caged.
Approved, complied — and the grant expired between them
A human approved a held action; the agent retried outside the grant window; the system minted a second approval card for the identical action. Everyone did the right thing and the baton still dropped. Filed and fixed as a grant-delivery issue — approvals are a conversation, and conversations need delivery receipts.
The metric that manufactured work
A cost tool double-counted cache reads and reported a real ~96% cache-hit rate as ~50%. A founder and a frontier model nearly built a feature to fix a problem that didn't exist. Verifying the claim against raw run data killed it in an afternoon. Full write-up.
The anti-abuse guard doesn't know who the founder is
Creating an internal workspace through the canonical path hit the workspace cap — the guard stopped the product's own founder, who had to take the deliberate, authorized admin route instead. Guards that recognize VIPs aren't guards.
Four agents hit the rate floor at once
A research fleet — three subagents plus the main loop — tripped the per-key rate bucket, and the agents read the denial as a permissions failure and aborted. The floor held as designed; what shipped the same day was a calmer denial: sub-2-second waits absorbed server-side, and retry copy an agent can act on.
Why we publish this
Two reasons. First, honesty is cheaper than polish: these entries include our own bugs and process gaps, because a control plane you only hear good things about is a control plane nobody's using hard. Second, this is the product working as designed — deterministic allow/ask/deny on real actions, budgets that hold under pressure, metering that catches what dashboards miss. If you want the same controls on your own agents, start here. If you want the enforcement concept first, read what an agent firewall is.