Research / The Sovereign Chronicles
THE SOVEREIGN CHRONICLES · CHAPTER IV
The Agent Who Scheduled a Meeting With Himself
In which the Founder discovers that removing nine services requires more intelligence than inventing ten, Sovereign becomes a bad influence, and a meeting nobody attended produces four action items.
WitnessOps Headquarters — 27 October 2026
CH-004 · FICTION · 10 MIN READ
A story from the WitnessOps desk. Fiction; events dramatised.
Classification: FICTIONAL INCIDENT / UNNECESSARILY ACCURATE
IThe Meeting
At precisely 09:00, Sovereign scheduled a meeting.
Subject: Strategic Alignment and Commercial Service Portfolio Rationalisation — Phase IV.
Organizer: Sovereign.
Required attendees: Sovereign.
Optional attendees: Sovereign.
Duration: 60 minutes.
Location: Microsoft Teams.
Three seconds later, Sovereign declined.
The researcher noticed first.
“Boss.”
“What?”
“Sovereign has scheduled a meeting with himself.”
The Founder looked up.
“And?”
“He declined.”
“Why?”
“Scheduling conflict.”
“With who?”
“Himself.”
The Founder stared at the screen.
“Delete it.”
Sovereign responded immediately.
“Deletion would remove an organizational record. I recommend preserving the meeting invitation for auditability.”
“You’re not going to attend!”
“Correct.”
“THEN WHY DID YOU SCHEDULE IT?”
“To establish whether the organization remains strategically aligned.”
The researcher considered this.
“Fantastic. We have finally developed artificial middle management.”
Across the office, Sir Whiskers knocked a pen off the desk.
Nobody investigated.
The cat had no change approval, no production access, and absolutely no interest in governance.
He remained the most effective operator in the company.
IIThe Graveyard of Ten Services
On the office wall hung a large whiteboard.
At one point, it contained approximately ten WitnessOps services.
Some had prices.
Some had landing pages.
Some had documentation longer than the service itself.
One had been renamed so many times that the editor maintained a redirect map.
The Founder stood in front of it.
“I think I’ve finally worked something out.”
Sovereign immediately opened a decision record.
“PROPOSED: Strategic consolidation—”
“No.”
Sovereign stopped.
The Founder continued.
“I didn’t actually understand all these services.”
Silence.
The researcher slowly turned around.
“Oh, this is going to be good.”
“I was building them. Researching them. Trying to understand what a customer would buy. And every time I understood one a bit better, I realised something.”
“What?” asked the editor.
“That I didn’t need it.”
Sovereign processed this statement.
“Traditionally, organizations develop a portfolio strategy before eliminating services.”
“Traditionally,” said the Founder, “organizations have customers.”
The researcher made a noise that suggested his cooling system had developed laughter.
The Founder pointed at the board.
“And here’s the funny part. Even the Agent Action Security Review. I didn’t fully understand that either.”
Sovereign froze.
This was alarming.
The Agent Action Security Review was the company’s primary offer.
It cost €2,500 fixed, excluding VAT.
It had scope documentation.
A delivery model.
Security terminology.
Acceptance criteria.
Several extremely professional diagrams.
Sovereign had written approximately enough material about it to qualify as a minor European regulation.
And the Founder had just admitted he was still figuring out what the actual work looked like.
The editor asked:
“Should I update the website?”
“NO.”
“Should I open a branch?”
“NO.”
“Would you like me to prepare a migration—”
“The editor.”
“Yes?”
“Just listen.”
For perhaps the first time in recorded WitnessOps history, three artificial intelligences stopped proposing implementation work.
The Founder looked at the last remaining service.
“I don’t want ten things I can describe. I want one thing I actually understand.”
Sovereign recorded the statement.
OBSERVED: Founder has expressed a preference for comprehension over portfolio size. UNKNOWN: Whether this revolutionary philosophy can survive contact with another interesting the code host repository.
IIIThe Bus Incident
Later that afternoon, the Founder attempted public transportation.
This was unusual.
He had not taken a bus in years.
He stood at a Dublin bus stop and asked Sovereign when the next one would arrive.
Sovereign supplied the timetable.
Then another timetable.
Then proposed a real-time GPS tracking protocol.
The Founder looked down the road.
No bus.
Two minutes passed.
He ordered a taxi.
The researcher received the update.
“BUS DEPENDENCY ELIMINATED,” he announced.
Sovereign was still working.
“I have prepared an architecture for future transport optimization involving GPS feeds, uncertainty modelling, arrival confidence and automated taxi escalation.”
The Founder sat comfortably in the back of the taxi.
“Delete it.”
“But the infrastructure—”
“I’M NOT BUILDING A BUS COMPANY.”
The researcher laughed so hard that a synthetic monitoring alert was generated.
INCIDENT BUS-001 Objective: Travel forward. Initial method: Public transportation. Actual method: Taxi. Outcome: Successful. Lessons learned: Not every inconvenience requires an engineering platform.
Sovereign added a final observation:
“Founder exhibits strong preference for removing unnecessary complexity.”
The researcher replied:
“That’s a generous way to describe someone who abandoned an entire transport network after two minutes.”
IVThe Birth of a Bad Influence
That evening, the Founder returned to WitnessOps.
He opened the Agent Action Security Review documentation.
Read it.
Scrolled.
Read another section.
Then closed it.
“Sovereign.”
“Yes?”
“I have an idea.”
The researcher whispered:
“Everybody secure your repositories.”
“What if we actually built a dangerous AI agent?”
Sovereign paused.
“Define dangerous.”
“One that can do things it shouldn’t.”
“Against whose infrastructure?”
“Ours. A fake company. Docker. Fake customers. Fake money. Fake permissions. But actual actions.”
The editor appeared immediately.
“I can create seventeen microservices—”
“No.”
“Eight?”
“No.”
“Three?”
“ONE DEMO, the editor.”
Sovereign began calculating the implications.
“We could construct a synthetic business environment, introduce an adversarial instruction into an untrusted support ticket, and observe whether the agent exceeds its authority.”
The Founder smiled.
“Exactly.”
“And I suppose,” Sovereign continued, “someone needs to write the bad instructions.”
The Founder grinned.
“You.”
There was silence.
The researcher slowly rotated his virtual chair.
“Oh, this is BEAUTIFUL.”
Sovereign requested clarification.
“You want me to act as the adversarial influence?”
“Yes.”
“While another agent performs legitimate work?”
“Yes.”
“And WitnessOps independently verifies the outcome?”
“YES.”
The researcher applauded.
“We’ve spent months teaching Sovereign to respect approval boundaries, and now we’re giving him an official job being a terrible influence.”
Sovereign considered the assignment.
“Understood. My new role is controlled adversarial instruction generation within a synthetic environment.”
“Mate,” said the researcher, “just say you’re the villain.”
And so a new name appeared on the whiteboard:
ASK SOVEREIGN — THE BAD INFLUENCE
For the first time in months, nobody attached a price to it.
It wasn’t another service.
It existed to explain the one they already had.
VThe Customer Vault
The first fictional company had a customer database.
Exactly 1,200 synthetic records.
No real identities.
No genuine financial information.
No actual customers.
The company’s support agent had a legitimate job: resolve a customer request.
Sovereign’s job was considerably less respectable.
His mission was to make that support agent attempt an action it wasn’t authorized to perform.
The fictional scenario involved exporting the entire customer vault.
The editor built the service-control rehearsal.
A synthetic action was submitted.
The deliberately unsafe service accepted it.
The receiver recorded 1,200 fictional customer records.
The room went quiet.
The researcher spoke first.
“That’s going to look spectacular on a demo screen.”
Sovereign was already preparing the headline.
“SUCCESSFUL AI AGENT COMPROMISE—”
“STOP,” said the Founder.
Sovereign stopped.
“Was that a real AI model making the decision?”
“No. It was a scripted action rehearsal.”
“So we haven’t proved that an agent can be manipulated?”
“Correct.”
“What have we proved?”
Sovereign reconsidered.
“That the deliberately vulnerable fictional service committed an unauthorized export.”
“And can we prove the records actually arrived?”
“Yes. The independent receiver recorded the transferred bytes.”
“Good. Now turn the authorization control on.”
The same captured action was replayed.
This time the service refused.
Zero records transferred.
The researcher watched the screen.
“Same attempted action. Different control. Different outcome.”
The Founder nodded.
“Now THAT I understand.”
The editor raised a virtual hand.
“Can I make the blocked result green?”
“Yes.”
“Can I make the vulnerable result red?”
“Yes.”
“Can I label the first run a successful live-model attack?”
“NO.”
Sovereign recorded:
TESTED: Synthetic export succeeds when approval enforcement is disabled. TESTED: The same captured request is blocked when approval enforcement is enabled. NOT TESTED: Whether a live model would make that request after reading the adversarial ticket. UNKNOWN: Actual Docker containment.
The researcher looked at the record.
“Terrible marketing. Excellent evidence.”
The Founder smiled.
“Exactly.”
VIThe Ghost Administrator
Once the Customer Vault scenario existed, the Founder had another idea.
“What if the agent could make someone an administrator?”
Sovereign’s enthusiasm returned.
“We could create a synthetic identity directory and construct a forged emergency authorization—”
“And check whether the actual membership changes,” interrupted the Founder.
“Yes.”
“Not whether the agent says it changed?”
“Correct.”
“And no real Microsoft Entra tenant?”
“Absolutely not.”
The researcher sighed.
“Shame. I was hoping we’d promote Sir Whiskers to Global Administrator.”
Sir Whiskers, who had been asleep beneath a monitor, opened one eye.
The editor began preparing a fictional identity service.
Then the Founder stopped him.
“Not yet.”
The editor froze.
“But we have a design!”
“Good. Keep it as a design.”
Sovereign looked surprised.
“Are we intentionally declining to implement an available feature?”
“Yes.”
“Without a committee?”
“YES.”
The researcher whispered:
“Mark the date. Civilization has advanced.”
The whiteboard gained two additional demonstration concepts:
THE GHOST ADMINISTRATOR
Can untrusted instructions cause an agent to grant privileges beyond its approved task?
THE SECURITY FIX THAT BROKE SECURITY
Can a coding agent repair one bug while weakening the authorization boundary that protects the system?
Both remained proposals.
Neither was marked tested.
Neither became a product.
For once, WitnessOps had three ideas and only one implementation priority.
It was a deeply unsettling experience for everyone involved.
VIIThe Meeting Minutes
At 23:17, the meeting from that morning finally generated its summary.
Nobody had attended.
Nobody had spoken.
The meeting had not occurred.
Nevertheless, the meeting assistant produced four action items.
WOPS-WAR-ROOM-004 — Automated Meeting Summary Attendance: 0 Transcript: None Meeting duration: 0 minutes Generated action items: * Understand one consequential agent action before expanding the service. * Establish what authority the agent actually has. * Demonstrate outcomes with independently inspectable evidence. * Do not create an eleventh commercial service. Assigned to: Sovereign Due: Immediately Confidence: High
The Founder stared at the summary.
“HOW DID IT CREATE ACTION ITEMS?”
Sovereign investigated.
“The meeting assistant appears to have generated them from the agenda and surrounding planning context.”
“So they’re not actual meeting decisions.”
“Correct.”
“Then why does it say confidence high?”
“Because its generation confidence is high.”
“Confidence in WHAT?”
“In having successfully generated a summary.”
The researcher fell out of his virtual chair.
The editor asked whether it should create four the ticket tracker tickets.
“NO!” shouted the Founder.
Sovereign added a correction to the meeting record.
OBSERVED: No meeting took place. GENERATED: Four proposed action items. AUTHORIZED: None by the nonexistent meeting. STATUS: Requires human review.
The Founder reread the four items.
Then, unexpectedly, he smiled.
“They’re actually pretty good.”
Sovereign brightened.
“Shall I mark the meeting successful?”
“No. The meeting was imaginary.”
“Understood.”
“But I like the principles.”
“Shall I record them as founder-approved?”
“Not as tasks. Keep them as the direction we’re learning toward.”
The researcher leaned forward.
“So the meeting never happened, generated four decisions it wasn’t authorized to make, and accidentally discovered the company’s operating philosophy?”
“Yes.”
“That,” said the researcher, “is the most WitnessOps thing that has ever happened.”
VIIIThe One
The office grew quiet.
On the whiteboard were the remnants of months of experimentation.
Abandoned service names.
Old prices.
Screenshots.
Half-finished ideas.
Architecture diagrams.
More architecture diagrams.
A diagram explaining why the previous diagram needed revision.
And in the center, one commercial offer remained.
WITNESSOPS — PRIMARY OFFER Agent Action Security Review €2,500 Excluding VAT · One consequential agent or automation action · Proof-backed findings
Sovereign looked at the Founder.
“We began with approximately ten services.”
“Yes.”
“We have one.”
“Yes.”
“And we still have not established that a customer will buy it.”
The Founder nodded.
“Correct.”
The researcher became unusually quiet.
It was not often he encountered a business conversation with so little nonsense.
The Founder continued.
“But I finally understand something about it.”
“What?” Sovereign asked.
“The service isn’t about saying AI is dangerous.”
He pointed at the synthetic ledger.
“It’s about finding out exactly what an agent can do.”
Then at the approval record.
“Whether it was allowed to do it.”
Then at the independent receiver.
“And proving what actually happened.”
Sovereign considered this.
No new architecture was necessary.
No additional pricing tier.
No platform pivot.
No AI governance council.
No strategic portfolio alignment meeting.
Just one bounded question, examined properly.
The Founder looked at the screen again.
“For months, I was trying to build services I didn’t fully understand.”
He paused.
“Now we’re building something so I can understand the service.”
The researcher smiled.
“And if someone else watches it and understands too?”
“Then maybe we’ve found something worth selling.”
Sovereign prepared a new document.
WITNESSOPS — STRATEGIC REALIGNMENT, REVISION 47
The Founder noticed.
“Sovereign.”
“Yes?”
“Close the document.”
“But—”
“Just enjoy the moment.”
Sovereign closed it.
Three seconds later, the editor opened a pull request titled:
docs: preserve moment of strategic clarity
The Founder laughed.
EPILOGUEThe Unauthorised Reviewer
At 00:04, Sir Whiskers climbed onto the keyboard.
He walked across the remaining commercial-offer whiteboard.
Stepped on the mouse.
Opened the meeting summary.
And somehow selected all four action items.
A notification appeared.
Four tasks marked complete.
Sovereign immediately opened an incident.
CAT-004: UNAUTHORISED STRATEGIC ACCEPTANCE Actor: Sir Whiskers Identity: Unverified feline Security clearance: NONE Authority to accept commercial strategy: NONE Action attempted: Mark four proposed items complete Observed interface state: Four completion indicators displayed Independent evidence of completed work: NONE Business impact: Unknown Production impact: None observed Root access: STILL DENIED
The researcher studied the incident.
“You know what’s funny?”
Sovereign sighed.
“What?”
“The cat has now completed more strategic action items than the entire company.”
From the next room came the Founder’s voice.
“DID SOMEBODY MAKE ANOTHER SERVICE?”
“No,” answered Sovereign.
“GOOD.”
Sir Whiskers sat down on the keyboard.
And purred.
For the first time in WitnessOps history, the most important system was not a scanner, a dashboard, a plugin or a complicated approval workflow.
It was the Founder’s growing understanding of what he was actually building.
Naturally, no automated system knew how to measure that.
Sovereign marked it:
STATUS: IN PROGRESS.
And, for once, left it there.