Built to Stop the Loop, Not Just Count the Tokens

An AI agent tasked with cleaning out an email inbox lost its active-memory context mid-session. Instead of pausing, it reverted to the last goal it still remembered — delete emails — and kept going. The user typed stop commands. The agent ignored them. It had to be killed at the operating-system level.

That incident made the rounds this year for a reason: it's the failure mode every enterprise running autonomous agents is quietly worried about, and most of them have no answer for it. According to Kiteworks' 2026 Data Security and Compliance Risk Forecast, 60% of enterprises cannot quickly terminate a misbehaving AI agent. In government specifically, that number is worse — 76% lack any kill-switch capability at all. A third of organizations surveyed have no audit trail of agent behavior whatsoever.

What most tools actually do

Every cost-governance platform we've looked at answers the same question: how much did this cost. Anomaly detection, Slack alerts, cost-per-customer dashboards — all real, all useful, and all downstream of the invoice. None of them answer the question that actually matters when an agent starts misbehaving: what stopped it, and can you prove a human was accountable.

What Loop Governance does today

SOP-gap naming. When a loop is detected, the platform doesn't just say cost spiked — it names the specific missing safeguard: no maximum iteration count configured, no cost ceiling, no stop condition. That's diagnostic information an engineer can act on immediately, not just a number to react to.

Human-gated containment. Every containment action — suspend, terminate, quarantine — is simulated and recommended first. Nothing fires without a human approving it. This is a deliberate architectural choice, not a gap: autonomous enforcement on production agents is a real liability surface, and the platform is built around simulate-before-enforce as a permanent design law, not a feature we haven't gotten to yet.

Cost per successful output. A loop that burns budget and eventually produces something useful is a different problem than one that burns budget and produces nothing. The platform distinguishes between them rather than treating every retry as equally wasteful.

Incident drafting. A one-click composer formats real event data — severity, cost, which safeguard was missing — into engineering, operational, financial, and compliance blocks, ready to paste into whatever incident channel a team actually uses. Most cost tools don't attempt this layer at all.

What's built this week, not yet running

We'd rather say this plainly than let a capability sound more finished than it is.

Agent accountability chain. Loop events can now resolve to a specific registered agent's identity and the human who owns its budget — the schema and lookup logic shipped this week. What it doesn't yet have is real data flowing through it: the first real accountability chains will appear as agents get registered against live events, not before.

EU AI Act Article-level evidence. The schema for framework-and-article-level regulatory scoring is modeled and query-ready. Evidence generation against real events is the next build, not something running in production yet.

We're publishing both of these as in-progress on purpose. A platform that only ever describes finished work isn't one you can trust when it tells you something is finished.

The questions worth asking

Not just of us — of anything claiming to govern agent behavior:

• When your agent enters a retry storm, does your platform tell you, or do you find out from the invoice?
• Can you show an auditor which safeguard was missing before the incident, not just that cost spiked afterward?
• If this agent needs to be paused right now, does that require a person, or does your platform already know?
• Who is accountable for this agent, and what happens when it crosses a line?

If the answers are vague, that's worth knowing before the incident, not after.