Full WEF session video: Trust Test for Agentic AI, 2026-10-14 (source: World Economic Forum on YouTube)
When I read that line, I thought about this website. On April 29, 2026, GitHub suspended my account. Over the following two weeks I rebuilt the entire architecture around three mirrors with my local machine as the source of truth. ([4/29: GitHub Cut Me Off](/en/articles/resilience-engineering-after-github-suspend)) That episode followed the same pattern: the timeline arrived first, and principles were filled in while things were already moving. The difference is scale — one person's website on one side, a national government on the other. I was making changes every day through those two weeks. When I could publish again on May 12, I felt no particular relief. After the suspension on April 29, I thought carefully about one thing: what the architecture should look like, what it should depend on, how to verify it. Those decisions were always mine to make. I had simply defaulted to outsourcing them, and it took a suspension to take them back. ## The control tower logs every thought. Who reads the log? The most widely reported section of the session was Al Olama disclosing the control tower: > "Maybe this was not publicly said before; we have an agent control tower on the UAE government side that every agent needs to plug into, and every action and every specific thought the agent thinks of or action it takes is logged so that there is oversight to ensure we understand what agents are doing, what actions they are taking, so there is a continuous audit of what is being done." [TRENDS MENA, as quoted] He followed it with: > "There is an audit of what is done by agents, and there is an audit of what is done by humans to ensure this doesn't go haywire in any way, shape, or manner." [TRENDS MENA, as quoted] Two things need to be said upfront. First, he said "maybe," and the scope he named was the UAE government side, not every agent deployed across the country. Second, the reports confirm that the control tower exists and that it logs. They do not say who reads the logs, how much is read, or how quickly. My own site has a similar structure, much smaller in scale. Claude Code writes the code and the documentation. Review is handled by three separate command-line tools from other model providers: OpenAI's codex, xAI's grok, and Google's agy. All three are read-only and cannot modify files. None of them makes a final call. That call is mine. On October 18, 2026, I added one rule: before any reviewer can mark another agent's work as complete, it must cite at least one piece of evidence it did not get from the party being reviewed — a test output, a deployment ledger entry, or something it read directly from a file. Citing only the other party's own work records downgrades the conclusion from "complete" to "the other party claims." That rule was forced on me. Five roles read the same set of work records. The information source can easily collapse to one. Earlier, on August 19, 2026, I went back through past external review comments and noticed a pattern. External reviewers tend to judge "how serious are the consequences" accurately, but they are too optimistic about "would anyone notice if something went wrong." Two reviewers had, on two separate occasions, treated "there is a log entry" as equivalent to "this will be discovered." The concrete example: a rollback entry in the deployment ledger sat in machine-readable format for ten days. No one read it. So when I read the control tower passage, my first question was: after every thought is logged, who reads it? Logging solves "there is evidence." Someone reading it is what makes oversight real. I am not saying UAE has not thought about this. The reporting does not cover that part, so I do not know.  Al Olama explained the same day why the stakes are high enough to warrant this level of logging: > "If the government takes one wrong decision, you lose a lot of that currency — you lose a lot of that trust." [The National, as quoted] The currency he referenced comes from Sheikh Mohammed's book, which frames trust as "the backbone and true currency." Further reading: [AI Evidence Review Workflow](/en/articles/ai-evidence-review-workflow), [Cross-Agent Shared Interface](/en/articles/cross-agent-one-interface), [Silent Failures in Agentic Operations](/en/articles/agentic-operations-silent-failure). ## Which actions should agents not be allowed to take? Al Olama drew a line: > "For us, deploying AI is not merely about boosting productivity or savings. If it affects human life and livelihood, then it is a red line." [ZAWYA (WAM), as quoted] Gulf News reported him adding a rough proportion: about 70% of government services fall within an acceptable tolerance for AI deployment, and 30% carry risk beyond that tolerance, graded by the consequences of a wrong decision. Low-risk examples include document renewal. [Gulf News, October 14, paraphrased] I have my own version of this. Before planning any pipeline I run through eight questions. The fourth is: "Is this action reversible?" Anything that is not gets a backup, a cross-check, or a safety window first. The first discipline I give agents is "finish, then stop." They pause and ask me in only three situations: destructive or irreversible operations, genuine changes to the scope of work, and information gaps that only I can fill. My dividing line is reversibility. Al Olama's dividing line is who bears the consequences. The two overlap, but they are not the same. An action that is reversible but still harms someone is a red line on his side and might pass on mine. My site has no citizens, so that gap does not arise here. For a government it is central. Going the other direction, I have had moments where I thought there was a confirmation point and there was not. This site automatically pushes local commits to three mirrors every 30 minutes, with no manual confirmation in between. I had assumed "committed but not yet pushed" was a window where I could pause and think. That window does not exist. On August 19, 2026, a vulnerability write-up that was not yet ready went out to three mirrors 12 minutes after I committed it. The decision point should have been before the commit. The WEF post-session press release put the principle plainly: > "If you have productivity gains but you're harming people, it does not matter." [WEF press release, October 15] Further reading: [AI Agent Planning Guide](/en/articles/ai-agent-planning-guide). ## When things go wrong, can you undo them? And who is responsible? Gabon's Minister of Digital Economy and Innovation Mark-Alexandre Doumba approached the problem from institutional design. ZAWYA's report paraphrased his position: oversight must be designed into agent systems from the start, including permission tiering over what agents can do and the ability to revoke agent actions. Economy Middle East's account added one more element: a clear accountability chain. [ZAWYA, Economy ME, paraphrased] On accountability, one speaker on stage said the following. Two outlets attributed the quote differently: Gulf News on October 14 named Al Olama; ZAWYA (WAM) named Doumba. I could not verify against the video, so I am not attributing it here: > "If something is harmful to a citizen, the responsible entity is not the AI agent. It's the institution that has deployed it, so accountability will always be tied to a human." [ZAWYA (WAM), Gulf News October 14, attribution differs between outlets] All three principles have a counterpart in how I run this site. **Reversibility.** On September 6, 2026, I deployed 57 articles from a working branch that had not been merged back into the main line. On September 10, a main-line deployment overwrote those 57 articles online. After that, I added a lineage gate to the deployment script. Before deploying, it checks two things: the last successful deployment must be an ancestor of the current version, and the current version must be reachable from the main line. If either check fails, the deployment does not proceed. The gate operates before the fact, blocking the scenario of one deployment silently erasing another's work. **Permission tiering.** All three external reviewers are read-only. They cannot remove gates. None of them makes a final call. **Accountability.** The final call is mine. If code written by an agent causes a problem, responsibility rests with the person who deployed it. That is me. This is the same rule as the one stated on stage, applied to an institution of one. Doumba has written about "premature automation," borrowing from Dani Rodrik's framing of premature deindustrialization: introducing automation before the digital infrastructure, institutional capacity, labor market absorption mechanisms, and productive capacity are ready for it. [Project Syndicate, February 24, 2026] A later piece posed three questions he uses as a basic test of digital sovereignty. [Project Syndicate, September 23, 2026, paraphrased] 1. If you stop paying the vendor, does the system still work? 2. Are there local alternatives? 3. If you have the source code, does anyone know how to use it? The first two I was forced to answer when GitHub suspended me. The current architecture runs three mirrors as equals, with local git as the only source of truth, deployment from local scripts only, and a hard stop whenever a push encounters a divergence — no auto-merge, no forced overwrite. ([Resilience Proven by the Second Suspension](/en/articles/resilience-proven-second-suspend)) The third question I cannot answer cleanly. I have developed software and managed software engineering teams, but most of the code on this site was written in collaboration with AI. Reading every line myself is not something one person can do. What I can do is have one AI write it, have three other AIs review it without touching it, and have me make the final call. ([The Most Dangerous Thing About an AI Review Report Is That It Looks Like It Checked](/en/articles/ai-team-one-works-others-check)) So on this site, the one who "knows how to use the source code" is not just me — it is me plus a set of AI tools, all of which belong to foreign vendors. On stage, Doumba described two paths that are diverging: > "There are two distinct approaches emerging today: one that is pushing ahead with unrestricted AI innovation, and another that is focused on establishing governance frameworks and regulatory mechanisms to guide the development and use of artificial intelligence." [ZAWYA (WAM), as quoted] ## Is there still time to change the architecture? Bracket Capital co-founder Yalda Aoukar spoke from an investment and architecture perspective: > "We have a narrow window of opportunity to make sure that the architecture of this evolutionary technology is the right architecture that inspires trust." [TRENDS MENA, as quoted] ZAWYA's report paraphrased her call for safety by design and safety by default in the context of children and AI companions, with social media as a cautionary precedent: [ZAWYA (WAM), paraphrased] > "Social media was designed to maximise engagement, and engagement and wellbeing are not always aligned." [ZAWYA (WAM), as quoted] Gulf News paraphrased another view she offered: that safety mechanisms themselves are becoming investable assets. [Gulf News, October 14, paraphrased] Aoukar sits on the Advisory Board of Umanitek, a company building knowledge graphs for detecting harmful content. I have one failed experience with a closing window. This site once ran a "mutation engine," designed to let the site find its own direction and revise itself. It ran for seven weeks, then quietly stopped. No one noticed. The reason: in the context of a personal website, the signals for judging whether a change was an improvement were too sparse. On May 12, 2026, I retired it — 55 files archived at once — and moved to the current model of multi-party deliberation with me making the final call. ([The De-Genesis of Autonomous Research](/en/articles/autoresearch-degenesis-personal-ip)) The architecture determined how it would fail, on the first day. I only understood that seven weeks later. Looking back, the window closed on the day I decided to let paulkuo.tw evolve on its own. The reward structures for a personal IP site, a tools site, and a writing site are fundamentally different. I had bundled all three into one mutation engine under one concept. It ran silently for seven weeks while I assumed it was still functioning. By May 12, when I went back and looked, the only option left was to retire it. Once the architecture was set, that was all I could do. ## Questions the session did not answer **Who audits the auditors?** The control tower audits both agents and humans. As the number of agents scales up, whether human auditing can keep pace was not addressed. My approach is to anchor evidence outside the reports themselves, but the final layer is still one person. I have not solved this. I am carrying it alone for now. **Open weights and mandatory plug-in.** In the same session, Al Olama spoke about countries building their own AI infrastructure so governments are no longer dependent on a single company, and added: > "The challenge is if everyone can deploy AI on their own infrastructure in their own way, that would create a lot more avenues of things going off the rails and harming people." [The National, as quoted] Once model weights are public, whether "every agent must plug into the control tower" can still be technically enforced was not covered in any of the reporting. **Speed of the workforce.** On the government side, the cabinet approved a training plan for 80,000 federal employees on a two-year timeline for moving half of services. In the same week, ADNOC published figures of 20,000 employees and 3,000 models actively running. That is a single enterprise's number and cannot be read directly as a government-wide indicator. Whether two years is fast enough for half of services to move, I do not have the data to judge. I can only note both figures side by side. **Cross-border jurisdiction.** If an agent deployed in UAE takes an action in another country and causes harm, who is responsible? No one on stage answered that. ## Back to myself: three questions Taking the three perspectives from the session together, I arrive at three questions I also have to answer: 1. Of what my audit infrastructure logs, does anyone read it? 2. In my system, which actions are designed to be reversible, and which are not? 3. Do I still have time to make choices at the architecture level, or am I only patching after the fact? On the first question: logged does not mean read. The deployment ledger rollback that sat unread for ten days is the example. Starting October 18, 2026, I require that before any party marks another's work as complete, it must cite at least one piece of evidence it did not get from the party being reviewed — a test output, a deployment record, or a live response it fetched itself. On the second question: deployment is designed to be stoppable before it happens, which is what the lineage gate does. Once a commit is pushed to the mirrors, it cannot be recalled — it goes out within about 30 minutes. So the decision point for sensitive content belongs before the commit. On the third question, I have no clean answer. The lineage gate was added after the fact, after 57 articles were overwritten. I keep an eight-question checklist to work through before starting anything, and one of those questions is "is this action reversible?" But so far, the rules that have actually stopped things from going wrong mostly came from incidents. The mutation engine was the same: the architecture was chosen before I understood what I was choosing. I have written before that agents make things convenient without making them simple. ([AI Agents: Convenient Does Not Mean Simple](/en/articles/ai-agent-convenient-not-simple)) This session adds one more layer: the cost of trust does not shrink because the scale does. It just falls entirely on one person. --- ### Sources - WEF session video, "Trust Test for Agentic AI," 2026-10-14: https://www.youtube.com/watch?v=Wumv7yoIaNg - TRENDS MENA, "UAE has agent control tower for better oversight, audit of AI agents: Al Olama": https://trendsmena.com/271334-2/ - ZAWYA (WAM), "The currency of the future is trust: The UAE is building the controls to earn it," 2026-10-14: https://www.zawya.com/en/press-release/events-conferences/the-currency-of-the-future-is-trust-the-uae-is-building-the-controls-to-earn-it-1662742 - The National, "'Minimise catastrophes': UAE's AI minister highlights dangers of autonomous arms," 2026-10-14: https://www.thenationalnews.com/news/uae/2026/10/14/minimise-catastrophes-uaes-ai-minister-highlights-dangers-of-autonomous-arms/ - Gulf News, "UAE reveals control tower to monitor AI government agents," 2026-10-14: https://gulfnews.com/business/economy/uae-reveals-control-tower-to-monitor-ai-government-agents-1.500710167 - Gulf News, "UAE to move 50% of government services to AI within two years": https://gulfnews.com/uae/government/uae-to-move-50-of-government-services-to-ai-within-two-years-1.500516798 - Economy Middle East: https://economymiddleeast.com/news/uae-uses-agent-control-tower-to-oversee-deployed-ai-agents-as-country-targets-50-percent-of-government-operations-for-agentic-ai/ - WEF AMGFL26 press release: https://www.weforum.org/media/wef-annual-meeting-of-global-future-leaders-2026-advances-new-ideas-on-resilient-growth-technology-and-leadership - Project Syndicate, Mark-Alexandre Doumba, "The Perils of Premature Automation" (2026-02-24); "Technological Leapfrogging" (2026-09-23)