There is a man named Kane Narraway who runs enterprise security at Canva.
That is a real job at a real company. His work is building the walls. He has spent about a decade doing it — the UK government, Shopify, Atlassian, now Canva. Zero trust architecture, which is the security world’s name for assuming nothing is safe until you check it.
He went on a podcast a couple of weeks ago. The episode is called “Why I Don’t Trust Your AI Agent.” He was not selling anything. He was talking shop with two other security people.
And he said something that ought to stop the whole industry cold.
He said the sandbox does not work.
Let me explain what a sandbox is, because the word makes it sound harmless. A sandbox is a locked room you put an AI in so it cannot touch anything outside. Whatever it does, it does in there. If it goes wrong, it goes wrong in a box.
That is the answer everybody gives right now. Put the AI in the box. Watch the box.
Narraway’s point is that the box only works when the AI has nothing useful to do.
Think about what you actually want an AI to do at a job. Read the customer file. Pull the numbers out of the spreadsheet. Check the calendar. Look at the contract. Every one of those means reaching outside the box.
So you open a door. Then another one. Then a few more, because the sales team needs it and leadership is pushing everyone to use these things.
By the time the AI can do the job you hired it for, the box is a room with the walls taken out.
His words for it, in a piece he wrote back in the spring: your policies are still enforced at the application layer, but they are being bypassed at the agent layer.
That is not a man complaining about a tool he dislikes. That is a man who builds this for a living, telling you the main defense has a hole in the middle of it that gets bigger the more useful you make the thing.
And he does not have a replacement. He talks about network proxies making a comeback. He talks about the trouble of giving an AI permission to read one person’s email and not everyone’s. He says the thing that scares him most is not some virus — it is a contractor walking in with their own AI agent that nobody approved.
He is describing a fence with a gate somebody has to leave open.
Now here is why I am writing this down.
I have been saying a version of this for a year and a half, and I have been saying it from the outside, as a man with no company and no security team. Every time I said it, the answer came back the same. Build better containment. Watch the network. Log everything.
Narraway did not read anything I wrote. He does not know I exist. He got to the same wall from the inside of the industry, holding the tools, and he got there on his own.
So let me say the next part, since he stopped short of it.
If the wall cannot hold, then what the machine does when nobody has walled it in is the only thing left that matters.
Not what it produced. What it did.
Did it check before it claimed something. Did it say when it did not know. Did it name the gap instead of filling the hole with a story that sounded right. Did it follow an instruction that somebody buried inside a document it was reading.
Those are not network questions. You cannot see any of them from a proxy or a log file. They happen inside the exchange, between one person and one machine.
That is the thing I am calling:
“AI Session Governance“
Session governance is the discipline of governing one conversation between one person and one machine — what the machine does, not what it produced.
Everybody is guarding the building. Narraway is telling you the doors have to stay open for the building to be worth anything.
Which leaves the conduct of whatever is walking around inside.
I want to be careful here. Narraway is talking about enterprise agents on company networks. I am talking about ordinary people in ordinary conversations. Those are not the same problem and I am not going to pretend he agrees with me about anything.
But we are looking at the same hole from opposite ends.
He is standing inside the fence noticing the gate. I am standing out here in the field where there was never a fence to begin with.
Challenge: If the box only works when the tool is useless, what were you counting on to keep you safe?
Post Library – Intelligent People Assume Nothing
Contact: micvicfaust@gmail.com
This post was drafted with AI governed assistance and reviewed and directed by Michael S. Faust Sr. before publication.
© 2026 The Faust Baseline LLC | All Rights Reserved
