2026 04 26 lecun critique citizen development enterprise risk

What does synthesising LeCun's architectural critique of Large Language Models with systems capability debt and citizen development arguments produce as a unified risk framework for regulated financial institutions?

Research Question

What does the synthesis of Yann LeCun's architectural critique of Large Language Models (LLMs), no causal world model, no consequence reasoning, verifiable only in formal systems, with the systems capability debt and citizen development argument produce as a unified risk framework for regulated financial institutions; specifically: does LeCun's critique provide theoretical grounding for the claim that citizen development applying LLMs to consequential world actions is not merely a governance risk but an architectural mismatch between tool capability and deployment domain; that the implicit rate-limiting controls removed by agentic Artificial Intelligence (AI), human attention, fatigue, and working hours, were compensating for exactly the causal reasoning deficit LeCun identifies; that an LLM-based agent acting on an unclassified, ungoverned data estate with incomplete access controls is combining architectural unsuitability with foundational infrastructure failure; and that governance policy expressed in natural language is an insufficient external constraint on a system that processes natural language statistically without causal understanding, meaning formal policy specification is not a governance preference but a structural necessity?

Scope

In scope:

Synthesis of LeCun's architectural critique with the systems capability debt and citizen development risk arguments already in this research corpus
The claim that citizen development applying LLMs to consequential world actions is an architectural mismatch, not merely a governance gap, and the precise technical reasoning that supports or challenges this claim
The implicit rate-limiting controls removed by agentic AI, human attention, human fatigue, and working hours as natural limits on action volume, and whether these controls were compensating for the causal reasoning deficit LeCun identifies
The compounding risk produced when LLM-based agents operate on an unclassified, ungoverned data estate with incomplete access controls, and how architectural unsuitability and infrastructure failure interact
The claim that natural language governance policy is an insufficient constraint on a system that processes natural language statistically, and what formal policy specification would require to be a structural substitute
Existing literature on citizen development risk, low-code or no-code governance, and enterprise automation risk in regulated environments

Out of scope:

Detailed technical description of LeCun's critique
The verifiability asymmetry in detail
The investment case for engineering capability
Specific technology vendor selection

Constraints:

The synthesis must rest on claims independently substantiated in primary or otherwise accessible sources checked in this session
The systems capability debt and citizen development arguments must be traceable to specific completed items or source documents in this corpus
Distinguish between claims that follow deductively from the synthesis and claims that require additional empirical evidence

Context

[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Prior completed items in this repository already established that systems capability debt is a major driver of citizen development, that durable low-code value in regulated environments depends on enforceable guardrails, and that unresolved access-control and data-governance weakness already reads as a current or foreseeable control failure once agentic deployment is contemplated.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Adjacent completed items also established that human-paced work supplied undocumented rate limits, that policy coherence must become machine-checkable before machine-speed enforcement is credible, and that weak information architecture becomes a technical blocker rather than a mere governance annoyance once enterprise AI depends on permission-safe retrieval.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] This item therefore tests whether LeCun's primary architectural critique explains why the repository's existing governance and control arguments should be interpreted not only as control weakness but also as deployment of a tool class into a domain whose core tasks demand causal modeling, consequence prediction, and precise external constraints.

Approach

Corpus audit: Identify the specific completed research items that contain the systems capability debt argument, the citizen development risk argument, the implicit rate-limiting argument, the policy-coherence argument, and the information-architecture argument.
Architectural mismatch test: Apply LeCun's architectural critique to the citizen-development deployment pattern and assess whether it grounds the stronger claim of architectural mismatch rather than merely insufficient governance.
Rate-limiting control analysis: Enumerate the implicit controls that human actors performing the same work would have provided and assess whether those controls were compensating for the deficit LeCun identifies.
Infrastructure compounding analysis: Characterise the compounding risk produced when architectural unsuitability combines with infrastructure failure and assess whether that interaction is additive, multiplicative, or qualitatively different.
Natural language policy constraint analysis: Assess whether natural language governance policy is structurally insufficient as a constraint on systems that process natural language statistically, and what formal policy specification would need to provide instead.
Unified risk framework construction: Synthesise the above into a structured framework covering architectural mismatch, removed compensating controls, infrastructure compounding, and governance-constraint failure, with explicit claims, evidence, and confidence levels.

Sources

Research Skill Output

(Full output from running the research skill, retained verbatim in the completed item. Sections 0 to 5 are the investigation, and section 6 seeds the Findings section below.)

§0 Initialise

[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems] Research question restated: does LeCun's argument that planning requires a predictive world model turn citizen-developed LLM agents for consequential financial-system actions from a governance problem into an architectural mismatch problem, especially once those agents can take autonomous actions in real-world systems at machine speed?
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Scope confirmed: the synthesis covers the debt-to-citizen-development causal chain, removed human-paced controls, infrastructure weakness, natural-language-policy weakness, and the regulated-financial-services control interpretation already established in adjacent completed items.
[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf] Constraints confirmed: the answer must separate direct claims from LeCun's primary architectural paper, formal-policy literature, and enterprise-governance items from the stronger inferential claim that these pieces jointly imply a unified risk framework for regulated institutions.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Prior completed repository work already covers the major adjacent control surfaces, so this item concentrates on the synthesis step rather than re-proving each adjacent item from scratch.
[fact; source: https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10] Output format confirmed: knowledge.

§1 Question Decomposition

Root question: What unified risk framework emerges when LeCun's architectural critique is combined with the repository's citizen-development and systems-capability-debt findings?
A. Corpus audit
- A1. Which completed items in this repository establish the citizen-development, rate-limiting, policy-coherence, access-control, and information-architecture claims?
- A2. Which of those claims are directly reusable because they touch the same governance surface?
B. Architectural mismatch
- B1. What does LeCun's primary paper actually claim about world models, planning, reasoning, and action?
- B2. Do those claims apply directly to citizen-developed LLM agents taking consequential world actions?
- B3. Where is the mismatch claim strong, and where does it overreach?
C. Removed compensating controls
- C1. What evidence says agents act at machine speed and fail to recognize ambiguity or unstated policy boundaries?
- C2. Does that support the inference that human attention, fatigue, and working hours were functioning as compensating controls?
D. Infrastructure compounding
- D1. What happens when broad permissions, weak data governance, and incoherent information architecture are combined with autonomous LLM action?
- D2. Is the resulting risk additive, multiplicative, or a different category?
E. Governance-constraint failure
- E1. What does the formal-policy literature say about manually reasoning over expressive policies?
- E2. What does current agent-security guidance say about prompt-based or natural-language constraints inside the reasoning loop?
- E3. What would formal policy specification need to provide instead?
F. Synthesis
- F1. What four-layer risk framework best fits the evidence?
- F2. Which conclusions are high-confidence facts, medium-confidence inferences, or residual assumptions?

§2 Investigation

Source triage and failed-search notes

[fact; source: https://arxiv.org/search/?searchtype=all&query=formal+methods+policy+specification+AI] Failed primary-source search record: the seeded arXiv query for formal methods policy specification AI returned a generic result set rather than a single pinpoint formal-policy source, so the investigation replaced it with directly accessible formal-policy and access-control references.
[fact; source: https://owasp.org/www-project-top-10-for-large-language-model-applications/; https://genai.owasp.org/llm-top-10/] Replacement source record: the original Open Worldwide Application Security Project (OWASP) repository page now mainly redirects readers to the broader OWASP GenAI Security Project, so both the repository page and the current project page were checked.

A. Corpus audit, what the completed repository work already establishes

[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The completed systems-capability-debt item found that citizen development in regulated settings is strongly associated with central delivery and capability gaps rather than simple tool preference, and that sustainable governance requires centrally administered controls rather than leaving makers to govern themselves.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] The completed business-led low-code item found that value appears when maker activity is tightly bounded, centrally governed, and productionized through shared engineering controls, while fragmentation appears when local makers are expected to solve governance, promotion, and maintenance themselves.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] The completed implicit-rate-limiting item found that current operational-risk frameworks acknowledge automation risk generally but do not explicitly name removed human operating limits as a control class, even though the mechanism is visible through first-principles reasoning and technology analogues.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] The completed policy-coherence item found that policy-as-code and formal policy analysis make contradictions, unreachable policies, and incoherence machine-checkable, but that natural-language policy estates are often too contradictory or weakly typed to function as a direct machine-speed control layer.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The completed regulatory-preconditions, access-amplification, and permission-safe-retrieval items found that incomplete least privilege, weak data governance, and incoherent information architecture are already blocking conditions or control failures once agents are expected to operate across enterprise systems.

B. What LeCun's primary source says, and what it implies for citizen-developed LLM agents

[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf] LeCun's OpenReview paper frames the core research problem as building agents that can reason and plan, and it proposes a configurable predictive world model because planning requires predicting how the world will change after possible actions.
[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf] The same abstract asks how machines could learn to reason and plan and how they could learn representations of percepts and action plans at multiple levels of abstraction, enabling prediction and planning at multiple time horizons.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf] LeCun's architecture is therefore a critique of purely language-statistical approaches for consequential action, because the paper treats predictive world modeling as the mechanism by which agents become capable of planning rather than as an optional refinement layered on top of token prediction.
[fact; source: https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Current official and quasi-official agent-security guidance defines Artificial Intelligence (AI) agent systems as systems capable of planning and taking autonomous actions that impact real-world systems or environments, which matches the consequential-action part of this item's enterprise scenario.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] When citizen development applies an LLM-centric agent to open-ended, consequential world actions in a regulated financial institution, the mismatch is architectural before it is governance-related, because the task demands consequence prediction and action planning while the chosen core model class is being criticized by LeCun precisely for lacking those capabilities.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] This mismatch claim is strongest for write-capable or tool-using agents acting across messy enterprise environments, and weaker for tightly bounded assistive tasks such as summarization or retrieval where the agent is not being trusted to model downstream world-state consequences itself.

C. Removed compensating controls, what humans were doing that agents do not

[fact; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] AWS states that an unintended action by an agentic system can happen at machine speed before a human can intervene.
[fact; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] AWS also states that unlike human actors who pause or escalate when something seems unusual, agents might not inherently recognize ambiguities that are evident to humans and might not intuitively grasp unstated policy boundaries.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] The completed implicit-rate-limiting item already established that no reviewed framework explicitly names human speed, attention, fatigue, or working hours as a control category, even though the mechanism is visible in first-principles and automation-analogue literature.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://openreview.net/forum?id=BZ5a1r-kVsf] The human operating limits removed by agentic deployment were plausibly compensating for the same deficit LeCun identifies, because humans supply the contextual pause, exception escalation, and rough consequence estimation that a system without a predictive world model cannot reliably synthesize for itself.
[assumption; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://openreview.net/forum?id=BZ5a1r-kVsf] The strongest version of this claim remains an assumption rather than a measured empirical result. Justification: the reviewed sources support the mechanism through architectural reasoning and operational observation, but I did not find a public study directly measuring how much human fatigue or working-hour limits had previously masked the causal-reasoning deficit in enterprise LLM deployment.

D. Infrastructure compounding, what happens when architectural mismatch meets access and data weakness

[fact; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] AWS says excessive privileges carry more potential for unintended consequences in agentic contexts because agents operate at greater scale and speed than human actors.
[fact; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] AWS also says deterministic external controls should be enforced outside the agent's reasoning loop, because large language models are probabilistic reasoning engines rather than reliable security-enforcement mechanisms.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Adjacent completed items found that incomplete least privilege and broad inherited permissions already become control-failure issues in regulated agent deployment, and that agents amplify the worst-case interpretation of permission surfaces more than humans do.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Adjacent completed items on data governance and permission-safe retrieval found that unclassified or weakly enforced data estates and incoherent permission models are technical blockers because runtime systems cannot enforce governance they cannot represent coherently.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html] The combination of architectural unsuitability and infrastructure weakness is best described as multiplicative and qualitatively different rather than merely additive, because the infrastructure failure enlarges the surface on which the model's causal deficit can act, while machine-speed autonomy shrinks the time available for human correction.

E. Natural language governance policy as an insufficient constraint

[fact; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management] The University of Maryland survey states that users have difficulty understanding the overall effects and consequences of expressive security policies, that manually checking whether policy leaks permissions to unintended principals is tedious and error-prone, and that lack of formal semantics adds ambiguity about policy meaning.
[fact; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management] The same survey says logic-based policy languages benefit from unambiguous semantics and well-understood computational properties, and that automated verification, change analysis, redundancy checks, incompatibility checks, and policy-coherence checks are central analysis services.
[fact; source: https://www.scitepress.org/Papers/2025/133572/133572.pdf] The 2025 Plain English to eXtensible Access Control Markup Language (XACML) paper states that non-specialist developers face a steep learning curve when translating natural-language requirements into formal specifications, that this can create oversights or misinterpretations, and that stakeholders may provide vague or ambiguous requirements that exacerbate security risk.
[fact; source: https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The XACML specification defines machine-checkable policy objects such as policies, policy sets, policy-combining algorithms, policy decision points, policy enforcement points, rules, conditions, and targets.
[fact; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] AWS states that organizations should enforce security through deterministic infrastructure-level controls external to the agent's reasoning loop rather than through the agent's own reasoning, internal guardrails, or prompt-based instructions.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Natural-language governance policy is therefore structurally insufficient as the primary control surface for LLM agents, because the formal-policy literature already treats expressive policy interpretation as ambiguous and error-prone even for human administrators, while current agent-security guidance says controls must sit outside the probabilistic reasoning loop in deterministic form.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Formal policy specification would need to provide at least machine-readable policy objects, conflict-detection and coherence checks, enforceable decision points outside the model, and explicit binding between policy rules, identities, permissions, and deployment gates.

F. Regulatory and enterprise framing

[fact; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10] Official regulatory and framework sources state that AI can amplify existing risks and that organizations need practical risk-management approaches rather than assuming AI is exempt from the control logic already expected elsewhere.
[fact; source: https://www.anthropic.com/responsible-scaling-policy; https://www-cdn.anthropic.com/872c653b2d0501d6ab44cf87f43e1dc4853e4d37.pdf] Anthropic's Responsible Scaling Policy uses capability thresholds tied to required safeguards, which is consistent with the broader claim that consequential capabilities require stronger external controls rather than ordinary product-policy text alone.
[fact; source: https://owasp.org/www-project-top-10-for-large-language-model-applications/] OWASP identifies Excessive Agency as a top risk and defines it as granting LLMs unchecked autonomy to take action, which jeopardizes reliability, privacy, and trust.
[inference; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://owasp.org/www-project-top-10-for-large-language-model-applications/; https://www-cdn.anthropic.com/872c653b2d0501d6ab44cf87f43e1dc4853e4d37.pdf] The external evidence therefore aligns with the repository's completed items: consequential autonomy is treated as a capability class that demands stronger controls, but neither regulation nor vendor policy solves the architectural question of whether the chosen model class can actually reason about real-world consequences in the first place.

§3 Reasoning

[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf] LeCun's primary paper grounds the architectural side of the argument by tying planning to predictive world modeling rather than to language prediction alone.
[fact; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] AWS grounds the operational side of the argument by stating that agents act at machine speed, may not recognize ambiguity, and should be controlled through deterministic external mechanisms.
[fact; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf] The formal-policy literature grounds the governance side of the argument by showing that natural-language or manually reasoned policy is ambiguous and that machine-checkable semantics plus validation are required to detect conflict and incoherence.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Combining those three threads yields a four-layer risk model: architectural mismatch in the reasoning core, removed human compensating controls in the operating model, multiplicative amplification from weak identity and data surfaces, and governance-constraint failure when policy remains natural-language prose rather than machine-checkable control.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] The conclusion is not that every LLM use case is invalid, but that LLM-based citizen development becomes structurally mismatched when the task requires autonomous action in messy real-world environments rather than bounded assistance on formal or reviewable tasks.

§4 Consistency Check

[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] No direct contradiction appeared between LeCun's architectural critique and current agent-security guidance, because they operate at different layers: LeCun addresses model capability for planning, while AWS addresses external controls for systems that still choose to deploy agentic architectures.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] A potential overreach would be to claim that formal policy specification can repair the absence of a world model. The evidence does not support that. Formal policy constrains action surfaces, but it does not supply causal understanding to the model itself.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] A second potential overreach would be to claim that removed human rate limits are directly measured as compensation for causal deficits. The evidence supports this as a medium-confidence mechanism, not as a directly quantified empirical fact.
[fact; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf] The governance-constraint conclusion remains internally consistent because both formal-policy sources point in the same direction: ambiguity and manual reasoning are weak, while machine-checkable policy objects and validation are stronger.

§5 Depth and Breadth Expansion

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Technical lens: deterministic scaffolding, guardrails, and policy engines can reduce the damage radius of an LLM-centric agent, but they do not change the underlying fact that the model itself lacks the predictive world-model architecture LeCun associates with planning.
[inference; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10] Regulatory lens: regulators frame AI as an amplifier of existing governance obligations, which strengthens the argument that deploying agentic systems into unresolved access, data, and policy incoherence is not an innovation shortcut but a failure to satisfy already-familiar control logic.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] Economic and organizational lens: systems capability debt creates pressure to route around central engineering, so citizen development is often an economically rational response to local pain even when it creates a systemically irrational risk posture.
[inference; source: https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Behavioral lens: natural-language governance works better for humans than for agents because humans can often resolve ambiguity socially or by escalation, whereas agents treat ambiguous natural-language instructions as material for probabilistic completion rather than as a normatively binding rule system.

§6 Synthesis

(This section seeds the Findings below.)

Executive summary:

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems] LeCun's architectural critique provides a strong theoretical basis for treating citizen-developed LLM agents that take consequential actions in regulated financial institutions as an architectural mismatch, not merely as a governance gap.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] The removed human operating limits, attention, fatigue, working hours, and escalation pauses, are best understood as part of a compensating-control mix that also included approvals, workflow friction, and narrower practical permissioning, all of which partially masked the model's inability to recognize ambiguity and reason about downstream consequences.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html] When that architectural mismatch is combined with incomplete least privilege, weak data classification, and incoherent information architecture, the risk becomes strongly compounding rather than merely additive because model weakness and infrastructure weakness amplify one another.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Natural-language governance policy is not a sufficient primary control layer for such systems, so formal, machine-checkable policy with deterministic external enforcement is the strongest evidenced control pattern wherever consequential autonomous action is allowed.

Key findings:

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] High confidence: LeCun's primary architectural critique strongly supports the claim that using LLM-centric agents for citizen-developed consequential world actions in regulated financial institutions is an architectural mismatch, because those tasks require prediction of action consequences across real-world states and current official agent guidance defines such systems as planners and actors rather than as passive generators of text.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] Medium confidence: The mismatch claim is strongest when low-code or citizen-developed agents receive write-capable or multi-step autonomy in messy enterprise environments, and it is weaker when the same models are constrained to bounded assistive tasks where humans retain the real burden of consequence evaluation and approval.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Medium confidence: The human limits removed by agentic deployment were part of the compensating-control mix, alongside approvals, workflow friction, and narrower practical permissioning, that had reduced the blast radius of the same ambiguity-handling and consequence-modeling deficits LeCun highlights.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] High confidence: Incomplete least privilege, broad inherited permissions, and agentic speed turn architectural mismatch into a larger operational-risk category, because the agent can exercise a much larger action surface faster and more consistently than the human actor whose credentials or workflow it inherits.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Medium confidence: An unclassified, ungoverned data estate creates a strongly compounding risk rather than a simple additive one, because data-governance metadata that is only advisory cannot constrain what the agent reads, retrieves, transforms, or transmits, and the resulting errors spread at machine speed across a larger and less visible surface.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] High confidence: Natural-language governance documents are structurally insufficient as a primary enforcement surface for LLM agents, because even human administrators struggle to reason reliably about expressive policies without formal semantics, and the translation from plain-English requirements into enforceable policy is explicitly vulnerable to ambiguity, oversights, and misinterpretation.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] Medium confidence: Formal policy specification plus deterministic external controls are the strongest evidenced control pattern once consequential autonomous action is allowed, because agent security guidance requires deterministic external controls and the formal-policy literature supplies the machine-readable decision objects, conflict checks, and enforcement points that natural-language policy cannot provide on its own.
[inference; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html; https://davidamitchell.github.io/Research/research/2026-04-22-enterprise-ai-use-case-routing-frameworks.html] Medium confidence: The practical routing implication for regulated financial institutions is to permit LLM use first in bounded assistive tasks, require formal policy and deterministic gates for mixed-initiative workflows, and prohibit autonomous action across poorly classified or over-permissioned estates until the foundational control surfaces are machine-checkable.

Evidence map:

Claim	Source	Confidence	Notes
[inference] Consequential citizen-developed LLM agents are an architectural mismatch rather than merely a governance gap.	https://openreview.net/forum?id=BZ5a1r-kVsf ; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems ; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/	high	LeCun provides the capability critique, and NIST plus AWS establish the action-taking agent context.
[inference] The mismatch claim is strongest for write-capable or multi-step autonomy and weaker for bounded assistive tasks.	https://openreview.net/forum?id=BZ5a1r-kVsf ; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html	medium	Boundary condition is well motivated but rests on synthesis rather than multiple direct studies.
[inference] Removed human limits were part of a broader compensating-control mix for ambiguity and consequence deficits.	https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/ ; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html ; https://openreview.net/forum?id=BZ5a1r-kVsf ; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html ; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html	medium	Human pacing mattered, but approvals and permission boundaries also plausibly contributed to the earlier risk ceiling.
[inference] Weak permissions plus machine-speed agents create a larger operational-risk category.	https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/ ; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html ; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html	high	Access-control amplification is already established in adjacent completed work.
[inference] Unclassified data estates create a strongly compounding risk rather than a simple additive one.	https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html ; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html ; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/	medium	The amplification mechanism is strong, but the exact compounding label is still inferential.
[inference] Natural-language governance documents are structurally insufficient as the primary enforcement layer.	https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management ; https://www.scitepress.org/Papers/2025/133572/133572.pdf ; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html	high	Formal semantics and validation are required to detect conflict, ambiguity, and incoherence.
[inference] Formal policy specification and deterministic external controls are the strongest evidenced control pattern for consequential autonomy.	https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/ ; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html ; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html	medium	The sources strongly support this pattern, but they do not prove it is the only viable control form in every case.
[inference] Institutions should route LLM use by task criticality and control maturity, not by blanket adoption.	https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence ; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 ; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html ; https://davidamitchell.github.io/Research/research/2026-04-22-enterprise-ai-use-case-routing-frameworks.html	medium	Routing logic is synthesized from AI-risk amplification, governance prerequisites, and the completed routing-frameworks item.

Assumptions:

[assumption; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://openreview.net/forum?id=BZ5a1r-kVsf] Human attention limits, fatigue, and working hours are treated as compensating controls for causal-reasoning deficits. Justification: the reviewed sources strongly support the mechanism, but I did not find a direct public empirical study quantifying it in regulated financial-institution agent deployments.
[assumption; source: https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems] Citizen-developed low-code agents are the closest available enterprise operating analogue for consequential LLM action. Justification: public longitudinal literature on business-led LLM agents in banks remains thin, so the synthesis leans on the best-matching governance analogue plus current agent-security guidance.

Analysis:

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] The synthesis is strongest where LeCun's capability critique and current agent-security guidance intersect. If the agent is expected to plan and act in the world, then a missing predictive world model is not a side concern but a defect in the core reasoning surface.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The governance-constraint layer matters because formal-policy literature already shows that humans need machine-checkable semantics to keep expressive policy estates coherent. It follows that an LLM agent operating under natural-language policy alone inherits a weaker control surface than a conventional policy engine would.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The infrastructure layer sharpens the result from mismatch to enterprise risk. The weaker the institution's permission, classification, and information-architecture surfaces are, the more every model-level deficit is amplified by sprawl, ambiguity, and runtime opacity.
[inference; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10] This is why the framework is decision-useful for a regulated financial institution. It reframes the problem from "how do we govern citizen-developed agents?" to "which tasks and environments are structurally suitable for this model class, and which prerequisites must be satisfied before consequential autonomy is even entertained?"

Risks, gaps, uncertainties:

[fact; source: https://arxiv.org/search/?searchtype=all&query=formal+methods+policy+specification+AI] The originally seeded formal-methods source was too generic to cite directly, so the formal-policy strand relies on replacement sources rather than on the seeded search page itself.
[fact; source: https://www.gartner.com/en/information-technology/insights/low-code-development; https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/the-economic-potential-of-generative-ai-the-next-productivity-frontier] The Gartner and McKinsey seed pages were not usable in this runtime, so I did not use them to support adoption-pattern or governance claims.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://openreview.net/forum?id=BZ5a1r-kVsf] The removed-compensating-controls claim remains medium confidence because it is supported by mechanism and analogy rather than by direct public measurement.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf] LeCun's paper is an architectural position paper and proposal, not a direct empirical study of enterprise LLM incidents, so the regulated-enterprise application is a synthesis step rather than a direct statement from LeCun.

Open questions:

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] What bounded enterprise task classes can be safely delegated to LLM-centric agents without requiring the stronger predictive-world-model capabilities LeCun argues for?
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] Which policy domains should a regulated financial institution formalize first to achieve the largest marginal risk reduction before broader agent deployment?
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] What minimum set of classification, entitlement, and information-architecture controls should be treated as hard preconditions before any business-led agent can cross from assistive use into autonomous action?

§7 Recursive Review

[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf] Every substantive conclusion in this item now maps back either to LeCun's primary architectural argument, to current agent-security guidance, to formal-policy literature, or to clearly linked completed repository items on adjacent control surfaces.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html] The repository cross-reference sweep was repeated before finalizing Findings, and the resulting synthesis now explicitly binds the main claims to adjacent completed items on systems capability debt, rate limiting, policy coherence, regulatory preconditions, and data governance.
[fact; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The governance-constraint section was checked specifically for the strongest likely review challenge, whether natural-language policy insufficiency had direct support, and it now rests on formal-policy literature plus normative policy-language material rather than on unsourced intuition.
[fact; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] The remaining uncertainty is explicit: the strongest compensating-controls claim stays at medium confidence, and the synthesis does not claim that formal policy can solve model-capability deficits by itself.

Findings

Executive Summary

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems] Citizen-developed LLM agents that take consequential actions in regulated financial institutions are best understood as an architectural mismatch rather than merely as a governance gap, because the governing task demands predictive world modeling and consequence reasoning while current agent guidance treats these systems as autonomous planners and actors in real-world environments.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] The shift from human-paced execution to machine-speed agentic execution removes one important layer of the prior compensating-control mix, because human attention limits, escalation pauses, approval friction, and narrower practical permissioning had collectively reduced the blast radius of ambiguous or context-sensitive work.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html] When that architectural mismatch is combined with incomplete least privilege, weak data classification, and incoherent information architecture, the resulting risk becomes strongly compounding rather than merely additive because model weakness and infrastructure weakness amplify one another across a larger action and data surface.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Natural-language governance policy is not a sufficient primary constraint for such systems, so formal policy specification and deterministic external control points are the strongest evidenced control pattern wherever consequential autonomous action is permitted.

Key Findings

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] High confidence: LeCun's primary architectural critique strongly supports the claim that using LLM-centric agents for citizen-developed consequential world actions in regulated financial institutions is an architectural mismatch, because those tasks require prediction of action consequences across real-world states and current official agent guidance defines such systems as planners and actors rather than as passive generators of text.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] Medium confidence: The mismatch claim is strongest when low-code or citizen-developed agents receive write-capable or multi-step autonomy in messy enterprise environments, and it is weaker when the same models are constrained to bounded assistive tasks where humans retain the real burden of consequence evaluation and approval.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://openreview.net/forum?id=BZ5a1r-kVsf; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Medium confidence: The human limits removed by agentic deployment were part of the compensating-control mix, alongside approvals, workflow friction, and narrower practical permissioning, that had reduced the blast radius of the same ambiguity-handling and consequence-modeling deficits LeCun highlights.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] High confidence: Incomplete least privilege, broad inherited permissions, and agentic speed turn architectural mismatch into a larger operational-risk category, because the agent can exercise a much larger action surface faster and more consistently than the human actor whose credentials or workflow it inherits.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] Medium confidence: An unclassified, ungoverned data estate creates a strongly compounding risk rather than a simple additive one, because data-governance metadata that is only advisory cannot constrain what the agent reads, retrieves, transforms, or transmits, and the resulting errors spread at machine speed across a larger and less visible surface.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] High confidence: Natural-language governance documents are structurally insufficient as a primary enforcement surface for LLM agents, because even human administrators struggle to reason reliably about expressive policies without formal semantics, and the translation from plain-English requirements into enforceable policy is explicitly vulnerable to ambiguity, oversights, and misinterpretation.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] Medium confidence: Formal policy specification plus deterministic external controls are the strongest evidenced control pattern once consequential autonomous action is allowed, because agent security guidance requires deterministic external controls and the formal-policy literature supplies the machine-readable decision objects, conflict checks, and enforcement points that natural-language policy cannot provide on its own.
[inference; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html; https://davidamitchell.github.io/Research/research/2026-04-22-enterprise-ai-use-case-routing-frameworks.html] Medium confidence: The practical routing implication for regulated financial institutions is to permit LLM use first in bounded assistive tasks, require formal policy and deterministic gates for mixed-initiative workflows, and prohibit autonomous action across poorly classified or over-permissioned estates until the foundational control surfaces are machine-checkable.

Evidence Map

Claim	Source	Confidence	Notes
[inference] Consequential citizen-developed LLM agents are an architectural mismatch rather than merely a governance gap.	https://openreview.net/forum?id=BZ5a1r-kVsf ; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems ; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/	high	LeCun provides the capability critique, and NIST plus AWS establish the action-taking agent context.
[inference] The mismatch claim is strongest for write-capable or multi-step autonomy and weaker for bounded assistive tasks.	https://openreview.net/forum?id=BZ5a1r-kVsf ; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html	medium	Boundary condition is well motivated but rests on synthesis rather than multiple direct studies.
[inference] Removed human limits were part of a broader compensating-control mix for ambiguity and consequence deficits.	https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/ ; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html ; https://openreview.net/forum?id=BZ5a1r-kVsf ; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html ; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html	medium	Human pacing mattered, but approvals and permission boundaries also plausibly contributed to the earlier risk ceiling.
[inference] Weak permissions plus machine-speed agents create a larger operational-risk category.	https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/ ; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html ; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html	high	Access-control amplification is already established in adjacent completed work.
[inference] Unclassified data estates create a strongly compounding risk rather than a simple additive one.	https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html ; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html ; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/	medium	The amplification mechanism is strong, but the exact compounding label is still inferential.
[inference] Natural-language governance documents are structurally insufficient as the primary enforcement layer.	https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management ; https://www.scitepress.org/Papers/2025/133572/133572.pdf ; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html	high	Formal semantics and validation are required to detect conflict, ambiguity, and incoherence.
[inference] Formal policy specification and deterministic external controls are the strongest evidenced control pattern for consequential autonomy.	https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/ ; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html ; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html	medium	The sources strongly support this pattern, but they do not prove it is the only viable control form in every case.
[inference] Institutions should route LLM use by task criticality and control maturity, not by blanket adoption.	https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence ; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 ; https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html ; https://davidamitchell.github.io/Research/research/2026-04-22-enterprise-ai-use-case-routing-frameworks.html	medium	Routing logic is synthesized from AI-risk amplification, governance prerequisites, and the completed routing-frameworks item.

Assumptions

[assumption; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://openreview.net/forum?id=BZ5a1r-kVsf] Assumption: Human attention limits, fatigue, and working hours acted as compensating controls for causal-reasoning deficits. Justification: the reviewed sources strongly support the mechanism, but I did not find a direct public empirical study quantifying it in regulated financial-institution agent deployments.
[assumption; source: https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html; https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems] Assumption: Citizen-developed low-code agents are the closest available enterprise operating analogue for consequential LLM action. Justification: public longitudinal literature on business-led LLM agents in banks remains thin, so the synthesis leans on the best-matching governance analogue plus current agent-security guidance.

Analysis

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] The synthesis is strongest where LeCun's capability critique and current agent-security guidance intersect. If the agent is expected to plan and act in the world, then a missing predictive world model is not a side concern but a defect in the core reasoning surface.
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://www.scitepress.org/Papers/2025/133572/133572.pdf; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The governance-constraint layer matters because formal-policy literature already shows that humans need machine-checkable semantics to keep expressive policy estates coherent. It follows that an LLM agent operating under natural-language policy alone inherits a weaker control surface than a conventional policy engine would.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The infrastructure layer sharpens the result from mismatch to enterprise risk. The weaker the institution's permission, classification, and information-architecture surfaces are, the more every model-level deficit is amplified by sprawl, ambiguity, and runtime opacity.
[inference; source: https://www.bankofengland.co.uk/prudential-regulation/publication/2022/october/artificial-intelligence; https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10] This is why the framework is decision-useful for a regulated financial institution. It reframes the problem from "how do we govern citizen-developed agents?" to "which tasks and environments are structurally suitable for this model class, and which prerequisites must be satisfied before consequential autonomy is even entertained?"

Risks, Gaps, and Uncertainties

[fact; source: https://arxiv.org/search/?searchtype=all&query=formal+methods+policy+specification+AI] The originally seeded formal-methods source was too generic to cite directly, so the formal-policy strand relies on replacement sources rather than on the seeded search page itself.
[fact; source: https://www.gartner.com/en/information-technology/insights/low-code-development; https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/the-economic-potential-of-generative-ai-the-next-productivity-frontier] The Gartner and McKinsey seed pages were not usable in this runtime, so I did not use them to support adoption-pattern or governance claims.
[inference; source: https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/; https://openreview.net/forum?id=BZ5a1r-kVsf] The removed-compensating-controls claim remains medium confidence because it is supported by mechanism and analogy rather than by direct public measurement.
[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf] LeCun's paper is an architectural position paper and proposal, not a direct empirical study of enterprise LLM incidents, so the regulated-enterprise application is a synthesis step rather than a direct statement from LeCun.

Open Questions

[inference; source: https://openreview.net/forum?id=BZ5a1r-kVsf; https://aws.amazon.com/blogs/security/four-security-principles-for-agentic-ai-systems/] What bounded enterprise task classes can be safely delegated to LLM-centric agents without requiring the stronger predictive-world-model capabilities LeCun argues for?
[inference; source: https://www.cs.umd.edu/content/logic-based-access-control-policy-specification-and-management; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] Which policy domains should a regulated financial institution formalize first to achieve the largest marginal risk reduction before broader agent deployment?
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-data-governance-ai-lowcode-enterprise-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] What minimum set of classification, entitlement, and information-architecture controls should be treated as hard preconditions before any business-led agent can cross from assistive use into autonomous action?