Partha Sarkar published a piece in Towards Data Science today that more people building agentic systems should read before their next architecture review.
The argument is one that deserves wider circulation: an LLM's job is to synthesize text, not to make authorization decisions.
Access Control as Architecture, Not Instruction
Sarkar demonstrates what that means in practice — access control enforced as a metadata filter at the vector database, so unauthorized content is never retrieved rather than merely instructed away. Content hashed at ingest and re-verified at retrieval, on the assumption the store itself can be compromised. Retrieved chunks scanned for embedded instructions before they reach the context window. And a human approval queue that even the highest-privilege account cannot bypass for irreversible actions. The design decision worth studying is the last one: privilege does not override the gate.
What the piece shows is that the components of single-agent governance are well within reach of any serious engineering team. That is genuinely good news, and it moves the industry conversation to the question a purpose-built demo is too small to reach.
The Seams Between Planes
Production environments do not run one agent inside one pipeline. They run many agents across identity, data, integration, and orchestration planes — each with its own controls, each individually defensible. The failures that reach audit committees rarely happen inside a well-built pipeline like Sarkar's. They happen in the seams between planes, where one system's enforcement assumption is another system's blind spot. And a numeric clearance level, which works cleanly for three test personas, becomes a semantic modeling problem the moment entitlements depend on role, relationship, and context across thousands of users. The access question stops being "what level" and becomes "what does this person's role mean" — which is a data architecture question, not a filter syntax question.
The single-agent envelope is buildable today, and this article shows one credible way to build it. The enterprise-scale version is where the harder work lives.