Report this article
Patrick Parker
Patrick Parker
Published Sep 8, 2026
+ Follow
In the Star Trek: The Next Generation episode “Darmok,” the Universal Translator is working and still fails.
It can translate the Tamarian words. What it cannot translate is the shared story behind them. “Darmok and Jalad at Tanagra” only becomes meaningful when Captain Picard understands the event being referenced: two people, arriving separately, brought together by a shared ordeal.
The words were never the real problem. The missing piece was the referent.
That is a useful way to think about a problem we are beginning to encounter with AI agents.
Suppose an agent receives a simple instruction: find our high-risk customers and prepare the appropriate remediation actions.
The agent may be properly authenticated. It may be authorized to access CRM, security and financial systems. Every tool call it eventually makes may be permitted.
But what does high-risk customer mean?
Credit risk, renewal risk, regulatory exposure, security posture and excessive privileged access are all plausible interpretations. A capable model can reason about them and may choose exactly the interpretation a human would have chosen.
The control question is different:
Which meaning is ours?
That question matters because interpretation happens before action. If the model silently interprets “high risk” as credit risk when the organization meant regulatory exposure, everything downstream can work perfectly. The action can be authorized correctly, executed through a controlled boundary and fully evidenced.
And the system can still do the wrong thing.
We have spent a great deal of effort learning how to govern what agents do. We also need to pay attention to the institutional meaning that causes them to decide what to do.
Being right is not the same as being authoritative
I recently used Cerebro, the governed knowledge layer in our Identity Fabric, to build a Tamarian translator as an experiment in this problem.
Cerebro gives agents a versioned source of institutional meaning so that model memory or inference does not become the organization’s answer by default.
Getting an LLM to translate Tamarian would not prove much. Modern models have seen decades of Star Trek material, academic papers, websites and discussions of “Darmok.” A capable model may already know what the famous phrases mean.
So the translator applies a stricter rule: model knowledge can inform reasoning, but it cannot by itself establish the translation the system is willing to stand behind.
A translation begins with a lookup against the committed Cerebro catalog. The lookup returns a signed, version-bound receipt containing the myth identifier, a catalog claim identifier, the active catalog version, its content hash and the exact output approved for that operation. The claim identifier names the specific asserted meaning associated with that myth.
For a gloss, the approved output is English. For a render, it is the approved Tamarian expression.
The server-side translation tools validate the receipt and the active catalog state before returning the translation. A stale or invalid receipt cannot authorize output.
The model may well be right. The system still will not stand behind the translation without the governed basis for it.
That distinction appears everywhere in an enterprise. What qualifies as privileged access? Which systems are production? Who is considered an employee? What makes an entitlement toxic? Which applications are critical? What evidence satisfies a control?
Governance systems have stored definitions like these for years. The new problem is that an autonomous reasoning system can interpret, combine and act on them without ever making the basis for its interpretation explicit.
For consequential claims and actions, we increasingly need an explicit, verifiable link to the institutional meaning the organization has adopted.
Authority does not guarantee correctness. A bad institutional definition is still bad. The advantage is that it has an owner, a version and a correction path. An inferred definition may have none of those things.
The missing step between authority and effect
This becomes especially important when we look at how agentic systems actually operate.
A person rarely authorizes the exact API call an agent will eventually make. We authorize something broader:
Investigate this alert.
Review these access risks.
Reconcile these invoices.
Identify the customers requiring intervention.
The agent interprets that objective, reasons over context and generates specific intent later.
That creates an important sequence:
approved purpose → institutional interpretation → generated intent → concrete action → authorization → effect
Most agent-security discussion concentrates on the right-hand side of that chain: identity, tool authorization, runtime policy, credentials and execution.
Those controls are essential. But they cannot repair a semantic error that happened earlier.
If the agent applies the wrong institutional definition, it may generate the wrong concrete action. A perfectly governed execution path can then faithfully execute that mistake.
In other words:
Generated intent is shaped by generated interpretation.
Governing the action does not eliminate the need to govern the meaning that produced it.
Why this is more than versioned RAG
Retrieval-augmented generation is valuable because it gives a model relevant context. It does not automatically establish which interpretation should govern an action.
RAG might show an agent five different definitions of “high risk.” The control problem begins when the system has to decide which one applies.
That also exposes something the Tamarian demo intentionally simplifies: ambiguity.
In the demo, a known phrase maps cleanly to a catalog entry. Enterprise language often does not work that way. Several governed meanings may plausibly match the same instruction.
Silently choosing one and attaching provenance afterward does not solve the problem. The selection itself has to become explicit and auditable. Where policy and context cannot resolve the ambiguity, the agent should ask rather than manufacture certainty.
There are therefore at least two distinct semantic failure states.
Unknown: we do not have a governed meaning.
Ambiguous: we have more than one plausible governed meaning and have not established which one applies.
Recommended by LinkedIn
The death of the em dash (and who killed it)
Clothier Lacey & Co
4 months ago
AI- A Master of Fluent Reflection
Amitava Sarkar
6 months ago
Two AIs are better than one
Sebastian Holst
2 years ago
Neither should disappear inside model confidence.
The Tamarian translator demonstrates the closed-world and provenance mechanics. A production system also needs explicit treatment of ambiguity before semantic selection is allowed to drive consequential action.
Unknown needs to remain a legitimate answer
The translator has another intentionally strict property. If a phrase is not in the committed catalog, the model cannot promote its own memory into the organization’s translation.
It may know the phrase. It may infer a plausible meaning. It may propose that the catalog be extended. The governed answer remains unknown until there is a basis for saying otherwise.
This matters because generative models are exceptionally good at making uncertainty sound settled.
Inference itself is not the problem. An agent should be free to investigate an unfamiliar entitlement, infer what it probably does, compare evidence and suggest a classification.
The control boundary appears when that inference is about to become something the organization relies on: an access decision, a risk classification, a remediation, an approval, a compliance assertion or another operational effect.
A useful inference can remain a proposal without immediately becoming institutional truth.
Meaning also has a version
Institutional meaning changes.
Definitions of privileged access broaden. Business roles change. Customers move between risk categories. Applications are reclassified. Policy interpretations evolve.
The Tamarian implementation therefore binds each lookup receipt to the version and content hash of the active committed catalog. When a new catalog version becomes active, an earlier receipt remains evidence of what was returned under the prior version, but it can no longer authorize a new translation against the successor version.
The current implementation does this conservatively at the catalog level. A catalog update invalidates outstanding receipts even if an unrelated entry changed. A future implementation could make that binding more granular, but the important property is already visible: governed meaning has temporal provenance.
Instead of recording only that “the agent concluded X,” we can identify the source and version from which that conclusion was authorized.
That starts to answer a question traditional execution evidence usually cannot:
Not only why was this action allowed, but why did the agent believe this was the action it should take?
Picard inferred the answer. Doesn’t the episode undermine this idea?
The episode itself depends on inference.
Picard watches Dathon, observes the circumstances, forms hypotheses, tests them against subsequent events and gradually reconstructs the meaning of the stories.
That is exactly the kind of reasoning we want intelligent systems to perform.
The important question is what happens after the inference.
In an enterprise, an agent’s plausible interpretation can become a proposal. Existing governed systems can seed the initial corpus, agents can propose mappings and definitions at scale, and approved changes can then be promoted according to policy and risk.
Our Tamarian implementation follows that pattern. A proposed myth is placed in a draft overlay. Drafts cannot authorize translation. Publication requires a different principal from the one who proposed the change.
For a production system, separation of duties has to mean more than agent A proposing and agent B publishing inside the same runtime. Low-risk mappings may eventually be handled automatically under policy. Definitions that gate access, remediation, compliance assertions or other high-consequence effects should require a human approver outside the agent runtime. Publication itself should be treated as a governed effect.
Canon is not a chat message.
There is a symmetry in the episode itself. By the end of “Darmok,” a new shared experience has created a new referent: “Picard and Dathon at El-Adrel.”
Picard’s inference was the beginning of shared meaning. For agents operating at machine scale, we need a controlled path from that inference to something the organization is willing to adopt.
Least privilege applies to knowledge too
The translator also separates capabilities.
The Tamarian speaker is scoped to render approved Tamarian expressions. It cannot call the English gloss tool or browse the underlying catalog. The linguist receives different capabilities, and curation is separated again. Those boundaries are enforced through the available tool surface and policy.
The enterprise analogue is clear. A customer-facing agent may need to know that a customer belongs to a particular service tier without being able to retrieve the internal risk factors that produced the classification.
What an agent may know, what it may represent as authoritative, what it may disclose and what it may do are four different permissions.
We have spent decades applying least privilege to resources and actions. Agents make us apply the same thinking to knowledge and context.
Governing both sides of the decision
Traditional authorization asks whether an identity may perform an action on a resource. Agentic systems do not make that question obsolete. They make it more important.
But there is now another side of the decision.
Before an interpretation becomes consequential, we increasingly need to know which institutional meaning supports it, where that meaning came from, which version was active and whether ambiguity was resolved rather than hidden inside the model.
That is the role Cerebro is designed to play.
Cerebro establishes the governed meaning the agent may rely on. The agent reasons and proposes what to do. The concrete action can then be evaluated through action-time authorization. Governed Execution controls whether that authorized action crosses the boundary into an external effect and produces the evidence of what actually happened.
The two control directions are complementary:
What did we mean?
and
What will this action do?
A lookup receipt should not be asked to prove the entire downstream chain by itself. Likewise, a perfect execution receipt cannot prove that the interpretation which caused the action was correct. The evidence has to preserve both parts of the story.
That is where I think agentic control is heading.
The next generation of these systems will need to govern both sides of the decision: the meaning that causes an agent to act and the effect that action causes in the world.
The Universal Translator had the words but not the story.
Today’s models may have every story but no inherent way to know which story is ours.
For agentic systems, controlling access to tools will not be enough.
We will also have to govern the meaning behind the action.
Leave a Reply