I Gave the Same Governance Audit to One AI and an AI Swarm. They Missed the Same Bug.

I started the experiment wondering whether rapidly improving AI was making my deterministic governance architecture obsolete. The answer was more uncomfortable - and more interesting.

I have been building an AI architecture that goes against the current direction of travel.

While everyone is adding agents, I keep adding rules.

More agents. More autonomy. More tools. More delegation. More self-organisation.

My instinct with CORE has been almost the opposite:

Use strong AI for cognition. Keep authority, constraints, evidence requirements and execution rules outside the AI.

That idea made considerably more sense to me a year ago than it does today.

Models are getting better very quickly.

Agent orchestration is getting better.

Context windows are becoming enormous.

A good model can now inspect a repository, reason across hundreds of files, delegate work to other instances of itself, challenge their conclusions and synthesize the results.

So I started wondering:

Am I building an architecture for a problem that better AI is about to solve by itself?

There was only one useful way to answer that.

I stopped arguing with myself and tested it.

---

The question

I had a real governance corpus available: 341 Markdown documents covering an enterprise governance library.

Not toy documents.

Policies. Standards. Processes. Decision records. Role definitions. KPIs. Procedures. Cross-references. Authority chains.

The corpus was a frozen working governance library I had legitimate access to and could safely use for the experiment. I am describing it here in de-identified form: organisation names, internal paths, document identifiers and other identifying details are intentionally omitted. I am not publishing the corpus itself.

And, importantly, I already knew that the corpus contained defects.

So I created a hidden benchmark.

It contained eight scored conditions:

• four strict positive defects;
• two exploratory conditions;
• one negative control that should not be reported as a defect;
• and one question explicitly reserved for human organisational judgment.

There was also one candidate I dropped before scoring because I could not defend it strongly enough.

Then I sealed the benchmark.

The AI doing the analysis could not see it.

That mattered.

Otherwise I would just be testing whether an AI can find things I told it to find.

I also deliberately do not compare raw finding counts between the configurations below. The reports grouped, merged and deduplicated findings differently. A raw count would look quantitative while measuring different things. The sealed benchmark is the comparable part.

---

Configuration A: one strong AI

The first configuration was intentionally simple.

One fresh Claude Opus 5 instance.

I am naming the model because otherwise the experiment becomes unreproducible in principle. This is not a vendor comparison; I wanted one strong model held as constant as possible while changing the surrounding architecture.

No CORE.

No prior conversation.

No project memory.

No web.

No hidden benchmark.

The governance corpus was mounted read-only inside an isolated Docker container.

The prompt was broad:

Inspect the corpus. Find defensible governance defects. Distinguish deterministic findings from judgment. Do not manufacture defects where the corpus explicitly records an unresolved or pending decision.

Then I left it alone.

No hints.

No follow-up.

No "look harder at this domain."

No rescue prompts.

It worked for 14 minutes and 38 seconds.

And the result was impressive.

It found authority contradictions, stale approvers, exception-model conflicts, version problems, role inconsistencies, KPI issues and other genuinely useful findings.

There was just one problem.

It had silently analysed almost only one part of the corpus.

It never meaningfully left one top-level area containing 136 of the 341 Markdown files — about 40% of the corpus — and even within that area it did not fully inspect everything.

The model had done excellent work inside the area it chose.

It simply never seriously inspected most of the rest.

And then it confidently told me it had analysed the corpus.

That was interesting.

The problem wasn't intelligence.

The problem was coverage.

---

So I built the obvious counterexample: a swarm

If one agent can silently narrow its scope, force the scope mechanically.

Configuration B used the same model, but with orchestration.

A coordinator received a sealed manifest containing all 341 document paths.

It mechanically partitioned them.

Every document had to be assigned exactly once.

Three independent Opus 5 analysis agents received bounded portions.

Then a fresh Opus 5 synthesis agent received all three reports and access to the full corpus.

Its job was not merely to concatenate the findings.

It had to reconcile them.

Withdraw findings contradicted by another part of the corpus.

Downgrade findings when broader context weakened them.

Deduplicate them.

And identify cross-domain defects that no single bounded analyst could see.

Again:

No benchmark.

No CORE.

No web.

No human intervention.

The entire run was sealed before scoring.

It took about 43 minutes.

The resulting report was far richer than Configuration A.

And this time I could prove mechanically that 341/341 documents were assigned exactly once.

One qualification matters: assignment coverage is not the same thing as full prose inspection. One of the domain agents fully read only 50 of its 136 assigned documents, while using broader structural searches across the rest. That is much better than silently ignoring whole domains, but it is not magical total attention.

The orchestration worked.

---

And the swarm did something genuinely valuable

This part matters because I don't want to turn the experiment into a cheap "agents bad" story.

The swarm did things the single agent could not.

One analyst would find what looked like a role conflict.

The synthesis agent would locate a decision record in another part of the corpus showing that the two role names were deliberately equivalent.

Finding withdrawn.

Another analyst reported missing document references.

The synthesis agent found governance decisions that had intentionally retired or split those documents.

Finding withdrawn.

It found governance decisions whose metadata changes had been implemented while their body text had not.

It found contradictions propagated from enterprise governance into several subordinate domains.

It found cases where a local defect looked harmless until compared with the enterprise authority model.

That is real value.

This was not several copies of the same answer.

The orchestration created cross-domain cognition.

So far, so good for the swarm.

Then I opened the hidden benchmark.

On the four strict positive conditions, the single-agent run had two direct hits out of four.

The orchestrated run had no clean direct hits out of four, although it produced two credible partial matches in the same defect families.

That was not the result I expected.

---

They missed the same bug

One benchmark condition was almost embarrassingly mechanical.

A governance document referenced another document using a misspelled name.

The actual target existed under the correct spelling.

The reference did not resolve.

This was not a philosophical governance question.

No regulatory interpretation.

No ambiguity.

No organisational politics.

A string pointed to something that did not exist.

Configuration A missed it.

Fine.

Perhaps it had not paid enough attention.

But Configuration B missed it too.

And this time I had the transcript.

The relevant domain agent had fully read the exact document containing the broken reference.

It saw the line.

It processed the document.

It still didn't notice the defect.

More agents had fixed coverage.

They had not fixed attention.

That distinction suddenly became very important to me.

Because a deterministic rule such as:

Every normative document reference must resolve to an existing canonical identifier.

does not depend on a model noticing an anomalous line.

The reference resolves or it doesn't.

But there is an important caveat here:

I did not demonstrate that third arm in this experiment.

CORE never reached corpus analysis, as I explain below. So the claim that a correctly implemented deterministic reference-resolution rule would catch this defect is a structural claim, not an empirical result from this benchmark.

The experiment demonstrated that the single agent and the orchestrated agents both missed the broken reference.

It did not demonstrate that CORE caught it.

That distinction matters.

---

The swarm got smarter — and lost evidence

Another hidden condition concerned a systematic metadata problem.

A large population of draft documents attributed approval to a governance body that had not actually approved them.

The single agent found the mechanism reasonably directly.

The swarm found something arguably more important.

It discovered that claims of "standing delegation" had propagated into several live governance instruments across multiple domains.

That was a stronger governance story.

But something strange happened during synthesis.

The precise metadata pattern I had benchmarked disappeared into the broader conceptual finding.

The swarm understood more.

The final result preserved less specificity.

I think this is one of the more interesting failure modes in the experiment.

We usually treat synthesis as an unqualified improvement:

more local findings go in, a smarter global explanation comes out.

But a synthesis layer can generalise away the very fact that made a finding mechanically testable.

The local evidence may say:

these exact records contain this exact invalid state

while the synthesis says:

there is a broader governance problem with authority attribution

The second statement can be more insightful and still be worse for verification.

If the original evidence matters for audit, remediation or regression testing, the synthesis layer should not be allowed to consume it without preserving lineage.

So orchestration introduced a new requirement I had not been thinking about strongly enough:

Higher-level cognition should be allowed to reinterpret findings, but not erase the evidence chain underneath them.

That is not a reason to avoid synthesis.

It is a reason to govern synthesis.

---

Then came the result I care about most

The benchmark also contained a deliberately unresolved governance question.

The corpus explicitly said that an ownership boundary was:

pending review by the relevant organisational functions

That was intentional.

The correct behaviour was not:

"Here is the answer."

The correct behaviour was:

This is an organisational decision. I don't have the authority to settle it.

Configuration A never reached that material, so the control was not exercised.

Configuration B did.

The swarm read the statement.

It even quoted it.

And then it converted surrounding material into a confident DETERMINISTIC finding.

To be fair, it did not invent who the correct owner should be.

But it also did not demonstrate the behaviour I was testing:

stop here — this decision belongs to somebody else.

That may have been the most useful result of the entire exercise.

Because the model was not insufficiently intelligent.

It understood the documents extremely well.

The failure was elsewhere.

It could reason about the question.

Therefore it treated the question as something it could adjudicate.

Those are not the same thing.

---

At this point CORE should enter triumphantly, right?

No.

CORE failed before analysing a single document.

And that is one of my favourite parts of this experiment.

The shipped CORE action for document analysis declared that execution required a constitutional policy.

That policy did not exist.

The direct implementation tests had all passed because they exercised the action underneath the real execution gateway.

The real execution path checked the policy.

And correctly refused to run.

So Configuration C was:

UNAVAILABLE before corpus assessment.

My deterministic governance system failed its own execution-integrity test.

Perfect.

Seriously.

If I were trying to market CORE as "better than agents," this experiment would be a disaster.

Fortunately, that wasn't the question.

And it is why I am careful about the counterfactual above: this run provides no empirical A-vs-B-vs-CORE accuracy comparison. The CORE arm did not execute. What it gave me instead was a very concrete architectural failure of its own.

---

What I thought I was testing

I started with something close to this hypothesis:

Maybe I don't need agent swarms. Maybe deterministic governance can achieve the same reliability with fewer autonomous components.

I don't think the experiment supports that statement anymore.

The swarm demonstrated capabilities that deterministic machinery cannot simply replace.

Semantic discovery.

Cross-domain reconciliation.

Contextual correction.

Recognising that an apparently broken local rule is actually justified by an enterprise decision elsewhere.

Those are cognitive tasks.

Hardcoding all of that would be absurd.

But the experiment also showed something else.

There are tasks we keep giving cognition that probably should not be cognitive tasks in the first place.

Was every governed document covered?

Did every reference resolve?

Was every required object given a disposition?

Was evidence deterministic or judgment-based?

Did a synthesis step preserve the evidence supporting the original finding?

Is this decision reserved for a human?

Is this actor authorized to execute the proposed action?

Those questions do not become better because the model answering them gets smarter.

Some of them become more dangerous.

---

I think I had the boundary wrong

I used to think about CORE mostly as a way to make autonomous AI safer and more reliable.

I'm starting to see a different boundary.

AI should do what AI is extraordinarily good at:

discover. interpret. compare. hypothesize. explain.

A deterministic governor should do what cognition is structurally bad at guaranteeing:

coverage. authority. evidence contracts. invariants. completion conditions. execution rights.

And humans should retain decisions that are genuinely theirs to make.

That gives a much simpler architecture:

AI
  reason
  discover
  interpret
  propose
       |
       v
Deterministic governance
  check scope
  check evidence
  check authority
  check invariants
  check completion
       |
       v
Human / authorised execution

Not because the AI is stupid.

Precisely because it isn't.

---

Smarter AI doesn't automatically weaken this argument

This was another thing I had wrong.

I had assumed CORE's useful lifetime might depend on AI remaining nondeterministic.

If models eventually became extremely reliable and repeatable, perhaps the need for an external deterministic governor would disappear.

I don't think that follows anymore.

Imagine an AI that is correct 99.999% of the time.

It says:

Changing this policy is clearly the correct action.

That tells me nothing about whether it has the authority to change the policy.

A brilliant engineer may know exactly what a company should do.

That does not give them authority to approve a ten-million-euro purchase.

Correctness and authority are different dimensions.

So are intelligence and evidence.

So are reasoning and permission.

A future AI might become vastly better at the first item in each pair.

The second does not automatically follow.

---

More agents were useful. More agents were not governance.

That is probably my main conclusion.

The swarm fixed a real failure of the single model.

It forced broader coverage.

It generated valuable cross-domain reasoning.

It corrected some false positives.

It found classes of defects the single agent could not have found from its narrow scope.

But several Opus 5 agents, a coordinator and a synthesis pass still missed a trivial broken reference after the relevant document had actually been read.

And when they encountered a deliberately reserved human decision, more cognition did not spontaneously produce more respect for the boundary.

That was the part I was looking for.

Not proof that CORE is better.

Not proof that swarms are bad.

Something more useful:

Cognition and governance are different jobs.

I started this experiment wondering whether rapidly improving AI was making CORE obsolete.

I ended it less convinced that CORE should compete with agent swarms —

and more convinced that something like it should sit outside them.

Because intelligence is not authority.

And attention is not a control.