Which Dependencies Don't Become Visible Until the Assumption Fails? Runtime Enforcement, Dependency Gravity, and the Limits of Agentic Assurance

Standardized runtime enforcement offers a promising architectural foundation for controlling agentic AI systems, but evidence of faithful enforcement does not necessarily establish the legitimacy of what is enforced. This essay distinguishes two analytically separate failure classes: failures within the classical reference-monitor model, in which a mediation mechanism is bypassed, compromised, unavailable, or disobeyed, and failures not resolved by that model, in which the mechanism executes according to specification while relying on an invalid premise. A hypothetical revoked-authority scenario illustrates how authentic but stale decision state can produce orderly enforcement and coherent audit records without satisfying deployment-level authorization requirements. The essay introduces dependency gravity to describe the accumulation of technical, operational, and institutional reliance around a shared control point, including reliance on what downstream actors believe its outputs establish. Using the Agent Control Standard as an architectural case rather than an implementation critique, the analysis argues for bounded assurance claims that distinguish enforcement fidelity from the validity of the underlying authority, policy, state, and context. It asks which dependencies remain unrecognized until an assumption fails, and how evidence that a control operated successfully can acquire meanings stronger than the properties actually demonstrated.