Topic starter
11/11/2026 5:59 pm
TL;DR: When written policy, norms and inferred intents are treated as separate expectations rather than one blended judgment, Origin reports that AI work review improves. Agents can appear routine while still violating policy, so reviewers need context before escalating.
Editorial analysis by NHI Mgmt Group, based on content published by Origin: “Understanding AI work through norms and intents”.
Key questions
Q: Why can normal-looking AI work still be risky?
A: Normal-looking AI work can still be risky because a model or agent may produce sensitive outputs, act on bad prompts, leak training data, or use tools outside its intended scope.
Q: How can teams tell intent from routine in agent logs?
A: Teams tell intent from routine in agent logs by correlating the prompt, tool call, data touched, and sequence of actions against the agent’s approved task and scope.
Q: How do I review agent actions against policy and norms?
A: Start by separating what the organisation explicitly requires from what people usually do and what a repeated action appears to be for.
Practitioner guidance
- Define review against three separate expectations Build review guidance that asks whether an action was allowed, whether it matched established practice and whether it served the intended objective before escalation decisions are made.
- Capture repeated work patterns with local context Record the workflow, business unit and task context when logging agent activity so that repeated behaviour can be interpreted correctly rather than treated as universally normal.
- Require an explicit expectation for escalation Make every review note name the policy, norm or intent at issue, because unexplained concern is not enough to support a governance decision.
Bottom line: AI work needs to be judged against policy, norms and intent separately because the same behaviour can be acceptable, risky or off-purpose depending on context.
Glossary terms: Policy, Intent, Expectations Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Policy, norms and intents are distinct governance layers, not competing explanations. Origin's framing is useful because it separates what is allowed, what is common and what an action is trying to achieve. That distinction is essential in agentic environments where behaviour can be technically normal and still be out of policy. Practitioners should treat the three as different review lenses, not one blended judgment.
A question worth separating out:
Q: What should security teams do first when AI behaviour becomes hard to predict?
A: Start by defining who can intervene, under what conditions, and with what technical mechanism. Then verify that those intervention paths work in practice. Until a team can stop or constrain the system at runtime, it should not assume the governance model is complete.
👉 Read our full editorial: AI actions become reviewable when policy and intent set the context