On 18 June 2026, Google DeepMind published its AI Control Roadmap, a framework for managing advanced AI agents operating inside Google's own systems. The premise is blunt: assume the agent might not be aligned with your goals, and build defences that hold even if it is not.
Most of the coverage will focus on the headline idea, treating internal AI agents as potential insider threats, monitored the way a security team would monitor a rogue employee who already has legitimate access. That framing is sound and overdue. The detail that matters most for anyone building security architecture sits further down the document, in two sentences most readers will skim past.
The sentence that matters.
DeepMind writes: for low-risk and reversible actions, organisations can rely on reviewing transcripts with a delay and remediating issues after they occur. They call this asynchronous response. For particularly high-risk actions, such as major cyber attacks, the response must shift to real-time prevention, blocking harmful actions before they can be executed. They call this synchronous response. Their own words: the response strategy must scale with the severity of the threat.
That is the precise architectural distinction this conversation keeps returning to. Most actions are recoverable. Investigate, remediate, learn, move on. A small number are not. For those, after-the-fact review is not a weaker version of the same control. It is the wrong category of control entirely. There is nothing to remediate once a production database has been deleted or a payment has settled.
DeepMind has reached this conclusion independently, securing its own infrastructure, with no reference to execution boundaries or human authority. They arrived at the same fork in the road from a completely different direction, and drew the same line: severity determines whether you can afford to review later or whether you must stop it now.
Who holds the brake.
Their analogy for the synchronous layer is a driving instructor with dual controls. The instructor trusts the student but stays ready to take the wheel or hit the brakes if a mistake occurs. It is a good analogy, and worth taking seriously, because it concedes something important: trust in the agent is provisional, and something has to retain the ability to intervene before the car leaves the road.
In DeepMind's roadmap, the hand on the brake belongs to another AI system. They call it a supervisor, a separate trusted model that constantly reviews a working agent's reasoning, actions, and plans, and steps in to block an action it judges harmful before damage occurs.
That is a meaningful improvement over no synchronous layer at all. It is also a different claim from the one their own data supports. DeepMind reports that after analysing roughly a million coding agent tasks, the majority of flagged events did not stem from adversarial intent. They stemmed from agent misinterpretation or overeagerness, an agent trying too hard to satisfy an instruction, not an agent attempting harm.
That finding is honest and useful. It also means the supervisor model has been validated, so far, at catching confusion, not at adjudicating intent in a genuinely ambiguous, high-stakes situation. A supervisor model evaluating another model's plan can detect that an action looks unusual against historical behaviour. It cannot know whether the company completed an acquisition yesterday, whether the board changed its risk appetite last night, or whether a legitimate but unprecedented instruction was just issued by someone with real authority to issue it. Those are not behavioural anomalies. They are changes in context that only a human with current knowledge can resolve.
Synchronous response needs a synchronous human, not just a synchronous model.
DeepMind's own severity scaling argument, that response must scale with the severity of the threat, points in a direction their current architecture does not fully follow through on. If the action is reversible, an AI supervisor reviewing it asynchronously, or even blocking it provisionally pending review, is proportionate. If the action is irreversible and catastrophic if wrong, a named human confirming the request on a device they control, in real time, before the action completes, is the proportionate response. Not because the supervisor model is unintelligent. Because accountability for an irreversible decision has to attach to someone who can be held responsible for it, and a model cannot be held responsible in the way a named person can.
This is not a criticism of the roadmap. It is the next question the roadmap itself raises and does not yet answer. DeepMind has done the harder conceptual work, establishing that severity, not convenience, should determine the response category. The mechanism for the highest severity tier, the one that needs to be unconditionally synchronous, currently still routes the final call to another AI rather than to a named human authority.
Two of the most resourced AI safety teams in the world, working independently, on different problems, in different industries, have now converged on the same structural insight: most actions tolerate delay. A small number do not, and trying to treat them the same way as everything else is the architectural error. DeepMind has built the detection and classification layer for that insight at extraordinary scale. The synchronous human confirmation layer, the part that makes the highest severity tier actually unconditional rather than provisionally trusted to another model, is the piece still missing from the public framework.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence platform for Security, Resilience & Defence. Osinto’s AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in seconds, not days.
References
1. Shah, Rohin and Flynn, Four. Securing the future of AI agents. Google DeepMind, 18 June 2026. https://deepmind.google/blog/securing-the-future-of-ai-agents/
2. Google DeepMind. AI Control Roadmap. 18 June 2026.
3. Google DeepMind. Three Layers of Agent Security. 18 June 2026.