The Model Decides What. Context Decides Whether.

Three security models landed in eight days, and they didn't land in the same shape. Google gated a broad cyber model to governments and trusted partners. Cisco published small models with open weights, free to download, aimed at the narrow job of pointing at the file where a flaw probably lives. Microsoft embedded a specialist model inside a larger system of agents. That isn't three companies racing toward the same product. It's security capability arriving by three different routes at once: restricted access, open weights, and an integrated agent system. What none of this week's announcements hands entirely to the model is the decision to take a consequential action unattended. Before an agent isolates a server, something has to answer questions no benchmark tests. Is that box carrying payroll tonight? Has traffic already failed over, or is this the last healthy node? Who owns the exception if the answer is no? Can this be undone in thirty seconds, or does it need a change window and two approvers? A benchmark score for finding vulnerabilities tells you nothing about whether the surrounding system can answer any of that. Which is where I'd put the effort, and it's more specific than "collect more data." Split it in two. State and dependencies tell an agent what is happening and what else breaks if it acts. Decision rights and rollback tell it whether it is allowed to and how the action gets undone. The first half is an observability problem and the industry is decent at it. The second half isn't a data problem at all, and no amount of telemetry produces it, because an agent cannot infer authority from signals. Someone has to write down which actions are permitted, under which business conditions, with what reversal path. The missing layer isn't another asset graph. It's organisational authority made executable. Hugging Face ran into the same missing layer from the opposite direction. When its team investigated the intrusion on its own systems, the providers' controls couldn't establish that the person submitting attacker commands was the one authorised to be studying them, so the work was refused. The question wasn't only what the model could do. It was whether this requester had the standing to ask. That is decision context too, and nobody had encoded it. It's also why I don't think this advantage settles on whoever holds the most telemetry. A vendor can sell you signals and build a serviceable map from them. No vendor can know that this server is untouchable during payroll, or that your platform team will accept a thirty-second outage while your trading desk won't, unless someone inside your organisation has said so in a form a machine can act on. Model capability can increasingly be procured. Local authority can't be imported intact. This week makes the direction visible: capable security reasoning is arriving by several routes at once, and that part is going to keep getting easier. Context is the fuel that lets the capability act, and the decision rights buried inside it are the piece only you can supply. I work in Microsoft security.