High-risk AI is not one field, and its controls cannot be copied whole from one industry to another. A government lab worries about classified data and kinetic consequences; tax, finance, legal and clinical systems fail in different ways. Each needs autonomy matched to the task, deterministic checks around irreversible decisions, and clear rules about where data may run. Cryptographic controls and provenance can protect evidence, but they do not decide whether an agent should act. That requires explicit workflow state, receipts people can inspect, and evals built from expert judgment. Clinical systems add one final constraint: staged evidence must come before real patients enter the loop. Autonomy can grow, but only when the evidence supporting it grows too.
Why first: Myshatyn starts with the consequences that every later control has to answer: exposed national-security data, harmful outcomes and public scrutiny. Gayle follows by asking who inside a regulated organization has to accept those consequences before anything ships.
Why second: Myshatyn names what can go wrong; Gayle shows why a working model still fails to ship inside a bank. In the first week he finds the people who own the data, model risk, audit and production, then starts at the lowest authority that creates value. Because a rerun may give a different answer, he keeps the original inputs and outputs as evidence. Hron then turns that authority into dials.
Why here: Gayle starts with the least authority that helps; Hron shows that "agentic" is not one setting. His dials let a team lower autonomy when precision matters and give the model controlled tax software instead. Agrawal takes the next step by removing some decisions from those dials altogether.
Why here: Hron tunes autonomy to risk; Agrawal draws a hard line through the highest stakes. Emergency routing, identity checks and other irreversible calls run in code before the model. Yücel then asks where that code, its data and its audit trail are allowed to run.
Why here: Agrawal makes the decision path deterministic; Yücel widens the boundary to processing location, permissions, models and infrastructure. Traceability must survive those changes. Korshakov follows with a cryptographic answer to the hardest version of that problem: even the operator should not be trusted by default.
Why here: Yücel asks who controls the workload and data; Korshakov makes the phone verify the exact workload before it shares a key, with a separate team controlling production signing. Ganesh carries that demand for verifiable control from access to the contents of the work product itself.
Why here: Korshakov proves which workload may see the data; Ganesh proves where each financial number came from and which firm rule transformed it. The model plans, while deterministic systems calculate and check. Shankhdhar next uses the same separation to decide which clinical cases may proceed without review.
Why here: Ganesh requires a provenance chain for every result; Shankhdhar reconciles payer rules, documents, history and portal checks before granting an oncology workflow more autonomy. When clinical evidence is thin, a person takes over. Smoker shows why that caution matters even when each individual agent looks accurate.
Why here: Shankhdhar gates each case on the evidence available; Smoker explains why a longer chain needs explicit state as well. Small errors compound across sequential agents, so his legal workflow stores inspectable relationships in a graph. Conover follows by asking how a human can inspect that evidence without drowning in it.
Why here: Smoker makes the workflow state explicit; Conover makes it usable. His research agent exposes stages, findings, citations and source passages so an analyst can pull on a doubtful claim. Reed, Revere and Keller turn that same human judgment into typed tests that can gate the next release.
Why here: Conover gives experts receipts to inspect; Reed, Revere and Keller capture what clinicians find there as typed evals in CI. Their guardrails aim for the right intervention, not the most intervention. Joselowitz then asks how much evidence those evals need before a patient ever hears the system.
Why last: Reed, Revere and Keller turn clinical judgment into release gates; Joselowitz builds the deployment ladder around them. He starts with specific harms, tests them in simulation, then moves through supervised evaluation toward monitored patient use. It closes the pack with its governing rule: autonomy is earned by staged evidence, not assumed at launch.