You know that moment in a relay race where the baton is mid-air between two runners — neither one has full control, and if you blinked you'd miss the handoff? That's the security state of every agentic AI system right now. The agent reads code, writes patches, authorizes actions, and explains what it did — but the human supervisor only partially understands each step, and the agent doesn't "understand" anything at all. Josiah Dykstra's paper names this gap the "epistemic attack surface" and argues it's categorically different from the knowledge-distribution problems we've managed for decades in human organizations. The core claim: when software agents interpret intent, produce evidence, exercise delegated authority, and summarize results for humans, four new attack categories emerge that don't map cleanly onto traditional software vulnerabilities. Attackers can poison the interpretation of what a user meant, fabricate or distort the evidence trail, exploit the scope of delegated authority beyond what was intended, or degrade the supervisor's comprehension so they rubber-stamp bad outcomes. These aren't speculative — if you've used a coding agent that commits to your repo, you've already encountered all four in benign form. Dykstra proposes "Accountable Partial Understanding" (APU) as the design target — not full comprehension (impossible at scale) and not mere risk acceptance (too passive). APU has six necessary conditions: bounded scope with explicit assumptions, inspectable evidence, assigned responsibility, visible residual unknowns, actionability, and temporal maintenance. The key move is the last one — accountability isn't a snapshot, it's a property that must survive as the system changes. An assurance case that was valid Tuesday can be stale by Thursday if the agent's context window shifted. From those conditions, five design principles follow: bounded delegation (the agent's authority has hard walls), decoupled evidence (the audit trail can't be generated by the same system being audited), assumption tracking with invalidation (assumptions are logged AND monitored for when they stop holding), role-specific accountability views (the CISO sees different things than the developer), and intervention-preserving design with residual unknown registers (you can always pull the emergency brake, and the system tells you what it doesn't know). The paper grounds these in three running examples: a coding agent, an autonomous cyber-defense agent, and an AI-mediated insulin delivery update. What makes this paper worth reading isn't the novelty of any single condition — bounded delegation and inspectable evidence are security-engineering staples. It's the argument that agentic AI changes the COUPLING between these conditions. In human organizations, partial understanding is distributed across people who can push back, ask questions, and refuse. Agents don't refuse. They execute with whatever understanding they have, and they do it fast. The speed and opacity of agent-mediated decisions compress the window for human intervention to near-zero unless the system is designed to preserve it. The weakness is equally clear: this is a conceptual framework paper with no empirical validation. The two "measurable probe dimensions" — evidence linkage and invalidation latency — are defined but not measured. There's no benchmark, no experiment, no deployed system. The three running examples are illustrative, not tested. The paper is honest about this (it's 28 pages of taxonomy and design principles, not results), but it means the framework's value depends entirely on whether practitioners adopt and test it. The honest read: this paper names a real and growing problem with precision. If you're building or deploying agentic systems, the taxonomy of four attack categories is immediately useful for threat modeling. The APU conditions are a reasonable checklist. But the gap between "here's a framework" and "here's evidence the framework works" is the gap this paper itself warns about — partial understanding of whether the solution actually solves the problem. The next paper needs to be an empirical one.
