The Plague Came on the Same Roads

Every infrastructure that connects the world runs the same pattern. Someone builds roads. Trade follows. Knowledge follows. Then, eventually, something dangerous follows, because the roads do not distinguish between silk and bacteria. The infrastructure just moves things.

This happened literally the first time the world was genuinely connected. Historians call it the Pax Mongolica: for about a century after the Mongol conquests, a single power held the roads from China to the edge of Europe, ran the yam relay network of fresh horses and provisions along them, and issued a universal passport that let a merchant ride from Beijing to the Black Sea under one protection.

Merchants travelled freely. Ideas crossed borders that had been closed for centuries. It was the first real age of globalisation, and historians still marvel at how suddenly the world shrank. Then the plague used those same roads. A third of Europe died. The infrastructure that created the wealth also created the vector.

The pattern did not end there.

The Internet Ran the Same Pattern

The internet is the same story at electronic speed. A new infrastructure layer collapsed distance, connected markets and people and ideas that had never been able to reach each other, and produced an explosion of wealth, culture, and knowledge transfer that genuinely changed what was possible for a human being to do in a lifetime.

And then the dangerous things started travelling the same routes:

• Disinformation at scale
• Coordinated manipulation
• Fraud that could reach every person on earth simultaneously
• State-level interference that fits in a laptop bag

The infrastructure did not distinguish. It just moved things.

Nobody designed the internet to carry those harms. They arrived the same way the plague arrived: along the routes that already existed, at the speed the infrastructure already supported, without asking permission.

AI Is the Next Layer

AI is not replacing the internet. It is being built on top of it, the way the merchants and scholars were the layer built on top of the old trade roads. Each layer moves something the one below it could not:

• The roads moved goods
• The merchants moved value
• The internet moves information
• AI moves decisions

That is the shift that matters. Not that AI is faster or smarter or more scalable than previous tools, though it is all of those things. The shift is that the thing travelling the network is no longer data about a decision or a recommendation for a decision. It is the decision itself, executed, done, before a human was in the loop or even aware one was being made.

An agent with write access to your infrastructure, no audit trail, and a service account scoped too broadly because nobody knew in advance what the model would need: that is not a hypothetical risk scenario. That is the default configuration right now for most MCP deployments. The roads are open. The merchants are moving. The plague question is already live.

What Travels with the Benefit

The dangerous things on AI infrastructure are less visible than a sick rat on a trade caravan and faster than any historical analogy can really capture:

• Synthetic content indistinguishable from real reporting, generated at a volume no human newsroom could match
• Automated systems probing for vulnerabilities millions of times per second, finding the one that works, acting before any human reviews the result
• Models manipulated through their inputs to take actions their operators never intended
• Agent-to-agent calls that no log captures and no audit trail follows

None of these require a sophisticated attacker. The first age of globalisation's plague did not require anyone to intend harm. Speed and scale and open infrastructure do the rest. The harm propagates along the same routes as the benefit, at the same speed, to the same destinations.

And the blast radius is larger than it looks. The tools are general-purpose. A model that can write code can write malicious code. A model that can summarise can fabricate. A model that can execute API calls against your systems can execute the wrong ones. Capability does not come with a scope limiter built in.

The Old Answer, Applied to Now

Every time this pattern has run before, the answer was not to close the roads. Trade did not stop after the plague. The internet did not shut down after the first wave of spam and fraud. The infrastructure survived because it was genuinely valuable, and the response was to build better systems on top of it: authentication, monitoring, governance that applied universally rather than being patched onto individual nodes.

The historical analogy is useful here for exactly one thing: it shows that the governance layer always comes after the infrastructure layer, and the gap between them is where the harm happens.

• The roads were built without a disease control system
• The internet was built without an identity layer
• AI is being deployed without an audit layer, without provenance for generated content, without checkpoints in automated action chains

The bitter detail is that the first globalisation had the best credential layer of the three. The Mongol paiza was a metal tablet of authority, and the design was remarkably complete:

• Graduated scopes: gold, silver, or bronze by the bearer's rank, each grade unlocking a different level of horses, escort, and provisions
• One artefact: identity, authorisation, and access scope together, honoured across five thousand miles
• Tamper-resistant: forging one was fatal
• Per-hop verification: not a border check; a rider presented it at every yam station, every time he drew fresh horses, dozens of checks along a single journey

A thirteenth-century network operator understood per-hop verification with graduated scopes, seven centuries before we started arguing about it. The plague still came, because biology does not present credentials. But the failure modes the paiza could address, it addressed everywhere along the route, continuously, not once at the gate.

Not a Gate. A Fabric.

The old mental model for security was a door. You check identity at the perimeter, you let the right people in, and everything inside the wall is trusted. That model was already broken before AI. AI makes it incoherent.

When communications and decisions are virtually instantaneous, checking at the entry point means checking after the fact. By the time the border crossing logs your arrival, the cargo has already been unloaded, distributed, and consumed. The harm is not waiting at the checkpoint. It is executing in parallel with the check.

The governance layer for AI systems cannot be a gate. It has to be a fabric: woven into every layer of the stack, present at every point where something consequential happens. Not just at ingress, but at execution. Not just at execution, but at storage. Not just at storage, but at egress. Not once per session, but continuously, for every action, at the moment it occurs. Closer to the paiza than to passport control.

Authentication is not a login. It is a property of every operation. For each action, the record needs to capture:

• Who authorised this specific action
• With what scope
• At what time, with what parameters
• What was the result

An agent that authenticated successfully at the start of a session and then deleted a production record twelve steps later does not have an audit trail. It has a door log. Those are not the same thing.

An agent that authenticated at login and deleted a production record twelve steps later does not have an audit trail. It has a door log.

Attribution Is How Consequences Reach a Person

"Who" is not one answer. In an AI system it is a chain:

• A human made a request
• A model interpreted it
• An agent executed it, possibly after calling other agents, possibly on behalf of a third party, possibly because an upstream system delegated authority it received from somewhere else

"An AI agent deleted the record" is the last link. The audit log needs all of them: who originated the request, who authorised each step of the delegation, on whose behalf the final action was taken, and why, meaning the stated intent that justified granting the access in the first place.

This matters because accountability cannot attach to a model. Models do not have legal standing, do not carry insurance, and cannot be held responsible in any framework that has ever existed. Accountability attaches to people, and in delegated systems the only way to reach the person is to follow the chain back. If any link is missing, the chain ends there. Complete attribution is not a compliance formality. It is the mechanism by which consequences reach the right place.

The same applies to content. Verifying that a document came from a legitimate source when it entered the system tells you nothing about what the model did with it, what it generated from it, or what downstream systems received as output. Provenance cannot live only at the boundary. It has to travel with the data, through every transformation, to every destination, in a form that can be verified at each step independently of trusting the previous one.

This is not a new idea. It is how financial systems work. Every transaction carries its own audit record. The ledger does not trust that the entry point was secure. It records what happened regardless. The question is why we are deploying AI systems that touch production infrastructure without applying the same standard we applied to double-entry bookkeeping five centuries ago.

The answer is speed. Building governance into every layer is harder and slower than checking at the door and assuming the inside is safe. But in a system where decisions execute at machine speed across distributed agents with write access to real infrastructure, the inside is never safe, and the door check happened before the threat existed.

The Ledger Itself Has to Be Trustworthy

There is a problem with every argument for better logging, and it is this: private logs are routinely doctored. A log controlled by the same party it is supposed to audit is evidence that party produced. It can be edited, truncated, backdated, or deleted. The history of corporate fraud, security incidents, and cover-ups is substantially a history of people with access to the audit log using that access.

So if the answer to "how do we know what the AI did" is "we kept a log," the next question is "who kept the log, and why should anyone trust it."

The answer cannot be a private ledger. It has to be something where the record, once written, cannot be altered without the alteration being detectable, by anyone, without needing to trust the party who holds it. This is not a new problem either. We solved a version of it for TLS certificates with Certificate Transparency: a public, append-only log that any party can monitor, where a certificate that does not appear in the log is not trusted, and where inserting a fraudulent entry requires breaking cryptographic commitments that were made publicly. The log is trustworthy not because we trust the operator but because the structure makes tampering evident.

The same principle applies to AI action logs. These are not exotic requirements. Sigstore does this for software supply chains, Certificate Transparency does it for TLS certificates, trusted timestamping authorities have done it for documents since the 1990s:

• Cryptographic signatures on every operation, signed at the moment of execution with keys that can be independently verified
• Hash-chained records where each entry commits to all previous entries, so that altering any record invalidates everything that came after it
• Public anchoring: periodic commitments to an external record that no single party controls, so the private log can be verified against something that cannot be quietly rewritten

A log that the operator can edit is a story the operator tells about what happened. A cryptographically anchored, publicly verifiable record is what actually happened.

For AI systems with write access to infrastructure that matters, the second one is the requirement. The first one is theater.

And the access to that record has to match the speed of what it is tracking. An audit trail that requires a legal request, a six-week review process, and a team of specialists to interpret is not an audit trail for AI systems. It is a forensics tool for after the disaster. Each party with the right to verify a given slice of the ledger needs to be able to do it programmatically, in real time, against a well-defined API with granular access controls:

• The regulator sees their jurisdiction
• The customer sees their data
• The compliance system runs continuously and flags anomalies without waiting for a human to ask

The verification has to run at the same speed as the actions it is verifying, or it is not verification. It is archaeology.

The Question Worth Sitting With

The first globalisation lasted about a century before the plague, the fragmentation, and the slow absorption of the conquerors into the cultures they governed ended it. A century of genuine connection, paid for with catastrophic harm that used the same infrastructure as the benefit, followed by a long unwinding that nobody planned and nobody could stop once it started.

We are early in our own version of that century. The capability is real. The benefit is real. The harm potential is also real, and it travels the same routes, at the same speed, to the same destinations.

We have the roads. The merchants are moving. We still have not minted the paiza.

The governance layer is not a constraint on the infrastructure. It is the thing that makes the infrastructure last.