The deployment of always-on autonomous agents into enterprise and consumer environments introduces a class of risk that existing security and governance frameworks were not designed to address. This paper examines the structural governance gaps created by agents such as Google Spark: the continuous attack surface of 24/7 runtime, the privileged credential exposure created by autonomous browser control, the silent failure modes produced by semantic drift under autonomy, and the substrate governance requirements that must be satisfied before agents of this class are deployed. The analysis treats agentic AI not as a software feature but as a new class of privileged compute — and derives the governance implications accordingly.
Narnaiezsshaa Truong (Wed,) studied this question.