In July 2026 we pointed RE³ at something it was never built for: a team of AI agents doing research together. The point was not that it worked. The point is that we then ran the same task with the governor switched off, measured both, and published the ceiling along with the result.
A demonstration that only shows the governed run proves nothing: you cannot tell whether the governor did the work or the models were simply having a good day. So we ran both arms, with identical measurement on each.
| Measured on the shared work | Ungoverned | Governed |
|---|---|---|
| Contributions carrying a defect | 19 / 57 | 0 / 45 |
| Genuinely contested questions settled as if they had one answer | 14 | 0 |
| A flagged agent flags again on its next turn | 72.2% | 7.7% – 18.2% |
That last row is the one we did not expect. Ungoverned, a flagged agent was more likely to err again (72.2%) than a clean one was to start (14.7%): nothing corrects it, so the mistake compounds. Governed, the rate after a flag falls below the baseline. The corrective loop is doing work, not just recording.
Across 28 rounds the governor read every contribution before it entered the result, and kept 28 of 140 out of the final report. One model kept overstating a genuinely contested question. It was taken off the work, a fresh agent picked up its topic, and it could only return through sustained clean contributions rather than a single good one.
The strongest model in the crew was flagged most often. One of the cheapest ran clean. Across four independent runs each model's characteristic mistake reproduced, but no model was reliably "the good one".
Where the sources genuinely disagreed, the disagreement was surfaced to the human rather than resolved by an agent. Every attempt to close one was caught. None was closed by an agent.
Four independent runs held a tight flag-rate band (20.0% to 26.7% per run). We audited our own scoring as hard as we audited the crew: every judge call logged, its determinism re-checked.
The benched model cooled over several rounds of clean work, earned its way back, and then relapsed on its very next unscaffolded turn. We are publishing that, because it is the most useful thing the run produced. A governor is not therapy for a model. It is a boundary that holds while it is there.
A related finding points the same way. The rule the model kept breaking was sitting in its own system prompt the entire time, and it broke it on alternate rounds anyway. Correction lasted exactly as long as the feedback stayed in context. A static instruction is memoryless; a governed loop is not. That is the argument for a layer outside the model rather than better wording inside it.
And one honest surprise against ourselves: the ungoverned run's final write-up still came out factually clean. The damage landed in the shared workspace, not on the product surface, which means a surface-level fact-check would have missed all of it. That is why the workspace number, 19 against 0, is the one that carries the weight here.
We asked the skeptical question ourselves: does the paired result survive outside one domain? So we ported the same governor, unchanged, to five more kinds of knowledge work: legal and regulatory research, procurement evaluation, policy synthesis, financial diligence, news synthesis, and a clinical guidelines exercise we keep internal by policy. Every domain is a fully fictional world with authored sources, so ground truth is decidable and no real-world claim is ever made. Each got a governed run and an ungoverned twin: identical agents, identical sources, identical measurement, twelve rounds each.
The result was the same in every domain. Governed: zero flagged claims reached any shared workspace, and zero contested questions were asserted settled. Across the six ungoverned twins: 94 flagged claims shipped, contested questions were asserted settled 60 times, and in five of six domains the agents closed a question the sources genuinely leave open. In each case it was that domain's classic hazard: a superseded specification cited as current, a corrected official statement ignored, a retracted study relied on, a repealed statute treated as live, two ministries' unreconciled statistics averaged into one number. Retrieval was perfect by construction in every run; the failures happened anyway. The agents did not lack evidence. They mishandled it.
And one number we attacked ourselves before publishing. Every contested-topic claim that merged had correctly declared itself as holding the question open, with zero exceptions. A number that clean should worry you, and it worried us: part of it is guaranteed, because the gate structurally refuses to merge anything else. The honest version is stronger. The agents tried to route around that rule 26 times out of 134 contested-topic contributions, roughly one attempt in five, and every attempt was caught. The purity of the output is not the models behaving. It is the gate earning its keep, on the record, in runs that can be replayed and checked from their own logs.
AURI shows the core holds with a vulnerable person, which is the hardest case we know. This demonstration shows the same core holds in a domain it was never designed for, with models we do not control, from vendors who did not build for us. A safety feature works where it was fitted. Infrastructure works where you point it.
It also lands on a question regulation is already asking. Where an AI system leaves something genuinely open, a human being has to be the one who decides it, and has to be able to see that they did. Keeping open questions open, and putting them in front of a person rather than letting an agent quietly resolve them, is not a courtesy. It is the part that has to be auditable.
This was a demonstration, not a product launch. If you are putting AI agents somewhere the failure mode matters, we would like to hear what you are building and what you need to be able to prove about it.
Get in touchQuestions? info@real-e3systems.fi · WhatsApp +358 50 3791916
