Note · 2026-08
You can have a program and still have a loose agent.
A policy PDF shows that a program exists. The useful question is simpler: if this agent tries something it should not, does anything actually stop it?
Most teams already have policies, access control, and logs. That is not the same as a check that runs before the action. A login system may let the agent call an API. A log may show what already happened.
None of that answers: may this action happen right now? If the answer is no, does it still run?
Nexus sits in that gap. If Nexus says no, the action does not happen.