Who owns what your agents know?
The question underneath the open-versus-closed AI debate
An Anthropic API key I could not account for had spent $386 in two days on Fable, a model none of my projects use outside of my Claude Max subscription.
I went looking. The model name appeared nowhere: not in the repo, not in a worktree, not in an env file. The key itself was not in my main product’s codebase either. I disabled that API key and watched to see what would break.
Something did, but that is for another essay. Here is what struck me: I could name every model in my stack, estimate their prices, defend every choice… and I could not say what my own products were doing with this one.
I knew my models. I didn’t know what my product knew.
The wrong layer
This week, Moonshot AI released the weights for Kimi K3: 2.8 trillion parameters, free to download, benchmarking near the frontier models many of you and I pay real money for.¹
It reopened a familiar argument. Dylan Patel at SemiAnalysis holds that the frontier is not substitutable by open-weight models for real knowledge work, and that Anthropic’s expanding margins prove it.² Ed Zitron reads the same figures as a subsidy coming apart.³ They agree on almost nothing except where the contest happens: the model layer.
I think that’s the right layer for a small population and the wrong one for everyone else. Tech companies adopt at the model layer. They run evals, route to whatever is most effective per dollar, and swap freely. Uber and Cursor buy models. Everyone else buys products and buys them on trust: the confidence gap between what AI can do and what you’ll actually let it do. Trust is built by the harness around the model as much as the model itself.
And I think that’s going to become increasingly true. Everyday intelligence is getting commoditized quickly. Gartner predicts that by 2030, running inference on a trillion-parameter model will cost providers over 90% less than it did in 2025.⁴ As intelligence gets democratized, the differentiated trust-building will happen further up the stack.
We can think of the AI tech stack in three layers, and they are not aging at the same rate. To make this concrete, picture a health organization whose community health workers text a triage AI assistant from the field.
The model layer. The intelligence itself: weights, reasoning, raw capability, priced per token. Here, it is whatever reads the symptoms: GPT 5.6 or Claude Fable 5 over an API, or Kimi K3 running on servers the ministry controls. Commoditizing from below. Production gateways already route nearly a third of their tokens to open models.
The harness layer. The production runtime around the model: the messaging interface the health worker already uses, the lookup into the patient record, the escalation to a nurse when confidence drops, the enforcement of every rule at the moment of answer. This could be built with Claude Code and Codex at the individual coder end; LangGraph and CrewAI for orchestration of the agent in production; or perhaps Bedrock AgentCore, OpenAI Frontier, Claude Managed Agents as the managed enterprise versions. Commoditizing from above. The runtimes ship orchestration natively, and the labs give their harnesses away to sell the tokens underneath.
The knowledge layer. What the assistant actually knows: the national treatment guidelines, the referral thresholds, the drug interactions, the rules the harness enforces, and the record of which answers a clinician has reviewed. When WHO updates a protocol, this is the layer where someone decides what changes. The layer that stays hard. It appreciates as everything beneath it gets cheaper, and it is the only layer where ownership has teeth. What your agents know. Who approves changes to it. Whether it can leave.
Where trust actually forms
I can see where trust forms in my own work.
This month I have been building slides in Claude Design. The output is good and fast. For this use case, I had stopped comparing alternatives. Even if a stronger model ships somewhere soon, I am not likely to move because the harness won the workflow. If that is how I behave (and I follow model releases closely), it is how most buyers will behave.
The spend data says the same thing. Vercel routes tens of trillions of tokens a month between production applications and AI labs. The June numbers split cleanly. Cheap open models run the volume. Trusted harnesses take the money.⁵
Organizations are making a version of the same commitment. I have watched teams teach employees to build Claude Skills: one analyst’s workflow, packaged so two hundred colleagues can run it identically. That is institutional knowledge compounding inside a vendor’s harness, and it is the best argument for committing to one. But look at what a Skill actually is: a folder of plain markdown files. Keep them in your own repository and you get versioning, review, and distribution for free; the runtime just consumes them. The format is Anthropic’s. The knowledge is yours. Committing to a harness and handing over your knowledge are two different decisions.
The platforms bundle those decisions by default. On Bedrock, Foundry, or Vertex, what your agents know accumulates in managed memory stores and vector indexes: readable by API, not by your staff, written by automated extraction with no human approval on what gets remembered.⁶ Approval exists for what agents do, not for what they learn. Palantir treats institutional knowledge as first-class (analysts call the Ontology its deepest moat), but it lives inside Palantir’s environment and cannot realistically leave.
There is a simpler practice, and it is the one I am converging on in my own work. Institutional knowledge, evals, and guardrails as plain files in a repository your company owns. Agents propose changes; designated people approve them, the way engineers approve pull requests. Pieces of this are arriving from both directions: the data-governance vendors now sell versioned, portable context as a platform, and every major coding agent already reads knowledge files straight from git. The missing piece is the discipline, not the technology. One append-only record serves as the audit trail, the eval set, and the evidence of impact. Any model, any runtime, swap without a rebuild.
The vendor owns how your agents run. You own what they know.
The exit test
So who owns what your agents know? For most organizations today, the honest answer is their vendor. Not because anyone decided that. Because the default settings decided it, one convenient integration at a time, while everyone argued about models.
The answer doesn’t have to stay that way, and fixing it doesn’t require giving up the harnesses winning workflows right now. It requires treating the knowledge layer as a separate decision. Keep the files in your repository, gate the changes, and hold the record, then use whatever runs best this quarter.
Ownership is only tested at the exit, though, and almost nobody has run the test. Claude Fable 5 was export-controlled for eighteen days in June, days after launch. Vendors get acquired. Prices change. Contracts end. When the health organization’s contract does, the question is whether the guidelines, the thresholds, and the reviewed record leave with the ministry or stay behind. Some Tuesday, one of those will happen to a workflow you depend on, and you will reach for what you assumed was yours.
What will you find?
¹ Moonshot AI, Kimi K3 release, July 2026. Coverage.
² Dylan Patel et al., AI Value Capture: The Shift To Model Labs, SemiAnalysis, May 2026.
³ Ed Zitron, AI Doesn’t Have ROI, Where’s Your Ed At, June 2026.
⁴ Gartner, Gartner Predicts That by 2030, Performing Inference on an LLM With 1 Trillion Parameters Will Cost GenAI Providers Over 90% Less Than in 2025, March 25, 2026. Will Sommer, the analyst behind the forecast, warns chief product officers not to confuse “the deflation of commodity tokens with the democratization of frontier reasoning.” Cheap tokens for everyday knowledge tasks do not mean cheap judgment for high-stakes work.
⁵ Vercel, AI Gateway Production Index, July 2026, reporting June 2026 routing data. Anthropic took 61% of gateway spend on 32% of tokens, and 72% or more of spend in every high-stakes use case; open-weight models ran 29% of tokens on under 4% of spend. One gateway’s view, not the whole internet: Vercel skews toward production web applications. OpenRouter, a larger multi-model gateway routing roughly 29 trillion tokens a week, shows Chinese-origin open models above 45% of token volume and Anthropic near 13% of tokens, while Anthropic holds a far larger share of dollars through premium pricing. No comprehensive measure of all inference exists; most enterprise traffic runs direct to the labs and never crosses a public gateway. But every gateway that reports shows the same split: volume follows price, spend follows trust.
⁶ Verified at documentation level, July 2026: Bedrock’s human-in-the-loop confirms tool actions, not memory writes; Microsoft’s June 2026 security guidance advises customers to build their own review-and-quarantine layer for agent memory.