Why guardrails aren't enough
Errors in step 2 become inputs to step 3
Can't explain why path A was chosen over B
Same input → different outputs each run
Agents rephrase to evade filters
Logs show events, not verifications