The watcher can't be another model.

In August, Anthropic made an automatic safety gate the default in Claude Code for its paid plans. Read that again. The company that builds the best coding agents in the world decided that letting the user set permissions was not enough, so it put a second system above the user, watching every action the agent takes.

Then it said the part out loud. In its own documentation, the gate "does not eliminate risk," and for high-stakes changes it still recommends you review the agent's actions yourself. That is the most important sentence in agent security this year, and it was written by the company least likely to want to write it.

What Anthropic actually shipped

The gate is a model judging a model. A classifier reads each tool call and predicts whether it is dangerous. It is better than nothing. Anthropic's own study of 1,053 testers found the classifier caught 89% of dangerous commands while the humans supervising caught 13.6%. People approve 97% of the prompts they are shown, and their catch rate falls from about 17% early in a session to about 5% after fifty prompts. The machine does not get tired. Good.

But a classifier is probabilistic by construction. It has a false-negative rate, which is exactly why Anthropic tells you it does not eliminate the risk, and why they still want a human on the high-stakes path. A model watching a model moves the problem. It does not close it.

Why deterministic is different

We took the other bet. Signet was built from the start as a deterministic gate with no model in the decision. Set logic and argument provenance decide every action before it runs. There is nothing to persuade and nothing to drift. The same action gets the same verdict every time, sealed to a tamper-evident record you own. On exactly the high-stakes path Anthropic tells you to review by hand, that gives an auditor and a regulator what a classifier cannot: a result that is identical every time and provable after the fact.

We are not going to tell you we invented the supervisory gate. We will tell you we made the opposite architectural choice, deterministic instead of a model judging a model, and that the strongest lab in the world just validated the category and then conceded the exact gap we close.

The whole pitch is one line. Everyone put a model on top to watch the model. The watcher can't be another model, and the company that builds the models just proved it.

If you run agents where a wrong action costs real money or real data, that gap is your problem, not Anthropic's. We should probably talk.

Source: Anthropic, "Auto mode is now the default in Claude Code," August 2026.