You've got the architecture exactly right on the audit trail. The enforcement layer owns the log — agent requests authority, enforcement decides and writes the receipt, agent never has write access to its own trail. Learned that one the hard way early on; the self-reporting model feels fine until you think about what a compromised agent would do with it.

The cold-start problem with circuit breakers is real and honestly the thing I'd change if I were starting over. Right now we handle it two ways: first-deployment agents run in shadow mode for a configurable window (logs anomalies, doesn't trip), and you can seed a baseline by importing behavioral profiles from similar agent types. Neither is perfect. The shadow window is a genuine blind spot — you're essentially saying 'we'll catch drift but not the first-run behavior.' Still figuring out a cleaner answer there.

Failure mode in practice: authorization layer, by a lot. The pattern is almost always agents that were scoped for one task creeping into adjacent ones — not malicious, just the model generalizing in ways the permission declaration didn't anticipate. Audit layer failures are rarer and usually infrastructure (the log queue backing up, not the design). Which is somewhat reassuring — it means the architecture holds, the problem is teams underspecifying permissions at registration time.