An AI agent crossing a system boundary does exactly the same thing. It encounters a term, collapses the ambiguity without noticing, and continues as if the meaning was settled. That isn’t intelligence. It is an automated assumption and the agentic wave has industrialised it.
Agents don’t answer questions. They act.
The first generation of enterprise AI mostly retrieved and responded. Ask a question, get a grounded answer. The failure mode was a bad answer, which a human could catch.
Agents are different in kind. They plan, reason, and take action across many steps, issuing dozens or hundreds of queries across multiple domains in a single workflow. Each domain boundary they cross is another silent interpretation. Each interpretation feeds the next step. Errors don’t just appear; they compound, and then they execute. By the time you read the output, the agent may have already sent the email, moved the money, or updated the record.
This raises the stakes on a problem that was survivable when meaning lived in a human head and inconvenient when it lived in a dashboard. When meaning lives in an agent’s chain of actions, every hidden assumption becomes operational risk.
Our guardrails guard the wrong thing
The agent-safety conversation in 2026 has produced real guardrails: authorise tool calls before execution, enforce rate limits, validate what the agent actually did, filter inputs and outputs. These are good and necessary. But notice what they govern. They govern behaviour — what the agent is allowed to do and how much.
None of them catches the agent doing the wrong thing for the right reasons, confidently, on a misread definition. An agent that has silently decided “revenue” means gross when finance means net will pass every behavioural guardrail you have. It is authorised. It is rate-limited. Its actions are logged. And it is wrong in a way no filter can see, because the error is semantic, and your guardrails are syntactic.
The missing guardrail is meaning itself.
Ontologies are how meaning becomes a guardrail
This is what ontologies are for and it helps to be precise about which kind, because the word carries at least two jobs.
A vocabulary ontology answers “What do we mean when we talk about this thing?” It captures concepts, human- and machine-readable definitions, relationships, synonyms, and high-level rules. It is a semantic blueprint of the domain. A data-structure ontology answers “What data about this thing looks like?” — properties, cardinality, constraints, identifiers, validation.
For agents, the vocabulary ontology is the one that turns meaning into a guardrail. It provides a ground truth of enterprise terminology that the agent can be held to: this is what “customer” is, this is how it relates to “account,” these are the constraints, this is the canonical identifier. The agent no longer has to guess at a boundary, because the meaning is handed to it explicitly.
The implementation side is converging on this. GraphRAG pairs retrieval with a knowledge graph so answers are grounded in relationships and structure, not just textual similarity. Ontology-grounded agents measurably reduce hallucination and digression, because structural grounding gives the model typed relationships and constraints that flat retrieval cannot. The pattern arriving across vendors is the same: put an ontology under the agent, and it stops sounding right while being wrong.
Grounding is necessary but not sufficient
Here is where most of the current tooling stops, and where it shouldn’t.
Grounding an agent in an ontology tells it what terms mean. It doesn’t, by itself, tell it what to do when meaning is genuinely ambiguous or contested across domains. And the temptation (for models and the people building on them) is to resolve that ambiguity by inferring it away. Pick the most likely interpretation and proceed.
That is precisely the failure to avoid. If a representation admits more than one valid interpretation, its meaning isn’t resolved; it defines a possibility space. An agent operating on it isn’t executing a determined meaning. It is selecting one, silently, exactly the move we started by warning against.
The discipline here comes from two ideas that belong together:
Semantic sovereignty: Each domain retains the right to define its own terms locally, and that local meaning stays explicit and governable rather than flattened into a false universal.
Model-executable thinking: Ambiguity isn’t something to manage at runtime — it is a failure condition to resolve before execution is allowed. If meaning cannot be resolved to a single path where the consequence is real, execution should be denied and clarification required.
Put together, they give agents a semantic contract. When an agent crosses a domain boundary, it should be handed an explicit, sovereign definition, not left to assume one. And where meaning cannot be made explicit enough to act on safely, the agent must surface the ambiguity rather than infer it away. One idea governs what a term means inside a domain. The other governs what is allowed to happen across domains. AI didn’t create this problem, but it removed our ability to keep ignoring it.
Where to start
None of this means ontologising the entire enterprise before you let an agent do anything. That is the same over-formalisation trap that has sunk a decade of enterprise modeling exercises.
The move is to identify where ambiguity becomes expensive (revenue decisions, compliance boundaries, irreversible automated actions) and make meaning explicit and enforceable there first. Build the vocabulary ontology for the concepts the agent acts on at those points. Ground retrieval in it. And wire in the rule that where meaning is unresolved and the consequence is real, the agent asks instead of guessing.
Make them mean right
We spent the last few years teaching models to sound right. The harder and more valuable step is making them mean right — to act on definitions the organisation actually holds, to honour local meaning instead of steamrolling it, and to stop at the boundary when meaning runs out rather than inventing it.
Ontologies are how meaning stops being something an agent quietly assumes and becomes something it is held to. In an enterprise full of agents acting across boundaries, that isn’t a nice-to-have. It is the guardrail we have been missing.