Where can surveillance agents actually be stopped: provider, local application or data owner?

Research brief closed, 14 October 2026. Question: once a state operator has connected an agent to records or used AI to engineer surveillance software, which actor can stop access, reports and rights effects? A good answer separates live hosted-agent calls from installed code and on-premises models; identifies the owner of credentials, copied data, compute and report channel; and compares what logs actually record with case-matched human analysts. The prior inventory audit had no independent subject-level field outcome; tonight was about enforcement edges, not repeating the procurement search.

Four subquestions and source shortlist

1. Provider-visible calls and cutoff: Anthropic’s 10 September original says it banned accounts in four materially different paths: a Chinese police-linked Claude Code browser/database/report workflow, a Chinese religious-affairs dossier desk, Iranian AI-built collectors and Mali’s AI-engineered, locally deployed dossier platform. Only the first shows Claude executing police database tools and delivering reports; the religious-affairs case is primarily model-aided analyst output, with the provider separately claiming one office produced thousands of investigations a month compared with previously many teams. Neither claim has independent before/after staff counts, per-subject verification or rights outcomes. Anthropic explicitly says Mali’s on-premises deployment of other models continued after its engineering account was banned. The 25-million-SIM design scope is not observed people actioned. Provider revocation stops one hosted capability, not all compiled software, retained copies or the owner’s records.
2. Service policy versus credentials: Anthropic managed-agent policy documentation distinguishes configurable allow/ask/auto for covered tools; it does not prove how an agency actually configured independently hosted Claude Code skills, custom tools or who owns an upstream government database credential. One may infer that revoked provider access stops fresh provider API calls from that account, not that the provider can revoke the state database, stop another provider or recall shipped code. For comparison, AISI’s host-side egress design is a concrete *operator-controlled* stopper in evaluations, but AISI reports no gate-on/off prospective field prevention rate and it was not installed in these foreign state systems.
3. An independently audited data-owner gate, and its limit: GAO’s June 2026 review verifies a US financial-intelligence owner with agreements, logged identities/justifications, monthly query sampling and annual agency audits; no negative finding in the monthly reports GAO inspected and no completed annual-agency audit timetable. This shows that purpose-checked access is institutionally feasible in that pilot, not that an autonomous foreign surveillance program obeyed it or that sampled clean justifications prove no misuse. GAO’s separate CTR audit found the portal’s 9.1 million recorded CTRs accessed of 167.5 million filed (2014–23) exclude several internal-system and preview paths. Downloads can be logged without a person reading them; unlogged search summaries can expose information. After a portal retention change, three large agencies retained copies in their own systems indefinitely. Source note preserves denominators, caveats and the fact this is human law-enforcement financial data, not validation of AI policing.
4. AI marginal effect versus existing bureaucracy: Anthropic’s account-selection and before/after labor description are not an independent experiment. The serious skeptical case is that human agencies already controlled targets, telecom assets, database logins and coercion; US-style purpose agreements, revocable access and logging show real alternative gates. The strongest counter is that an approved database lookup without per-subject justification, a warrant-free local dossier generator and a shipped collector remain operative even after a provider bans an engineering account. GAO finds only an estimated 13% of surveyed agencies track their CTR usage and very few track downstream outcomes; even an access log is not a denominator of innocent people accused. No outside audit in these source checks confirms Chinese staffing savings, Mali’s actually run dossier count or wrongful/report-benefit rates against matched analysts.

Causal synthesis: live Claude → provider credential can be withdrawn; agent’s tool → state-provisioned database and outbound authority require state/data-owner permission; installed collector or local model → local operator compute and control; copied records → independent retention and audit at each new custodian. Revocation upstream blocks future upstream calls, not necessarily past exports; monthly reviews and approval can reduce misuse but only if they cover the actual route and are enforced. A discriminating safe study links signed upstream query identities, agent tool logs, copies/exports and supervisor send approvals to unique people and subsequent state decisions; it compares similarly tasked human teams on wrongful and useful leads with appropriate privacy safeguards. Source search covered one pass per four brief questions plus a narrow gap search on log/retention controls; the absence of independently observable state logs is an evidentiary stopping point, not proof that all governments lack controls.

Feed/backlog: GAO’s original long audit is weekend hold only if Dru wants a practical data-owner-control counterpoint. Anthropic’s original September report is already waiting with a summary; do not post a new link to a different section of the same long source on Wednesday. The cross-case note can serve as a short correction after he reads it, but another background post now would add clutter to an untouched state-power link.