The Negative-Carry Code Crisis
In quantitative finance, a negative-carry asset is an investment where the ongoing cost of holding the position exceeds the cash flow or yield it generates. You might buy an asset thinking it will appreciate, but every day it sits on your books, financing costs, storage fees, and insurance bleed your principal dry.
That is exactly what has happened to enterprise software in 2026.
Every engineering organization I talk to tells me the same story. Their developers are shipping code faster than ever. Copilot, Cursor, and autonomous agent loops generate thousands of lines of TypeScript, Python, and SQL before lunch. On paper, pull request velocity is up 300%. The executive dashboard looks incredible.
Then you walk onto the engineering floor.
Senior engineers aren’t building new features. They spend 80% of their week reviewing giant, synthetic diffs they didn’t write, tracing subtle edge-case regressions, and trying to figure out why an agent wrote three different ORM abstractions for the same Postgres table. The creation cost of software dropped to zero, but the carry cost skyrocketed.
The Illusion of Free Velocity
Code is not an asset. Code is a liability. The value of software is in the business problem it solves and the user intent it satisfies. Every line of code written to accomplish that goal is technical debt that must be maintained, secured, upgraded, and understood by human beings.
When humans wrote all the code, there was a natural biological friction limiter: typing speed, cognitive fatigue, and the need to mentally simulate architecture. That friction was annoying, but it kept the total surface area of code roughly bounded to what a team could comprehend.
AI removed that biological limiter without giving teams an architectural replacement. Now, an engineer with a vague prompt can generate 5,000 lines of boilerplate in 45 seconds. Because generating it took zero effort, committing it feels free.
It is not free. You just committed a negative-carry asset. Tomorrow, someone has to upgrade a dependency, fix a race condition, explain it to a SOC 2 auditor, or debug a production incident at 2 AM. When nobody on the team deeply understands the internal state transitions because nobody actually wrote them, MTTR (Mean Time to Resolution) explodes.
The 2008 Analogy: Packaging Unverified Risk
In 2008, the financial system collapsed because Wall Street packaged unverified, low-quality mortgages into complex derivatives, stamped them with AAA ratings from agencies who didn’t examine the underlying assets, and traded them as pristine capital.
The software industry is running the exact same playbook today.
An agent writes a tool execution loop or a microservice. A superficial linter passes. A unit test generated by the same LLM passes (testing only what the LLM remembered to test). The PR is stamped approved because no human has the mental stamina to review 200 AI PRs a sprint. The unverified risk is merged into the mainline repository.
As these unverified layers compound, you reach technical insolvency. The team spends so much capital simply maintaining the carry costs of their AI debt that innovation slows to a crawl.
Why Prompt Guardrails Cannot Fix Negative Carry
Most vendors try to solve this by adding more AI: an LLM-as-a-judge reviewing the first LLM, or elaborate system prompts begging the model to “write clean, maintainable code.”
That is like buying flood insurance from someone who predicts the weather by flipping a coin. You cannot solve hallucinations by adding another layer of hallucinations on top of it.
The only way to eliminate negative-carry software is to enforce deterministic execution boundaries. The AI should propose intent, but compiled CPU logic gates must verify whether that intent is structurally admissible before it ever executes against a database, API, or production codebase.
The Exogram Authority Runtime Law:
Never allow a probabilistic intelligence engine to hold unilateral execution authority over production systems of record. Cognition must be separated from execution. Every mutation must pass a deterministic 0.07ms boundary backed by cryptographic state proofs.
Until organizations stop measuring software by lines of code generated and start measuring by total carry cost, the crisis will worsen. If you want velocity that compounds positively instead of negatively, you need a deterministic bouncer at the door.