Agent governance
Data governance frameworks were built for information at rest. Agents act. They make decisions, trigger workflows, consume resources, and produce outputs — autonomously, at speed, at scale. Governing them requires a different set of primitives.
A dataset does not decide. An agent does. That single distinction changes everything about how governance must work.
Access to data, data quality, data lineage, retention policies, classification tiers, privacy controls. The data sits still. Governance determines who can see and use it.
What an agent is allowed to do, not just what it can see. Action limits, autonomy levels, conflict arbitration, behavioral drift detection, and accountability when something goes wrong.
Data governance violations are typically discovered after the fact — in an audit, a breach, or a compliance review. Humans investigate and remediate.
Agent governance must enforce limits before an agent acts — not after. By the time an autonomous agent has made a decision, the outcome may already be irreversible.
Every agent must be registered before it is allowed to act. Registration includes: owner, domain, purpose, data access scope, action permissions, and ladder rung. An unregistered agent is an unauthorized agent.
Each agent class has an explicit allowlist of actions it may take — and a denylist of actions it may never take, regardless of instruction. Actions outside the allowlist require human approval before execution.
Data access is scoped per agent, not per user. An agent may only access data explicitly granted to its registration. Access to higher sensitivity tiers requires CAO approval and is logged immutably.
Superseded by the Agentic Autonomy Ladder. Autonomy is no longer a label attached to an agent — it is a five-rung contract stating what the agent may do, what contains it, who is responsible, how compliance is measured, and the exact rules by which it ascends and descends. The other four layers are unchanged in intent and now feed the ladder's gates and compliance signals rather than standing alone.
Agents are monitored continuously against their registered behavioral profile. Deviations — in output quality, decision patterns, latency, or resource consumption — trigger alerts and, above defined thresholds, automatic containment — a safe-hold on high rungs, pending review.
Autonomy is earned, and always revocable. No agent is born autonomous: it ascends by accumulating measured evidence, and it descends the moment it violates its contract.
An agent's rung is a function of two dimensions, not one. Reversibility — how costly the action is to undo if wrong. Sensitivity — the data scope and blast radius it touches. An agent earns a rung for a specific region of that grid, not in general, and its rung is capped by the more demanding of the two.
Every rung specifies six things: the autonomy it grants, the deterministic gates that contain it, the responsible roles, the compliance signal with its threshold, the promotion rule, and the demotion rule. Accountable is always the CAO; the AGP operates; the domain owner implements.
A breach here suspends the agent outright.
Any executed action without approval drops it to Shadow. Immediate.
Error rate above ceiling or a missed high-impact escalation drops it to Supervised.
Automatic safe-hold. Demotion waits for human confirmation.
Automatic safe-hold, strictest notification. Demotion waits for human confirmation.
Two controls are not rungs. Security and jurisdiction cut across the ladder and harden as an agent climbs it. Autonomy answers how much freedom; these answer under what conditions that freedom is permitted at all. Both return a rung cap, and the effective rung is the minimum.
effective_rung = min( earned_rung, # from the ladder's promotion rules security.rung_cap, # Gate A — OWASP Top 15 agentic + MITRE ATLAS jurisdiction.rung_cap # Gate B — EU AI Act / US sectoral )
An agent can perform flawlessly and still be blocked from ascending, because these gates are orthogonal to performance. A prohibited jurisdiction overrides performance entirely. This is the structural guarantee that an agent's competence cannot override the conditions under which it is allowed to be competent.
Containment answers does the agent keep acting? It is always immediate and automatic — but it is a safe-hold, not a kill: the agent starts no new actions, while already-committed operations close cleanly to its declared safe-hold point. Risk is contained without tearing permissions away mid-transaction.
Demotion answers does the agent drop a rung permanently? On rungs 1–3 that is cheap to reverse, so it is automatic. On rungs 4–5 it carries business consequence and is not urgent once the agent is already contained — so it waits for human confirmation, or is cleared as a false positive and the agent resumes.
What is automatic and immediate is the safe-hold, never the demotion. The requirement it forces — that every high-rung agent declares where it can safely freeze — is itself the Rung 4 promotion gate. An agent that cannot define its safe-hold point does not qualify.
Because containment is measurable, the framework reports mean time to containment, not only mean time to remediation. Remediation can take days; containment must take seconds. A governed ecosystem is not one that never breaches — it is one that contains breaches faster than they compound.
| Agent class | Autonomy | Data access | Max action scope | Escalation trigger |
|---|---|---|---|---|
| Research agent | Rung 2 · Supervised | Public + internal read-only | Read, summarize, report | Any write action attempted |
| Workflow agent | Rung 3 · Conditional | Domain-scoped read/write | Trigger, update, notify | Cross-domain action or spend > threshold |
| Decision agent | Rung 3 · Conditional | Domain-scoped + aggregated | Classify, score, route | Confidence < threshold or novel case type |
| Execution agent | Rung 4 · Autonomous-Bounded | Full domain access | Act, commit, publish | Irreversible action or policy conflict |
| Orchestrator agent | Rung 4 · Autonomous-Bounded | Cross-domain read, agent registry | Coordinate, delegate, monitor | Sub-agent failure cascade or budget breach |
Rungs are not permanent — that is the point. Each is assigned at registration from the agent's reversibility and sensitivity profile, earned upward on measured evidence, and revoked on contract breach. The rungs shown here are the earned rung; the rung an agent actually operates at is min(earned, security.cap, jurisdiction.cap), so a security finding or a jurisdictional disposition can hold an agent below the class default. Any agent at Rung 4 or above must also carry a declared, verified safe-hold point. See the Autonomy Ladder.
Resource contention — two agents competing for the same API rate limit, database connection, or compute allocation simultaneously.
One agent fails silently. The other may produce incomplete output. No log of the conflict. No alert. No resolution protocol.
Priority determined by agent class and business criticality. Lower-priority agent queues. Conflict logged. CAO notified if pattern repeats.
Goal conflict — a sales agent optimizes for conversion while a compliance agent flags the same customer interaction as high-risk.
Whichever agent acts first wins. The other's signal is ignored. Regulatory exposure accumulates invisibly.
Compliance signal always overrides commercial signal at the action boundary. Conflict escalated to human review. Policy updated if pattern is systemic.
Instruction conflict — an agent receives contradictory instructions from two orchestrators with overlapping authority.
Agent behavior becomes unpredictable. It may follow the most recent instruction, the most permissive one, or halt entirely without explanation.
Agent escalates immediately. Orchestrator hierarchy is consulted. Conflict resolved at the governance layer before any action is taken.
The governing principle: when agents conflict, governance decides — not the agents. The conflict resolution protocol is defined by the CAO and enforced by the Agent Registry, not by the agents themselves arbitrating in real time.
policy_flags
Any policy boundary touched during the run — attempted denied action, sensitivity ceiling approached, autonomy limit reached. Flags are written even when the policy blocked the action successfully.
actions_taken
Ordered sequence of every discrete action in the run: API calls, database writes, messages sent, files created. Not a summary — a complete record.
escalated_to
If the agent escalated to a human, this field records who received the escalation, when, and what decision they made. Escalations close the loop between autonomous action and human oversight.
input_hash
Inputs are hashed rather than stored in full to protect privacy while maintaining auditability. The hash allows verification of what was processed without exposing the raw content.
All audit records are append-only. No agent, orchestrator, or user can modify or delete a run record after it is written. This immutability is the foundation of regulatory defensibility.
The EU AI Act classifies AI systems by risk level. Agents in high-risk categories require human oversight, transparency, and auditability. The CAO framework enforces these requirements at the governance layer.
The NIST AI Risk Management Framework defines four functions: Govern, Map, Measure, Manage. The CAO role maps directly to the Govern function, with the Agent Registry providing the infrastructure for Map, Measure, and Manage.
Agents that process personal data create new privacy risks — automated decision-making, data minimization, and purpose limitation requirements apply to agentic systems just as they do to human processes.
Policy definitions, audit trails, and compliance monitoring — implemented in a single system of record.