Architecture pillar

Governed agent execution

Safe autonomy is constrained execution, not a stronger system prompt.

An agent becomes consequential when it can change an external system. At that boundary, instructions inside the model are not enforcement. The runtime must identify the actor, resolve delegated authority, evaluate policy, contain the action, route exceptions to a human, and preserve enough evidence to reconstruct the decision.

Diagnose the ambient-authority problem →

Bind every action to identity and delegated authority

“The agent did it” is not an accountability chain. Every request should carry the initiating principal, the delegated task, permitted resources, purpose, expiry, and the service identity used at execution. Task-bound leases keep authority narrower than standing roles and make revocation mechanical.

Agent permissions should expire like leases →

Separate policy decisions from enforcement

A policy decision point evaluates actor, action, resource, environment, and risk against a versioned rule set. An enforcement point then prevents execution unless the result is allow or a precisely scoped approval has been satisfied. Deny must remain stronger than a generic approval.

Policy-as-code is how enterprises say yes to agents →

Size containment to the accepted blast radius

Sandboxing is not one binary control. Filesystem mounts, credentials, network egress, process limits, data scope, time, and spend should be granted from the worst effect the task may cause. Generated code and computer-use paths deserve stricter boundaries because their action spaces are broader and less typed.

Choose sandbox strength from blast radius →

Make escalation show the real consequence

Human approval is useful only when the reviewer can see the proposed action, target, changed state, evidence, rollback boundary, and authority being exercised. A vague “approve?” prompt transfers risk without transferring understanding.

Approval UX should show blast radius →

Preserve reconstructable decision evidence

The audit record should connect the principal, delegation, policy version, matched rules, approval, tool request, outcome, and resulting state. Logs that retain only model text or a final success flag cannot answer who acted, for whom, under which authority, and why.

Proof and limits

Inspect policy as an execution boundary

Follow one consequential request through policy evaluation, approval, enforcement, and audit evidence.