Governed agent execution
We need agents to act without granting ambient authority
Consequential action must pass through external controls sized to the accepted blast radius.
An agent that inherits a broad service account can turn one mistaken or manipulated decision into an unrestricted external effect. A system prompt may describe what the agent should do, but it cannot enforce which identity acts, which resource is in scope, when authority expires, or whether the action should pause.
See the Governed Agent Execution pillar →
Decisions that constrain useful action
- Identity: Preserve the initiating principal and the service identity that will execute the action.
- Delegation: Grant task-bound authority with explicit purpose, resources, limits, and expiry instead of standing ambient access.
- Policy: Evaluate actor, action, resource, environment, and risk outside the model before execution.
- Containment: Restrict filesystem, network, credentials, data, time, and spend according to the worst accepted effect.
- Escalation and evidence: Make approvals specific and preserve the policy, authority, request, outcome, and resulting state.
Read the authority path
- Policy-as-code is how enterprises say yes to agents — enforce versioned decisions at runtime.
- Choose sandbox strength from blast radius, not convenience — contain the accepted effect.
- Agent permissions should expire like leases — bind authority to scope and time.
- Approval UX should show blast radius — give reviewers the real consequence.
- Audit trails must preserve the authority chain — make responsibility reconstructable.
Proof and limits
Inspect policy-as-code
See how one bounded implementation turns governance rules into deterministic runtime outcomes and attributable evidence.