Agentic AI governance.
An autonomous agent invokes tools, moves money, and changes state without pausing for human review. Governing it means producing cryptographic proof of every one of those actions, at the instant it happens.
Sealed at the decision boundary
What agentic AI governance means.
Autonomous AI agents invoke tools, modify system state, execute transactions, and orchestrate other agents, all without a human approving each step. This creates action risk, a category different from the output risk that traditional AI governance addresses.
Major governance frameworks now call for bounded autonomy, continuous monitoring, and auditable evidence of compliance. These are the right requirements. The gap: frameworks define intent, and monitoring records observations, but neither yields cryptographic proof of what actually happened.
Agentic AI governance answers this by defining permissions before execution, evaluating each action at every decision boundary, and producing cryptographic evidence of every action the agent took, whether it stayed in bounds or not.
The governance gap.
The distance between governance policy and provable compliance.
Monitoring, logging, and policy-as-code produce records of observation, not proof of what an agent actually did. AGA produces a signed record of every governance decision. An agent can be monitored while still taking unauthorized actions. A log can record a violation without having prevented it. A policy rule can advise without binding.
As agents grow more autonomous, the gap widens. Every decision made without human review is a decision that must be cryptographically recorded and offline-verifiable.
Output risk vs. action risk.
Two distinct categories. Existing AI governance addresses the first. Agentic governance addresses the second.
Output risk
Traditional AI governance
- Hallucinations and factual errors
- Bias in generated content
- Toxic or harmful outputs
- Data leakage in responses
Addressed by guardrails and content filters.
Action risk
Agentic governance
- Unauthorized tool invocations
- System state modification
- Financial transactions without oversight
- Unprovable execution history
Requires cryptographic proof at the execution boundary.
Cryptographic runtime governance.
Cryptographic Runtime Governance (CRG) closes the governance gap with a two-process separation boundary. The governed agent runs as one process with no access to signing keys. The gateway runs as a separate process holding all cryptographic material.
The agent holds no signing keys, so it cannot self-authorize an action without the gateway first parsing and validating the sealed Policy Artifact. Every governed action transits the gateway boundary. Every transit generates a signed receipt. The result: a cryptographically committed record of every governance decision.
Seal
Policy artifacts are cryptographically signed before execution.
Capture
The gateway measures continuously. The agent holds no keys.
Prove
Signed receipts chain into offline-verifiable evidence bundles.
How AGA maps to agentic governance requirements.
Seven requirements. The industry approach is observational. AGA’s approach is structural.
| Requirement | Industry approach | AGA implementation |
|---|---|---|
| Bounded autonomy | Permission scoping, RBAC | Sealed Policy Artifact defines authorized parameters |
| Continuous monitoring | Log aggregation, anomaly detection | gateway measures hash at the cadence sealed in the artifact |
| Enforceable controls | Policy-as-code advisories | Two-process boundary. Agent holds no keys. |
| Oversight evidence | Dashboards, periodic reports | Signed receipts and evidence bundles with Merkle proofs |
| Audit trail integrity | Append-only databases | Hash-linked receipts under a signed Merkle checkpoint |
| Offline verification | Tied to the producing system | Evidence bundles verify with standard crypto. No network required. |
| Drift response | Alert, then human review | Response chosen from a sealed set of actions, recorded in a signed receipt; handler wired per deployment |
Standards alignment.
Six frameworks. AGA produces the evidence each one calls for.
NIST AI RMF
Govern, Map, Measure, Manage functions
EU AI Act
Articles 9, 12, 14: risk, records, oversight
CISA Secure by Design
Demonstrable runtime controls
OWASP Agentic AI Top 10
Agent-specific threat coverage
CoSAI MCP Security
Coverage across the 12 MCP security threat categories
NIST SP 800-218 / SLSA
SSDF provenance and integrity
Not a certification or compliance framework. Describes architectural design alignment only.
MCP tool-call governance.
MCP defines how AI agents discover and invoke external tools. AGA integrates at this layer to govern every tool call. Authorized configurations are sealed into a Policy Artifact. The gateway intercepts each invocation, validates it against the sealed configuration, and generates a signed receipt.
The governance decision is made at the protocol level, the layer every tool call must cross before reaching the application. For a deeper look at the threat model, see AI agent security.
Frequently asked.
See the architecture.
How the two-process boundary, the sealed Policy Artifact, and the receipt chain compose into a verifiable governance system.