Agentic Governance Framework

Governing a network of agents

This framework sets out how an organization governs the agents it builds, buys and relies on, and the relationships between them. It covers each phase of an agent's life, the disciplines that apply in every phase, and the control objectives that show whether governance is working.

Managed and governed agent networks

An agent network is managed when someone who did not build it can check that it is under control. The check covers the agents themselves, the standing relationships between them, and their live interactions. The relationships are the dependencies, the delegations and mandates, the contracts, and the admissions that say who may talk to whom. The interactions are the requests and the work that pass along those relationships while the network runs.

A network is governed when the organization's side is in place as well. Written policy sets what "under control" must mean for each agent and each relationship. Every agent traces to a business objective that someone still stands behind. Accountable people set the rules and audit the results.

Governance supplies the values that management enforces. A spending ceiling on an agent is a management control. The amount of the ceiling, and who may change it, are governance decisions. The control objectives on this site say what management has to show so that governance can be satisfied.

The Agentic Governance Framework GOVERNANCEsets the values MANAGEMENTenforces them, keepsthe evidence ASSURANCEchecks from outside Business objectives Obligations Risk tiers Accountable people change loops back Plan Design Build Run Change Decommission Network: relationships, interactions Internal audit Outside auditor Partner POLICY EVIDENCE FINDINGS CHANGE POLICY The Agentic Governance Framework GOVERNANCEsets the values Business objectivesObligations Risk tiersAccountable people POLICY MANAGEMENTenforces them, keeps the evidence PlanDesignBuildRun ChangeDecommission change loops back Network: relationships, interactions EVIDENCE ASSURANCEchecks from outside Internal auditOutside auditor Partner FINDINGS CHANGE POLICY

A managed network

Someone who did not build it can check that these are under control:

  • The agents. Each one has a known identity and owner, limits on what it may do, spend and reach, a record of how it was made, records of what it has done, and a person who can stop it.
  • The relationships. Every dependency, delegation, mandate, contract and admission is recorded, and delegated authority only narrows.
  • The interactions. Loops between agents are caught, failures do not cascade, cost is known across a chain, and a stop reaches all the work it should.

A governed network

The organization has also put its side in place:

  • Written policy sets what "under control" must mean for each agent and each relationship, by risk tier.
  • Every agent traces to a business objective that a named person still stands behind, with an owner of its value and a review date.
  • Accountable people set the rules, decide the exceptions and audit the results.

The tensions governance has to balance

Agility and control

Teams need to put agents to work quickly, and the organization still needs to know who answers for each one.

Autonomy and oversight

Agents are useful because they act on their own, so the limits on what they may do have to be set in advance and enforced outside them.

Innovation and standards

Experiments should be cheap and fast, and the agents that reach production should still fit together.

Why agents need their own framework

Ordinary software does what its code says. An agent decides what to do next, calls tools, spends money and hands work to other agents, often with no person watching each step. IT governance written for ordinary software does not ask who an agent acts for, what it may commit its owner to, or what happens when a mistake travels along a chain of agents belonging to different teams or companies.

Without governance written for agents, that autonomy brings real risks: data leaving where it should not, answers that are wrong, broken obligations, and costs nobody approved. This framework gives an organization the structure to use agents and still keep each one, and each relationship between them, aligned with its policies, its obligations and its objectives.

How the framework is organized

The framework has four parts. Objectives and obligations come first, because every agent has to trace to them. The lifecycle governs each agent from plan to decommission, and the change phase makes it a loop. The cross-cutting disciplines apply in every phase. The operating model sets how strictly each control applies, by risk tier.

IObjectives and obligationsEvery agent traces to a business objective, an owner of its value and a review date, and to its contractual, regulatory, internal policy and ethical obligations.

II. Lifecycle

1PlanStrategy, portfolio, catalog 2DesignArchitecture, scope, security by design 3BuildTests, review, signed builds 4RunIdentity, limits, records, alerts 5ChangeUpdate, reconfigure, roll back 6DecommissionImpact, data, notice, records
Change feeds back into Design and Build, so the lifecycle is a loop.

III. Cross-cutting disciplines

Network Security and risk Performance and quality Financial governance Organizational enablement Assurance Continuous improvement
IVOperating modelFour risk tiers, for agents and for relationships, set what every control objective requires.

Section I

Objectives and obligations

Every agent has to trace to a business objective that someone still stands behind, to a named person who owns the value it is supposed to deliver, and to a date when that value will be checked again. Alongside its objective, each agent carries its obligations: the contracts, regulations, internal policies and ethical principles that bind what it does.

Objectives

Each agent has a business objective, an owner of its value, and a review date at which it is renewed, changed or retired.

Contractual obligations

These include customer agreements and service levels, supplier contracts for models and tools, and intellectual property terms.

Regulatory obligations

These include data protection and privacy law, rules for AI systems, sector regulation and export controls.

Internal policy and ethics

Internal policy covers acceptable use, risk appetite and data classification. Ethics covers fairness, transparency, bias mitigation and explainability.

Read the section on objectives and obligations

Section II

The lifecycle

Governance is built into each phase of an agent's life, rather than added at the end. There are six phases. The fifth, Change, covers updates, reconfiguration and rollback, and it feeds back into Design and Build. That makes the lifecycle a loop that ends only when an agent is decommissioned. Continuous improvement is where that loop is governed.

The Agentic Development Lifecycle defines the work of building and running an agent as 24 stages in seven phases. Each phase here names the stages it governs and links to them, so the stages are described in one place.

Phase 1

Plan

Decide which agents the organization needs, register them, and link each to an objective.

Plan time Phase 2

Design

Scope each agent to one job, declare what it does and refuses, and set its limits before it has credentials.

Design time Phase 3

Build

Write the tests before the code, review it, and sign a record of what went into the package.

Build time Phase 4

Run

Enforce identity, limits and the network's rules on every act, and keep records nobody can alter unnoticed.

Run time Phase 5

Change

Update, reconfigure and roll back on purpose, and send any change of scope back to Design and Build.

Change time Phase 6

Decommission

Tell dependents, handle the data as stated, keep the records, and retire the key and the name.

Decommission time

Section III

Cross-cutting disciplines

The lifecycle governs an agent at particular points in time. Some disciplines have to apply all the time, in every phase. There are seven of them, and each has its own control objectives.

Network

This discipline governs the relationships between agents and their live interactions. It covers admissions, delegation that only narrows, contracts, loops, cascades, cost across a chain and how far a stop reaches, and federation between organizations.

The network discipline

Security and risk

Each agent can reach only what it declared, holds its own secrets, ignores instructions hidden in what it reads, and stays stopped once it is stopped.

Security and risk

Performance and quality

Agents are measured against known answers and evaluated continuously by something other than themselves, so that regressions and factual errors are caught.

Performance and quality

Financial governance

Every cost lands on a named account, ceilings refuse work before it spends, and each agent's return is compared with what was projected.

Financial governance

Organizational enablement

Governance bodies make timely decisions, every agent has a named owner, roles are clear, and the people who sponsor, build and use agents are trained.

Organizational enablement

Assurance

Every control objective has immutable evidence, audits and attestations rely on that evidence, and partners can verify it across company lines.

Assurance

Continuous improvement

What is learned at Run and Change goes back into Design and Build, lessons from incidents are acted on, and controls are written as code.

Continuous improvement

Section IV

The operating model and its risk tiers

A framework that applied every control at full strength to every agent would stop experiments altogether. The operating model sets how strictly each control applies, by risk tier, so that exploratory agents move quickly and critical ones get full scrutiny. Tiers apply to agents and to the relationships between them. A relationship through which one agent can commit money for another raises the tier.

TierWhat the agent or relationship is likeHow it is governed
Tier 1 ExploratoryIt runs in a sandbox with no production data.Teams serve themselves inside fixed limits.
Tier 2 OperationalIt runs on production systems with limited autonomy, and its actions can be reversed.A light review and automated checks apply.
Tier 3 CriticalIt acts with high autonomy, handles sensitive data, or takes actions that cannot be reversed.The design gets a full review, and the agent is monitored continuously.
Tier 4 StrategicIt affects the whole organization, faces the outside world, or falls within regulation.An executive sponsors it, and an outside auditor checks it.

Read how tiers are set for agents and relationships

How to read a control objective

Every page ends with its control objectives. Each objective has an identifier, such as RUN-02, that stays the same between versions of this framework so that an organization can map its own controls to it. Each one gives the same six things:

  • The statement says what the control asks for.
  • The risk addressed says what goes wrong without it.
  • The key metric is how an organization can measure whether the control is working.
  • What each tier requires gives one requirement for each of the four risk tiers, from Tier 1 Exploratory to Tier 4 Strategic.
  • The evidence names the records that prove the control holds.
  • Who may check it says whether internal audit, an outside auditor or a partner may read that evidence.

The management attributes behind these objectives fall into eleven areas: identity, authority, spend, reach, provenance (including the software supply chain), behavior inside the agent, people in the loop, records, watching, stopping, and change. Each area appears in the objectives of the phase or discipline where it is enforced.

Governance as code

This framework is meant to be applied, and it should change as agents change. The most reliable way to apply it is to write controls as code: a ceiling is enforced before money is spent, a mandate is checked before work is accepted, and a stop is checked at every door. A control written this way applies the same way every time, and it produces its own evidence as it runs.

Policy written as code is versioned, reviewed and released like any other change, which is how governance keeps up with the agents it governs. The Continuous improvement discipline covers how that happens.