Plane 02
Runtime.
Govern the action.
This is the thesis made physical. A control that is not enforced at the moment of action is a record, not a control. The Runtime is where policy decides before anything happens, and where an action can be stopped in flight.
01Runtime · The substrate
Is there a single place to enforce, or a mesh where enforcement is impossible?
Write a control once. Have it hold everywhere.
The Fabric is the layer through which agents find tools and data, and through which every interaction is mediated and observed. A web of point to point integrations makes a single guarantee impossible. A fabric with a policy plane makes it structural.
One chokepoint, enforced everywhere
A control written once holds across every agent, tool, and call. That guarantee is only achievable when everything flows through one mediated lane.
Every tool a permissioned endpoint
Each capability an agent can reach is a named, revocable, logged access grant, not a convenience.
Observable by construction
If the fabric mediates every interaction, telemetry and evidence are free. If agents talk directly to systems, you are blind to the traffic that matters most.
The failure if absent
Integrations proliferate faster than anyone can inventory them. Each new agent to tool connection is a private door. Enforcement fragments into as many policies as there are pipes, which is to say it stops existing.
Replaces
Reads from
- Warehouses and lakes
- Model and feature registries
- Agent frameworks and copilots
- SaaS and core systems
- Identity and ticketing
- Third party AI and vendors
The governance layer
Fiducia
The Runtime
Checked before it commits
Answers to
- The board
- The regulator
- Internal and external audit
- Model risk and compliance
- Customers and members
- The public record
02Runtime · The hardest surface
An agent acts for a person but is not one. Whose authority does it hold, and how much?
Classical identity has no clean primitive for an agent. This does.
An agent is not a shared service account and not a human's session. It is a distinct, attributable actor, and it needs authority scoped to the task in front of it, never the union of everything the user could ever do.
Agents are first class identities
A distinct, attributable actor, not a borrowed login. Every agent has its own identity, its own record, and its own leash.
Scoped to the action, never the union
The agent gets the user's authority for this one task, granted just in time, nothing more.
Short lived and secretless
Just in time credentials that expire, over standing secrets that leak and linger.
Attributable to the triple
Which agent, on behalf of whom, under what authority basis. Every action answers all three, always.
The containment failure
An agent that inherits a wealth advisor's full entitlements can act across that advisor's entire book. Least privilege is not hygiene here. It is the boundary that decides whether one confused agent touches one account or ten thousand.
Replaces
Blast radius · full inheritance vs scoped
Full inheritance
the advisor's whole book
Scoped to the action
one account in reach
The Authority Ladder
Declared, never default
- 1
Read only
Retrieve and summarise. Nothing it touches changes.
Data scope and sensitivity class
- 2
Suggest
Propose an action. A person commits it.
Every commit is human
- 3
Act within reversible bounds
Commit actions that can be undone.
Reversibility and a blast radius cap
- 4
Consequential action
Commit actions that cannot be taken back.
A named human approves before commit
- 5
Self directed inside a mandate
Choose its own steps toward a stated goal.
Mandate bounds, kill switch, standing review
Drift up the ladder is the failure agent governance exists to prevent. The Registry records the rung, the Control Plane enforces it.
03Runtime · The thesis, made machinery
Is your policy a document, or the thing that decides before an agent acts?
The single place where governance physically happens.
A platform that stores policies and generates reports is not a control plane. The control plane sits in the request path and can say no before anything happens. That is the whole distinction.
Agent requests
An action is proposed: place, transfer, message, change. It does not execute yet.
The control plane evaluates
Against mandate, entitlement, consent, and risk tier, in the action path, in the moment.
Tiered decision
Reversible actions clear automatically at machine speed. Consequential or irreversible actions escalate to a named human before commit.
Commit and evidence
The action proceeds, and the decision record is written as a byproduct. Governing and proving are the same act.
Governance becomes velocity
Low risk clears in a day, high risk on a set SLA. The tiering is codified, not judged in the moment. Real governance is what lets you ship autonomy at all.
Replaces
The decision gate · a governed action
- 01
Agent requests
in
- 02
Policy evaluates
mandate · entitlement · consent · tier
- 03
Tiered decision
clear · escalate · stop
- 04
Commit + evidence
record written
reversible clears at machine speed · consequential routes to a named human
04Runtime · The last line
Can this specific action be stopped in flight, and can the whole agent be stopped at once?
The control plane decides authority. Guardrails decide safety.
Authority asks: may this agent do this, given its mandate. Safety asks: is this specific content or action harmful, right now, at machine speed. Two questions, two layers, both required.
Input and output filtering
Unsafe content caught in both directions, before it reaches a model or a customer.
Egress control
PII and secret exfiltration blocked at the boundary.
Injection defense
Prompt injection, tool poisoning, and attempts to escalate authority, defended as a standing posture.
The kill switch
Stop one action, or stop everything, at once. Immediate, total, and tested.
The deployment principle
An agent that cannot be stopped is an agent that cannot be deployed. In a fiduciary context, the kill switch is not a feature. It is the precondition that gates deployment.
Replaces
The kill switch · stop one action, or everything
immediate · total · tested. every agent dot freezes at once.
See it on your own estate.
A 30 minute working session against a control, an agent, or a rule you already answer to.