Guardrails that intercept
Rails evaluate the turn at defined seams and can monitor, redact, block, escalate or abort. A blocked call never reaches the tool.
Governance
AI agent governance
That actually holds. Instructions in a prompt are advice a model can ignore. AI agent governance means the platform intercepts the action, checks it against policy, and can refuse.
Policy belongs in the platform, not the prompt
Asking a model nicely to avoid a destructive action is not a control. It is a hope with good intentions. Real governance sits between the decision and the effect, where it can still say no.
Human approval on risk
A high-risk action pauses and waits for a person. The run resumes only on an explicit decision, and the decision is recorded with it.
Attributable identity
Every request carries an authenticated identity, so an action traces back to the person it was taken for rather than to a shared service account.
Evidence after the fact
Structured traces of calls and results, so a review answers what happened instead of reconstructing it from logs.
The questions a security review will ask
AI agent governance is easier to talk about than to evidence. These are the questions that decide whether an agent ships, and each one has a concrete answer here.
- Who is the agent acting as? An authenticated identity on every request, never an anonymous shared account.
- Whose credentials does it use? Encrypted per user, with OAuth handled and revocation available at any time.
- What is it allowed to do? Tool access is granted explicitly, and guardrails can refuse a call the model still tries to make.
- What needs a human first? Risky actions escalate and park until somebody approves them.
- Where does the data live? Your database, your VPC, if that is what your policy requires.
- What can you show an auditor? A structured record of the calls made and the results returned.
Governance you can change without a redeploy
Policy is configuration, not a fork of the codebase. Rails ship switched off, so an agent with no policy behaves exactly as one written before the feature existed, and turning a rail on is a config change rather than a rewrite.
Start permissive
Run in monitor mode first and watch what the agent tries. Real traffic tells you which rails you actually need.
Tighten where it matters
Escalate the handful of actions with real consequences, and leave the rest alone. Gating everything trains people to click approve.
Keep the evidence
Every decision, refusal and approval lands in the record, which is what turns AI agent governance into something you can demonstrate.
Governance and capability pull against each other, and pretending otherwise helps nobody. The useful question is not how to restrain an agent completely, but which actions deserve a human and which do not. Read the enterprise controls for how this is deployed.
What AI agent governance changes in the spec
AI agent governance is configuration next to the model and the tools, in kodeus.yaml or in the Console. You name the seams where a rail runs. You choose whether it monitors, redacts, blocks, escalates or aborts. A new rule is not a fork of the agent and not a longer system prompt. An agent with no policy behaves as it did before the feature existed, which is how you adopt this without a flag day.
Start permissive. Monitor mode shows you what the agent tries on real traffic, including the calls you did not expect. Then tighten the few actions that move money, delete records, or send something outside. Leave the rest alone. A policy that stops everything teaches reviewers to approve without reading, which is the opposite of AI agent governance.
Identity and credentials are part of the same control, not a neighbouring product. The request carries an authenticated identity. The tool call uses that user's secret, encrypted with AES-256-GCM, revocable when they leave or when a key leaks. A shared service account makes the approval theatre, because the record cannot say who it was for. The enterprise AI agent platform page is where those controls are listed with the evidence you can ask to see.
After the decision, the trace has to show it. A refusal that vanishes is indistinguishable from a success you forgot to log. That record is AI agent observability. Together they are what a security review is actually asking for: a limit that held, and proof that it held. Both sit on AI agent infrastructure, self-hosted in your VPC or airgapped if that is the boundary you need.
Bring your security team
The questions above are the ones they will ask. We are happy to answer them together.
Frequently asked questions
What is AI agent governance?
It is the set of controls that decide what an autonomous agent may do, enforce those limits at the moment of action, and leave evidence afterwards. It covers identity, credential scope, tool permissions, human approval on risky actions and traceability.
Why are prompt instructions not enough?
A prompt is advice the model can ignore, and a model under pressure sometimes does. Governance has to sit in the platform, between the decision and the effect, so a refused action genuinely cannot reach the tool.
Does governance slow the agent down?
Most rails are checks on a call that was going to be made anyway. The visible cost is human approval, which applies only to the actions you choose to gate.
Can I watch before I block?
Yes. Run in monitor mode and see what the agent tries. Real traffic tells you which rails you need. Turning a rail on is a config change, not a rewrite.
What needs a person?
The actions with consequences you are not willing to reverse quietly: money movement, deletion, external sends, anything your policy names. Gating everything trains people to click approve without reading.
Where does AI agent governance live relative to the spec?
In the same kodeus.yaml as the model and the tools, or in the Console. Policy is declared. It is not a paragraph hidden in a skill prompt.
What can I show an auditor?
A structured record of calls, results, refusals and approvals, tied to an identity. Enterprise engagements can also walk through the policy catalogue and a sample trace.
Is this the same as AI agent observability?
No. Governance is the decision to allow or refuse. Observability is the record of that decision and of everything around it. You want both, and they are separate pages because they answer different questions.