# Governed Agent Systems ## Introduction Software is beginning to act. For most of computing history, this was not the central problem. Software stored information, transformed inputs, displayed interfaces, executed predefined procedures and returned results. Even sophisticated systems were usually understood as tools whose consequential decisions remained somewhere else. A person chose what to do; the software helped them do it. Agentic systems disturb that arrangement. They can inspect a situation, determine what appears relevant, choose among possible actions, use tools, alter state, communicate with people and systems, pursue objectives across multiple steps, recover from obstacles and continue without a human specifying every intermediate move. This is usually described as an increase in capability. It is. But capability is only half of what has changed. The other half is consequence. Once software can move from *describing what could happen* to *making something happen*, questions that were once peripheral become architectural. Who is the system acting for? What authority has actually been delegated to it? What may it decide for itself? Where does that authority end? What happens when the useful next action lies beyond that boundary? What happens if permission changes while the system is already acting? And after something has changed, how do we establish who changed it, why, under what authority and with what result? These are sometimes treated as safety features to be added after the agent works. That is backwards. They are part of what it means for the agent to work legitimately at all. A system that can perform an action has demonstrated capability. A system that can explain why it is entitled to perform that action, recognise when it is not, remain inside that distinction while conditions change, and leave evidence of what it did has demonstrated something else. It has demonstrated governance. ## What governance means here Governance is an overloaded word. It can evoke committees, policy documents, compliance programmes, approval chains and the peculiar human talent for turning one sensible rule into forty-seven pages of process. That is not what this series means by governed agency. Governance begins much earlier and much closer to the action itself. > **A governed agent is an artificial system capable of selecting and performing actions within an explicit, attributable, constrained, inspectable and revocable delegation of authority.** Every part of that definition matters. The system acts under authority that comes from somewhere. That authority belongs to a principal before it belongs to a delegate. Delegation transfers some ability to decide or act without making the delegate identical to the principal. The grant has boundaries. Those boundaries can be inspected. They can change. They can be withdrawn. Consequential actions remain attributable afterward. Governance therefore describes the relationship between **capability, authority, judgement and consequence**. It does not require every agent to operate beneath a vast institutional control plane. A local agent working for one person may need nothing more elaborate than a clear authority definition, sensible execution boundaries and reliable receipts. A system operating across money, production infrastructure, customer data or institutional commitments may require considerably stronger machinery. The machinery should scale with consequence. The underlying distinctions should not. ## The missing layer Much of contemporary agent design concentrates on making agents more capable: better models, better planning, better memory, more tools, longer-running tasks, more reliable execution, broader access and greater autonomy. These developments matter. An agent that cannot reason or act reliably is not made useful merely by governing it beautifully. But increasing capability without an equally serious model of authority produces a predictable problem: technical reach begins to stand in for legitimate reach. The agent has credentials, therefore it can access the system. It can access the system, therefore the action is available. The action is available, therefore the workflow proceeds. Nothing dramatic needs to go wrong. That is precisely the problem. Authority can disappear quietly inside a successful execution path. A credential proves that a system can call an endpoint. It does not, by itself, establish why this agent should call that endpoint now, for this purpose, on behalf of this principal, under these conditions. A writable repository does not establish a mandate to modify every branch. Access to email does not establish authority to make commitments for the account holder. The ability to query a record does not establish that the record is relevant to the task. The ability to spend money does not establish a budget. The distinction sounds obvious when stated abstractly. Systems erase it surprisingly quickly once everything is connected and working. That gap is where governed agent systems begin. ## Governance is not the opposite of autonomy Governance does not mean reducing an intelligent system to a chain of permission prompts. A system that asks a human to approve every trivial intermediate decision is not necessarily well governed. It may simply have displaced judgement onto a biological confirmation button. The objective is not maximum human intervention. It is legitimate agency. A useful agent should be able to exercise substantial judgement inside the authority it has actually been given. It should investigate, reason, choose methods, adapt to circumstances and carry work forward without requesting approval merely because another decision exists. But meaningful autonomy includes recognising where autonomy ends. A system may know exactly what should happen next and still recognise that the decision belongs to someone else. It may possess the technical ability to perform an action while correctly refusing to perform it. It may encounter conflicting evidence and preserve the conflict rather than manufacturing the certainty required to continue. It may reach the edge of its delegation and produce an escalation rather than silently expanding its own jurisdiction. It may remain capable after its authority has been revoked. None of these behaviours make the system less intelligent. They make its intelligence safer to trust with consequence. The interesting question is not whether an agent can operate without a human constantly watching it. The interesting question is whether it can exercise meaningful judgement under legitimate authority and remain aware of the difference between what it knows how to do and what it is entitled to do. ## Authority must survive the workflow This becomes harder as agents operate across time. A single action can often be governed with a simple permission check. Long-running agency cannot. Authority may change after a task begins. A delegation may expire. A budget may be exhausted. Evidence may undermine the assumptions under which an action was authorised. Another authority may intervene. A downstream step may require a commitment the original grant never covered. The tenth action in a workflow cannot be legitimate merely because the first one was. Otherwise delegation decays into momentum. Governance therefore has to remain attached to the work as the work evolves. The system must be able to establish not only that some authority once existed, but that the relevant authority still reaches the consequence it is about to create. When it does not, the architecture needs somewhere honest to go. Sometimes that means stopping. Sometimes it means narrowing the task. Sometimes it means escalating a specific unresolved decision. Sometimes it means preserving disagreement. Sometimes it means continuing under a different delegation. Sometimes it means recognising that an action once authorised is no longer authorised at all. These are not peripheral failure modes. They are normal states of consequential agency. ## Consequence must remain answerable Governance also cannot disappear after execution. If an agent changes something consequential, a later observer should be able to reconstruct the event without relying on the agent to generate a persuasive story about what probably happened. What acted? For whom? Under what authority? What evidence mattered? What action was selected? What state changed? What was the result? Did the action remain inside its mandate? What happened when something went wrong? This is why governed agency requires more than ordinary logging. Logs tell us that events occurred. Governance must preserve enough context to determine whether those events were legitimate. The difference matters because two technically identical actions may have completely different authority states. One may have been explicitly delegated. The other may have been a competent system doing something useful that it was never authorised to do. **Same operation. Same outcome. Different governance event.** A mature agent system has to preserve that difference. Not because every action belongs in a courtroom, but because authority that cannot survive inspection after the fact is barely authority at all. ## The problem this series addresses This series is an attempt to describe that missing layer. It is not one platform, one universal policy language or a proposal that every agent system should share the same architecture. The objective is smaller and more fundamental: to identify the properties that must remain true when artificial systems are entrusted with consequential action. The first five pieces follow the life of delegated authority through an agent system: 1. **Capability Is Not Permission** separates what a system *can* do from what it *may* do. 2. **The Authority Envelope** gives delegated permission an inspectable boundary. 3. **Escalation Is an Output** describes what legitimate agency does when useful action lies beyond that boundary. 4. **The Receipt** keeps consequence reconstructable after action occurs. 5. **Revocation Is a Runtime Event** treats authority as something that can change while work is already in motion. These are not five unrelated control mechanisms. They are different views of the same relationship: **principal → delegation → judgement → action → consequence** Governance determines whether that relationship remains legitimate as the system moves through it. There will be more to add. Identity matters. Provenance matters. Conflicting authority matters. Delegation between artificial participants matters. Recovery matters. Institutional memory matters. So does the question of how systems earn greater authority without quietly converting successful operation into entitlement. But none of those questions can be handled clearly until the first distinction remains intact. A machine may be able to do something. That fact matters. **It is not permission.** That is where we begin.