agent-governance

Patterns for adding safety, trust, and policy enforcement to AI agent systems. Governance patterns ensure AI agents operate within defined boundaries — controlling which tools they can call, what content they can process, how much they can do, and maintaining accountability through audit trails. Define what an agent is allowed to do as a composable, serializable policy object. Combine multiple policies (e.g., org-wide + team + agent-specific): Store policies as configuration, not code: Detect dangerous intent in prompts before they reach the agent, using pattern-based signals. Key insight : Intent classification happens before tool execution, acting as a pre-flight safety check. This is fundamentally different from output guardrails which only check after generation. Wrap individual tool functions with governance checks: Track agent reliability over time with decay-based trust scores: Multi-agent trust : In systems where agents delegate to other agents, each agent maintains trust scores for its delegates: Append-only audit log for all agent actions — critical for compliance and debugging: Match governance strictness to risk level: - Agents with tool access : Any agent that calls external tools (APIs, databases, shell commands) - Multi-agent systems : Agents delegating to other agents need trust boundaries - Production deployments : Compliance, audit, and safety requirements -...