AI agent governance fails at the intersection of governance and permission. What appears to be granted by way of permission to use a tool in a narrow fashion can rapidly devolve. In the end, what failed governance? A permission spreadsheet with attached vibes recorded in a spreadsheet.
Live execution path is the space where governance happens. Runtime security for autonomous agents, a space Microsoft is actively tackling in the open with the Agent Governance Toolkit, is the space of deterministic policy enforcement, identity, isolation, audit, reliability controls, etc. for a variety of agent frameworks. All of this is open-source, MIT-licensed. Governance is moving out of the prompt and into the runtime.
The action is only half the question
What has traditionally been thought of as access control, a simple yes or no as to whether a subject can take an action on a resource, becomes rapidly more complex as the same action becomes, following a series of steps, a vastly different thing. As an example, a verified billing change for a customer may cause the sending of a single email to that customer. A scraping of a long-dormant escalation queue by an AI agent could cause the sending of 4,000 such emails, potentially each with its own complexity, and be a wildly different event. Similarly, a verified alert causing a remediation script to be run is a vastly different action from an untrusted prompt injection that caused the alert in the first place.
