Runtime Governance
Govern AI at the point of action
Explore how controls, accountable authority, and evidence work together when AI systems make consequential decisions.
For risk leaders, security teams, and AI builders designing boundaries that can hold during execution.
01 / Start with Control
Make The Control Boundary Explicit
Agent Control Standard
An approach to exposing middleware hooks and enforcing portable safety policies across agent frameworks.
Piscys Lens
Control coverage depends on where actions pass through enforcement. Identify the paths that remain outside that boundary.
Read original →02 / Design the Controls
Put Governance Into The Workflow
Start with the action, the permissions it requires, and the person accountable when a boundary is reached.
Why AgentCore Chose Cedar for Agent Authorization
How a policy layer outside the model evaluates tool access using an authorization language that can be inspected and analyzed.
Piscys Lens
The documented boundary covers gateway-routed traffic. Ask how exceptions, alternate routes, and policy changes are governed.
Read original →OWASP Top 10 for Agentic Applications
A practical starting point for understanding the security risks of agents that plan, use tools, and act across workflows.
Piscys Lens
Map each relevant risk to an owner, an enforcement point, and a tested response.
Read original →Agent Identity as an Enforceable Access-Control Boundary
Microsoft Entra Conditional Access can target autonomous agent identities, restrict resource access, and block agents via policy and risk signals.
Piscys Lens
Identity controls determine where an agent may go. Governance must also address authorized actions, exception approval, and evidence for intervention.
Read original →Practices for Governing Agentic AI Systems
A framework for keeping agent operations safe and accountable, including responsibilities across the system lifecycle.
Piscys Lens
Which actions need approval, who can interrupt execution, and what records make responsibility traceable?
Read original →Human Control Must Be Measurable, Not Merely Declared
A governance framework for military AI agents organizing preventive, detective, and corrective controls around measurable human control.
Piscys Lens
Human oversight should mean effective authority to understand, constrain, and redirect actions—not merely a human present in the workflow.
Read original →Agent Memory Changes the Boundaries of Accountability
A survey of how agent memory is created, updated, retrieved, and reused across interactions and system lifecycles.
Piscys Lens
Persistent memory expands governance beyond a single action: what informed the decision, who may alter that state, and what evidence survives revision?
Read original →Building Effective Agents
A practical discussion of workflows, autonomy, checkpoints, and stopping conditions. Some tooling has changed since publication.
Piscys Lens
Use the least autonomy the workflow needs, then make escalation and stopping conditions explicit.
Read original →03 / Test the Evidence
Measure Oversight in Practice
Look beyond the presence of a monitor. Examine coverage, intervention, evaluation integrity, and the limits of each measurement.
Provenance and Proof in the Age of Agentic AI
Why conventional AI audit logs may fall short of independently verifiable evidence — and how decision-time records, cryptographic commitments, and external verification can strengthen accountability.
Piscys Lens
When AI takes consequential action, evidence must establish what was evaluated, what was authorized, and whether the decision record has changed.
Read the Piscys perspective →Measuring AI Agent Autonomy in Practice
An empirical look at agent use and human oversight within Anthropic’s ecosystem, including important limits on what the data reveals.
Piscys Lens
Measure whether people can understand and redirect agent behavior; approval counts alone cannot establish effective oversight.
Read original →Measuring The Pace of AI Development Inside Frontier Labs
A proposed measurement approach that includes oversight coverage, review latency, and escalation rates for agents used inside a frontier lab.
Piscys Lens
Review latency and accountable containment answer different questions. Define both endpoints before using a timing metric.
Read original →Piloting Double-Blind AI Evaluations
A pilot using protected computing environments to keep proprietary model weights and external evaluation prompts confidential.
Piscys Lens
Ask what protects evaluation integrity, who can independently examine results, and which deployment risks remain untested.
Read original →Safety Cases Need Evidence That Survives Change
A structured approach to adapting safety claims, arguments, and evidence for evolving generative and agentic AI systems.
Piscys Lens
Evidence must remain traceable as models, policies, and system boundaries change—and signal when prior assurance no longer holds.
Read original →Generative AI Profile · NIST AI 600-1
A cross-sector companion to the AI Risk Management Framework for organizing generative AI risk-management activities.
Piscys Lens
Connect each relevant risk-management activity to an accountable owner and evidence from the actual workflow.
Read original →Continue Exploring
Follow The Next Question
From Insight to Action
Where Does Control Enter Your Workflow?
Bring one consequential AI workflow to an executive briefing. Examine its authority boundaries, intervention paths, and evidence requirements.
Request an Executive Briefing