Governance & Compliance

Audit Trails & Provenance

What to capture to reconstruct any decision, hash-chained tamper-evidence, retention vs erasure, and the four-strand provenance of model, prompt, tools and data.

Policy Enforcement & Controls

Policy-as-code outside the model, enforcing pre/in/post loop, allowlist-by-default, and separation of duties so a compromised agent cannot close the loop alone.

The Regulatory Landscape

A qualitative map (not legal advice): risk-tiered regulation, documentation and human-oversight duties, the provider/deployer split, and how NIST AI RMF and ISO/IEC 42001 operationalize it.

EU AI Act, for agents

The AI Act's risk tiers explained from an agent builder's perspective — what triggers high-risk, what general-purpose AI obligations look like, and the dates that matter.

NIST AI RMF, for agents

Map / Measure / Manage / Govern read as a checklist for agent teams — what each function actually demands when the system is an autonomous agent rather than a model.

Accountability & Ownership

Accountability never transfers to the agent: the named operator role, RACI on the autonomous action, sign-off that means something, and an accountability ladder set in advance.

Data Governance for Agents

An agent is a data-flow machine: lineage through the loop, purpose/consent enforced at point of use, boundary minimization for PII, governed training data, and invisible cross-border flow.

Governance Without Gridlock

Make governance an enabler: risk-proportionate tiers, the safe default as the easy path, automated evidence with humans on judgment, and counting gridlock as a real cost.

Third-Party Model & Vendor Risk

The question with teeth is not "is your model safe" but "what can change without telling me": version stability, subprocessor notice and retention terms as the three clauses that decide whether your evals stay true — plus the gateway that gives you all of it without the vendor's cooperation.

Disclosure & Content Provenance

Disclosure is a property of an artifact as it travels, and in an agent topology the person who must be told is rarely where your code is — so put it at one egress layer with a CI test per channel, and accept that text provenance rests on a record you hold, not a watermark a paraphrase removes.

IP & Copyright for Agent Output

Whether you can stop others copying the output and whether your vendor will defend you if it infringes are the same variable read from opposite ends — how much human judgement is still in the artifact — so autonomy spends your ownership and your indemnity at once.

Retention & Legal Hold for Agent Traces

Your tracing platform's default TTL is a legal decision an engineer made to control storage cost — and the trap is not the primary store, which you can hold, but the copies: eval golden sets, fine-tuning extracts and vendor-side retention all escape both the deletion request and the hold.

Serious-Incident Reporting

Live since 2 August 2026, the AI Act's two-day track for widespread fundamental-rights infringements is an engineering deadline, not a legal one — the clock starts at the causal link, and sampled traces, rotated model versions and a deployer who is not the provider are what make it unmeetable.

Agent Inventory & Registry

Every governance regime opens with "enumerate your AI systems" and almost everyone answers with a voluntary spreadsheet, which omits exactly the agents that carry risk — derive the inventory from credential issuance, the gateway and the bill, make the grant rather than the name the unit of record, and put the register in the issuance path so it cannot drift.

Delegated Access & Consent Records

Connecting a user account creates a token every system stores and a consent almost nobody does — grantor, scope, purpose text, client ID and time — so the questions you will actually be asked are answered by the record you discarded; keep an append-only ledger, stamp its ID on every action, log exercised scope alongside granted scope, and rehearse revocation like a restore because the credential dies while the derived data, the queued job and the downstream effects do not.

Erasure Requests Against Agent Memory

The request names a person; your storage names a chunk, a vector, a summary and a graph edge, and a memory system earns its value precisely by deriving state that no longer carries the identifier — so key every derived artefact to its sources at write time, delete by rebuilding rather than by patching, and run one synthetic-subject drill to find out which of your six copies are actually reachable.