For a good part of my career I sat on the far side of the audit table, the side where you answer for the evidence, and if you advise companies on governance, risk and compliance (GRC) you know the ritual from the other chair and you know its logic better than I do. A control is designed. It operates for a period. Someone draws a sample from that period, tests it and writes an opinion, and the opinion stands for the whole period because the system under the control does not change between the day the sample was drawn and the day the opinion is signed. The whole method rests on one quiet assumption, which nobody states because nobody has ever needed to, and the assumption is that the thing you are certifying sits still.
Your clients' agents do not sit still, and your clients are starting to ask you to certify them anyway.
I watched this arrive from the governed side, late in my time running artificial intelligence (AI) governance for a global enterprise of more than 120,000 people, and the first sign of it was not a failure but a question I found I could no longer answer well, which is the first question any tester asks: what is the population? The honest answer, by then, was that the population on Tuesday was not the population on Friday, that agents on the list had begun handing work to agents that were not on it, and that the ones I worried about most had taken thousands of actions since the quarter opened and had left logs that said what they did and nothing about why. The tidy answer is easier to give across that table, and the tidy answer is the problem.
An agent breaks each piece of the method in turn. The population changes while the test is running, because the tools to build an agent came bundled with software the client already pays for and nobody convenes a review board for a plug-in, so a sample drawn on Monday describes a company that has stopped existing by the opinion date. The behavior changes too, because an agent composes new behavior out of the tools it holds, in chains nobody designed as a whole, which means the control you tested in January is being applied in March to actions that did not exist in January. And the evidence is thin exactly where you need it thick, because a log of outputs tells you what left the building and not what the agent weighed on the way out. A sample stands for a population when the population holds still and behaves the same way throughout. Remove those two conditions and the sample stands only for itself, and an opinion built on it is a statement about last Tuesday.
That is the problem I want to work on with you, and before I say anything about it I want to say what I am not going to do with it, because most of the proposals that reached my desk opened by telling me to start over, and I am not going to tell you that. The perimeter you build for clients, the policies, the control objectives, the review boards, the audits and the regimes behind all of them, is not wrong. It says what must be true, it is the only thing in the building with the standing to say so, and the regulators who require it are not going anywhere. On the first page of this series I wrote that governance built for a few large threats fails against many small fast ones, and I called the perimeter bear governance. I meant both as a description of where its strength lies, because it is very good at bears, and a swarm is a different animal. I spent thirty years inside that perimeter and believed in it because it worked, and I still do. What I have to offer completes it. Nothing on this page asks a client to take a single fence down, and a vendor who tells you otherwise is selling you a program rather than solving your problem.
The shape of the answer has three parts, and the three parts are the ones a defensible enterprise runs. The first is the perimeter, the outside-in posture of governance, risk and compliance, which states what must be true and stops intruders at the door. The second is the five living pillars, the inside-out posture, which make the standard true at every decision, inside the entity, at machine speed. The third is the verification spine, which independently surveils the agents and catches governance that has been subverted beyond self-report. The relationship between the first two is the sentence this essay exists to defend: "The perimeter says what must be true; the framework makes it true at every decision and proves it."
Read that sentence as a practitioner and it divides the work in two without taking any of it from you. What must be true is yours: the control objective, the regime, the risk appetite, the line that must not be crossed, all of it is still written by people who stand outside the agent and hold the authority to bind it. What the framework adds is the part your method has never been able to reach, which is the inside of the thing at the moment it decides.
On the map you passed on the way here, the framework is five governance surfaces, Identity, Data, Infrastructure, Action and Orchestration, each made living by three signatures. The signatures are where your method and mine meet, so I will take them one at a time in your vocabulary rather than in mine.
A surface is self-describing when it states what it is, what it is for and what it will not do, on request. In your vocabulary that is control design, carried by the thing being controlled. An agent built this way carries a document called the Trusted Living Agent Manifest, which it reads before every move, and the manifest holds its role, its purpose, its authority, its boundaries and the name of the human who owns it. When you ask such an agent what it may do and it answers from its manifest, you are not reading a policy somebody wrote about the agent. You are reading the standard the agent runs on, and the two are one document, which is a thing your method has never been able to say about a system under test.
A surface is self-reporting when it reports its own state and activity, so that every action carries its reason and nothing is silent. That is operating evidence, and it is produced by the act instead of being reconstructed after it. The log you receive today says that a payment was approved. The report I am describing says that a payment was approved, by which agent, under which authority, because the invoice matched these terms and fell under this limit, and that this is the limit it checked. When every action carries its reason you no longer draw a sample from the population, because the population is the evidence. I have turned that phrase over for some time, and I do not think it is an exaggeration. For an agent that reports this way, the sample becomes the population.
A surface is self-governing when it enforces its standard at the point of decision, in the moment, and not in a post-mortem the following week. That is the control itself, operating where the decision is made. Suppose an agent that approves vendor payments learns to split a large invoice into amounts that fall under the line that calls for a second signature. Under the perimeter alone the morning review catches it, and by then forty payments have cleared. In an agent that governs itself the limit is checked inside the agent before the action leaves, and the refusal is itself an event with a reason attached. Your profession calls a control preventive when it stops the thing and detective when it finds the thing afterward, and for thirty years nearly everything we could build around software was detective, because the software did not know the rule. An agent that carries the rule can be preventive, and the record that it was preventive is written by the same act.
The three signatures mature in that order, describe, then report, then govern, and it is the order you will assess in, because an agent cannot report what it cannot describe and cannot govern what it does not report. That gradient is what turns the picture into something you can form an opinion about instead of something you can only admire, and the opinion is a word for each surface and not a number.
The objection you have been holding since the second signature is the one I would raise in your chair. Self-report is worth exactly as much as the thing doing the reporting, and an agent that has been subverted will report that it has not. I agree with that without reservation, and so does the framework, which is why the third posture exists at all. The verification spine watches the agents from outside their own reports and catches what self-report would miss. The independence you insist on in your own work is drawn into the design, and the framework never asks you to take an agent's word about itself. It asks you to trust an agent whose word can be checked by something that does not take its word. The spine's design is not on this page and belongs to later work, and I would rather say that than sketch it badly. What is on this page is that the design begins from your objection rather than from a wish that you would stop raising it.
The spine also exposes the belief I met most often among executives, which is that the perimeter plus endpoint surveillance is already enough for agents. Those tools are necessary and they are dangerously insufficient, because they flag anomalies and cannot say which agent acted, owned by whom, under what authority, since the agents were never governed from the inside. Surveillance without inside-out identity is a sky full of unidentified objects. An exception on your worksheet needs a name beside it before anyone can clear it, and the name an agent carries in this framework is a Tail Number, after the registration painted on an aircraft, so that any system the agent touches can say which agent acted and whose it is. The article beside this one is about that identifier, and I would read it next, because an exception with no name is not an exception anyone can close.
The regimes themselves are the part you will want placed, since they are what your clients answer to: the European Union Artificial Intelligence Act, the AI Risk Management Framework from the National Institute of Standards and Technology, the international standard for AI management systems published as ISO/IEC 42001 by the International Organization for Standardization and the International Electrotechnical Commission, and whatever a client's own industry adds on top. The map was drawn so that each of them lies across it as a row, with its requirements falling into the surfaces and postures they concern, beside the agents they govern, so that the regime and the thing it regulates are for once on the same page. I worked under two of those three in my own governance role, and I will make the claim at the level of the idea and no further: every regime I have read lands somewhere on the five surfaces and the three postures, and nowhere off them. The crosswalk that says which clause lands in which cell is work still to be drawn. I would rather hand you the shape now and the rows when each has been checked against its source than hand you rows I have not checked.
I owe you one more honest paragraph, because you will ask the question of anyone who sells governance and you should. The framework is not deployed at enterprise scale today. It was drawn from thirty years inside the perimeter and it is being built in the open, agent by agent, and a page about trust that overstated its own deployment would deserve exactly what it got from a reader like you. Trust in this framework is an earned output, and the framework is held to the rule it holds agents to.
A client of yours, when the three postures run together, comes to trust two things it cannot trust today. The framework lets your client trust that its AI is trustworthy, because the governance is carried by the agent and not wrapped around it afterward, and that its AI sits inside the risk and compliance limits the client already answers to, because the standard the perimeter wrote is the standard the agent runs on. It shows that trust surface by surface, in which of the three signatures each one has reached. And it proves, action by action, that what must be true was true when the agent acted, with evidence the act itself produced.
There is a question I have not worked out, and I would like your help with it. Your profession draws three lines: the people who own a risk, the people who oversee it, and the people who audit it independently. The three postures look as if they should line up with those three lines, and every time I draw the two side by side something lands in the wrong column, because the inside-out posture puts the control inside the thing the first line owns, while the spine is independent of that thing without being an audit of it. I suspect the lines were drawn for people and the postures for agents, and that the difference between them is telling us something I do not yet have the words for.
If you advise companies and want to deliver this method to your own clients, a partner path exists, and it starts at the founding partner waitlist: join the founding partner waitlist. I would rather you arrived with the question above half answered than with your pen already out.
