AI governance
The risk comes from the model. It leaks, it gets taken over by something it read, it steps out of the role you deployed it in. Governance starts with knowing what you are running, which is where most programs stall.
A guard has to be its own component
The check that stops an agent can be almost anything, and which one you want depends on the decision. A payment threshold, a sanctions screen, a limit you have to defend to a regulator: those want a strict rule, deterministic and reproducible. Whether a support reply broke your tone policy, whether a post belongs on your platform, whether an assistant stayed in the role you gave it: those want a model reading your rulebook, because no threshold can describe them.
We run both, and everything in between: a rule, a small trained classifier, a zero-shot check on a criterion you typed this morning, a judge model reading your whole policy document. Hosted, or running on your own hardware. Most deployments use several, and the cheap ones decide what reaches the expensive ones.
What makes any of them a control is not what it is made of. It is where it sits. A guard is a control when four things are true: it is declared outside the thing it guards, it is versioned, it can be tested before it ships, and what it decided is recorded. The same judgment written into the agent's own system prompt is a hope, because the agent you are asking to obey the rule is the one that was talked out of it.
You cannot govern what nobody has written down
Ask an organization to list every AI system it runs and you get a spreadsheet somebody updated in March. Ask which of them can move money, read customer records, or send email, and you get silence.
Here the register writes itself: an agent is added to it by its first call, so it cannot quietly go out of date. What is on the record for each agent.
A control with no record is only a claim
An auditor does not take "we block prompt injection" for an answer. They ask for the decision record: the rule that fired, the frozen version that was live, and the request you can point at.
Where each question is answered
| What am I running? | Registries and documentation |
| Who may call what? | Authentication and authorization |
| What arrived from outside? | Injection detection |
| What must not leave? | Data redaction · code fingerprinting |
| Did it stay in role? | Role and judge checks |
| What is it costing me? | Spend and loop limits |
| What did it actually do? | Audit and evidence |
Who decides your risk tier
We hold the register and produce the evidence. We do not decide your system's risk tier under the law: that is a determination about your use of it, made by you with counsel. See our read of the EU AI Act for which obligations this layer touches and which it does not.
Where it applies
Everywhere, which is why it is a discipline rather than an industry: financial services, digital assets, insurance, healthcare, legal, platforms carrying user content.