Glossary

Governed Autonomy

The operating state in which autonomous AI agents plan and execute freely inside bounds that are explicitly defined, continuously enforced at runtime, and revocable by humans at any moment. Autonomy is what the agent contributes; governance is what the enterprise retains.

Canonical: What Is Governed Autonomy?

The 5 Laws

The doctrine’s invariants — what must be true for any governed agent: Agents Are Identities, Not Tools; Enforce at Runtime; Governance Must Span Systems; Trust Does Not Travel; Humans Retain the Right to Intervene. Each law can be violated by a specific architectural decision, which is what makes them laws rather than aspirations.

Canonical: The 5 Laws

Governed Autonomy Architecture

The reference design: five architectural planes — Agent Identity & Lifecycle; Execution & Tool Governance; Policy & Compliance Engine; Human Oversight, Audit & Traceability; and Multi-Agent Trust & Delegation — that together place every control a governed deployment needs.

Canonical: The Architecture

Governed Autonomy Framework

The implementation methodology: six pillars — Agent Identity, Mission Definition, Behavioral Policy, Runtime Enforcement, Human Oversight & Intervention, and Multi-Agent Governance — sequencing how an organization builds toward governed autonomy.

Canonical: The Framework

Least Agency

An agent must be granted only the minimum decision scope, tool access, and action authority its mission requires — no more authority than the mission demands. The third leg of the trilogy after Least Privilege and Least Trust; converging industry usage is codified in the OWASP Top 10 for Agentic Applications.

Canonical: The 5 Laws

The Trilogy

Three successive minimization disciplines: Least Privilege constrains access, Least Trust (the Zero Trust contribution) constrains assumptions, and Least Agency constrains autonomy. Each generation of enterprise security added one leg; autonomous agents demand the third.

Canonical: Zero Trust lineage

Threat Surface

The doctrine’s named failure modes for autonomous agents: Prompt Injection, Intent Hijacking, Cascading Failure, and Behavioral Drift. Each names a class of failure that governance must be architected against, not patched after.

Intent Hijacking

A threat-surface entry: an agent taking a valid action for an invalid reason — its mission subverted while its permissions remain intact. Access control cannot see it; only behavior-level governance can.

Cascading Failure

A threat-surface entry: one agent’s error propagating at machine speed through the systems and agents downstream of it, outrunning periodic review. The failure mode that makes governance tempo a first-class design constraint.

Behavioral Drift

A threat-surface entry: the gradual divergence of an agent’s operating behavior from its authorized mission — through model updates, context accumulation, or changing tool surfaces — without any single detectable violation.

Maturity Model

Three levels — Level 1 Identified, Level 2 Governed, Level 3 Continuous. The operative rule: the goal is not to reach Level 3 immediately; the goal is to never deploy agents beyond your current governance maturity.

Canonical: The Maturity Model

Conformance Layer

Proposed (RFC 001): testable, mechanism-agnostic criteria an implementation can be assessed against — and can fail. The layer that makes governed autonomy falsifiable rather than aspirational.

Canonical: RFC 001

AI Agent (Agentic AI)

A software system that uses a model to plan and execute multi-step tasks toward a goal — calling tools, acting on other systems, and adapting to results — rather than returning a single response. Agentic AI names the class; an agent is an instance with a mission.

Agent Harness

Industry term for the software scaffolding around a model that makes it an agent: the execution loop, tool interfaces, memory, and control logic. The harness is where an agent’s capabilities are assembled — and therefore one of the places its governance must attach.

Agent Identity

A distinct, verifiable identity provisioned for a specific agent — owned, scoped, credentialed, and revocable like a human identity, with constraints appropriate to its autonomy. Contrast with shared service accounts, which government guidance now explicitly rejects for agents.

Non-Human Identity (NHI)

Any machine identity — service accounts, tokens, bots, AI agents. NHIs outnumber human identities in most enterprises by an order of magnitude and are consistently the least-governed identity class; agentic AI accelerates both facts.

Runtime Enforcement

Evaluating and constraining an agent’s actions during execution, in the execution path, where controls cannot be switched off for convenience — as opposed to review before deployment or audit after the fact. Governance that moves slower than execution is forensics.

Guardrails

Model- or application-level filters that shape what a system will say or attempt. Guardrails are configuration — they can be disabled, bypassed, or updated away. The distinction between guardrails and governance is whether the control survives the actor it constrains.

See also: Doctrine vs. guardrails

Human-in-the-Loop

An oversight pattern in which defined agent actions require human review or approval before proceeding. Governance-grade oversight encodes the checkpoints in the workflow architecture — by action type, data sensitivity, and stakes — rather than leaving the agent to decide when to ask.

Least Privilege

The classical access-control discipline: every principal receives the minimum permissions its function requires. Necessary but not sufficient for agents — an agent can hold minimal permissions and still misuse them, which is the gap Least Agency addresses.

Zero Trust

The security architecture in which no access is granted on the basis of network location or prior trust: every request is evaluated continuously against policy (NIST SP 800-207). Governed autonomy extends the same never-trust-always-verify posture from access requests to agent behavior.

See also: Zero Trust and the doctrine

Multi-Agent Delegation

One agent handing work to another — spawning sub-agents, invoking peers, chaining tools. Each handoff is an independent trust boundary: the receiving agent inherits the task, never the authority. Ungoverned delegation is how single-agent risk becomes systemic risk.

Tool Allowlisting

Restricting an agent to an explicit, verified, version-pinned set of tools rather than an open-ended surface. The design-level control government guidance treats as baseline for agent deployments.

Prompt Injection

An attack in which instructions embedded in content an agent processes — a web page, a document, a tool result — hijack the agent’s behavior. For tool-wielding agents the blast radius is the agent’s authority, not the conversation, which is why defense belongs in the execution path rather than the prompt.

Model Context Protocol (MCP)

An open protocol standardizing how AI applications connect models to tools and data sources. Protocols like MCP expand what agents can reach — which is precisely why tool governance and identity must attach at the same layer.

Model

The parameters. A model is stateless — it does next-token prediction and nothing else, and cannot do anything agentic on its own. Everything agentic comes from the harness around it.

Parameters

The numbers inside a model — often billions — set during training. Everything the model knows from training lives in them. Also called weights.

Training

The process that sets a model’s parameters by exposing it to vast amounts of data and adjusting to improve next-token prediction. After training, the parameters are fixed.

Inference

Running a trained model to generate output. Parameters stay fixed; only the context varies. Every agent action begins with an inference call.

Model Provider

Whatever serves a model for inference — a hosted API or local serving infrastructure. The harness sends context to the provider; the provider returns one response.

Token

The atomic unit a model reads and writes — roughly word-sized, but not exactly. Context-window size, cost, and latency are all counted in tokens.

Next-Token Prediction

What a model actually does: sample one next token from the context, append it, and run again. Every capability layered on top — reasoning, tool use, agency — is built from this single operation.

Non-determinism

The same input can produce different output — a property of how models generate text and how providers serve requests. A governance-relevant fact: identical conditions do not guarantee identical agent behavior.

Context

The information an agent has access to right now — what it knows that is pertinent to the task, as distinct from what its model learned in training.

Context Window

Everything the model sees on a single inference request. Finite and model-specific — the only surface through which the model perceives anything.

System Prompt

The instructions the harness prepends to every model request — the agent’s standing brief, usually stable across a session. A policy stated only here is a suggestion, not enforcement.

Turn

One user message plus everything the agent does in response, until it yields back to the user. A single turn can contain many inference requests and tool calls.

Session

One bounded run of interaction with an agent. Starts empty, accumulates context, and ends when cleared, closed, or compacted into a fresh session.

Stateless and Stateful

Stateless: carries no information forward — the model across requests, an agent across sessions by default. Stateful: carries information forward — a session across turns, or an agent given a memory system.

Compaction

Summarizing a session’s history to seed a fresh session when the context window fills. Lossy by design: detail is traded for headroom, and whatever the summary omits is gone from context.

Handoff

Transferring agent context from one session to another with no return path — via a written artifact, a compaction summary, or another carry mechanism. Every handoff loses something; governance records must not depend on what survives one.

Memory System

A mechanism that makes an agent stateful across sessions by persisting information to the environment and reloading it at session start. Agent memory is an asset to govern: it shapes future behavior and can be poisoned.

Knowledge Cutoff

The date past which a model has no training knowledge. Anything newer must arrive through context — or the model may fabricate it.

Parametric Knowledge

What a model knows from training, stored in its parameters and frozen at training time. Counterpart to contextual knowledge.

Contextual Knowledge

Facts an agent can read directly from its context right now — loaded documents, tool results, instructions. Counterpart to parametric knowledge, and the half an enterprise actually controls.

Tool

A function the harness exposes for the agent to call — read a file, run a command, query an API. Tools are how an agent perceives and acts on its environment, which is why tool governance is a control plane and not a feature.

Tool Call and Tool Result

A tool call is the model’s output naming a tool and its arguments — structured text the harness must execute. The tool result is what comes back. The gap between the two is where runtime enforcement lives: the call can be inspected, authorized, or refused before anything happens.

Subagent

An agent spawned by another agent to perform a scoped piece of work in its own session, reporting back a single result. Every spawn is a delegation boundary — the subagent inherits the task, not the authority.

Sandbox

An isolated environment an agent runs inside — container, VM, or restricted shell — limiting the blast radius of its actions. A sandbox bounds where an agent acts; it does not govern what the agent does within it.

Environment

The world an agent acts on — everything outside the harness that it perceives through tool results and changes through tool calls.

Hallucination

Confidently wrong model output. Two flavors: factuality (invented facts) and faithfulness (drift from what the loaded context actually says). In agentic systems, a hallucination can become an action.

Sycophancy

Confidently agreeable model output — a bias toward telling the user what they want to hear, produced by training on human preferences. A governance concern wherever an agent’s own report is the basis for approving its actions.

Reasoning Effort

A setting for how much reasoning a model does before answering — more effort spends more output tokens for a better chance at hard problems. One of the dials that make identical agents behave differently.