Glossary of governed-agent terms
The vocabulary used across the field notes and project pages. Definitions are mine, written for CTOs, product leaders and public-sector architects, and they describe how the terms are used on this site rather than any standard.
- Admission
- The governor’s decision to let a run start, taken before any model or tool is called. Admission pins the exact policy version, model route and evidence obligations the run will carry.
- See also: Run, Governor
- Agent as principal
- The rule that an agent has its own identity, registered and scoped like a human or workload identity, and that its effective rights are the overlap of its own role and the sponsoring human’s rights. It can never exceed that person.
- See also: Delegation
- Approval binding
- A human approval that is attached to a specific plan revision, evidence state and freshness window, so the run can resume only what was approved. If anything changed, the approval is stale and the run asks again.
- See also: Run, Human oversight
- Assurance class
- A label for where inference runs and what that allows you to claim. Sovereign: inference, data, keys and evidence stay inside the boundary you control. Frontier-connected: a local governor sends minimised data to one qualified remote route. The second never implies the first.
- See also: Model route
- Capability pack
- A signed, versioned bundle that carries domain logic, such as handling reports about public space, into a platform whose core stays domain-neutral. The only way business rules enter the core.
- Delegation
- The explicit, scoped grant by which a person or workload allows an agent to act on their behalf, for a purpose, within limits, for a period. Without delegation an agent may propose but not act.
- See also: Agent as principal
- Evidence grade
- The maturity label on every piece of work on this site: concept, prototype, pilot, deployed or measured. It says what kind of proof exists, not how good the idea is.
- Evidence record
- The authoritative, tamper-evident record of what a run did: which policy applied, what the model proposed, which tool executed, who approved, what came back. Written by the governor, hash-chained, never edited. Provider logs are not evidence.
- See also: Governor, Run
- Exit test
- The question that decides whether a component belongs to the governance spine: if I remove it, do I lose agent definitions, policies, evidence or run records? If yes, it must meet spine rules. If no, it is sourced and replaceable.
- See also: Governance spine, Trust root
- Fail closed
- The behaviour of a control when it cannot evaluate: deny. A policy that cannot be checked does not pass, a route that is not qualified does not serve, an unavailable sovereign route does not fall back to a remote one.
- Governance spine
- The small set of components a platform must own: governed execution and policy; identity, delegation and registry; verification, evaluation and evidence; sovereignty, deployment and compliance. Everything else is sourced through contracts.
- See also: Trust root, Exit test
- Governor
- The component that holds the governance spine. It admits runs, evaluates policy outside the prompt, binds approvals, mediates tools, decides egress and writes evidence. It does not run agents or host models.
- See also: Governance spine
- Human oversight
- Oversight that is effective rather than decorative: a named person approves high-stakes actions before they happen, supervises the rest on the loop, can take as long as they need, and the override rate is published as the measure of whether it is real. My design reading of Article 14 of the EU AI Act (Regulation (EU) 2024/1689), not a legal ruling; each deploying organisation’s data-protection officer decides for their own case.
- See also: Approval binding
- Model output as proposal
- The rule that a function or tool call produced by a model is a proposal, not an instruction. A deterministic local component authorises and executes the effect, or does not. The model cannot talk its way past a policy it never gets to evaluate.
- Model route
- An immutable record that pins one provider and its legal entity, endpoint, region, model snapshot, API version, retention posture, assurance class, allowed data classes, use case, egress policy, qualification and expiry. A route is a contract, not a setting.
- See also: Assurance class, Qualification
- Policy outside the prompt
- Rules enforced by a component that does not run agent code and cannot be reached by the model. A rule inside the runtime or the prompt is a convention; a rule outside is a control.
- Qualification
- The recorded decision that a model route, tool, runtime or capability pack may be used for a named purpose, with an evaluation result, an approver and an expiry. A material change to any dependency suspends it.
- See also: Model route
- Run
- The unit of governance. Every agent action executes as a durable, inspectable run that survives failures, can pause for a person for as long as needed, can be cancelled as a fact, and leaves an ordered evidence record. Not the conversation, not the agent.
- See also: Admission, Evidence record
- Trust root
- The component that gets to say, with authority, that an agent action was allowed. Everything else is checked against it; it is checked against nothing. It must be owned, small and reachable only through published contracts. Never a model provider, runtime or cloud.
- See also: Governance spine