Search papers, labs, and topics across Lattice.
This paper identifies the inadequacies of traditional control models for governing autonomous AI agents in enterprise settings, highlighting three critical mismatches: the ephemeral nature of agents, the unpredictable actions driven by models, and the ease of agent creation via APIs. The authors propose five runtime governance primitives鈥攄iscovery, identity, governance, attestation, and supply chain鈥攏ecessary for effective oversight of these agents, detailing the consequences of their absence and the interdependencies among them. An implementation is described where agent actions are mediated against policies, authorized through a tenant-specific vocabulary, and recorded in a verifiable ledger, with four primitives already operational in private pilots.
Runtime governance of autonomous AI agents is essential, as traditional control models fail to address their ephemeral and unpredictable nature.
Enterprise deployments of autonomous AI agents inherit a control model built for human users and long-lived services, and the fit fails in three specific ways: agent principals are ephemeral, appearing and vanishing faster than provisioning; their actions are selected by a model rather than programmed, so the set of things they may attempt is not known in advance; and the population is discovered rather than provisioned, because anyone who can call an API can create one. We argue that governing such agents is a runtime problem -- not a model-alignment problem and not a build-time problem -- and we derive five primitives from the questions that must be answered before an action takes effect and after it has: discovery, identity, governance, attestation, and supply chain. For each we state what fails if it is absent and why the others cannot structurally supply it. We describe an implementation in which an agent's action is mediated against policy before it takes effect, authorised against a per-tenant action vocabulary, and recorded in a hash-linked signed ledger a third party can verify with the vendor out of the loop. We report what the architecture costs: the enforcement point sits on the request's critical path, identity requires a sidecar per workload, and fail-closed mediation converts availability incidents into denial. We are explicit about implementation status: four primitives are built and running in private pilots, and the fifth is built as separate tooling and not yet integrated into the request path. We keep it in the set deliberately: a five-part decomposition that exactly matches what its authors happened to build is not a taxonomy but a description of a codebase.
