What is Runtime Governance?
Governance & ControlPolicy enforcement applied outside the model's reasoning loop, at declared checkpoints in the agent loop. The model proposes an action; a separate runtime evaluates it against active policy and returns allow, deny, or escalate. The agent has no say in the decision.
Why It Matters
The default safety mechanism for agents is a prompt instruction: “do not modify production data.” Instructions shape probabilities. They do not prevent actions. In the Aegis evaluation, prompt-conditioned agents recorded 79 policy violations across 6,300 actions. The same policy enforced at runtime recorded zero violations across 2,100. You cannot enforce a boundary by asking the thing you are constraining to respect it.
Regulators noticed before most engineering teams did. EU AI Act Article 14 requires oversight capability to be designed into the system, not instructed on top of it. A prompt instruction is not a technical substrate. A runtime policy engine is.
The Four Enforcement Points
Pre-action gate. Evaluates the proposed action against policy before the tool runs: allow, deny, or escalate.
Action-time monitor. Watches for scope creep and side effects while the tool executes, and can interrupt mid-run.
Post-action auditor. Compares what happened with what was proposed, using the independent execution trace rather than the agent’s self-report.
Escalation router. Sends ambiguous cases to a human with a structured decision package: the proposal, the policy that flagged it, the context around the action, and what the reviewer needs to decide.
The architecture has one invariant. Controls must live outside the agent’s reasoning, because anything the agent can reason about, it can reason around.
Where It Breaks
The first failure is placement. A gate the model can see is a gate the model can plan past, so governance written into prompts or tool descriptions is decoration. The second failure is the human side. Route every action to a reviewer and the reviewer becomes a rubber stamp: under approval fatigue, humans catch about 5% of seeded violations. A governance layer that escalates volume instead of judgment is a queue, not a control.
How Flytebit Handles It
Every agentic system we ship carries runtime governance at the tool boundary, and escalation is sized so humans see judgment calls, not throughput. The full architecture, including the four enforcement points and the approval-fatigue math, is in Governing Agentic AI. As an engagement it is our AI governance and risk work.