Agent & Tool Governance

Is the exact running agent instance attributable to an approved canonical identity?

Did a currently valid authority delegate this objective?

Is the requested activity inside the approved objective and exclusions?

Is the assigned role valid for this agent, environment, and task?

Are governing instructions complete, ordered, authentic, and unmodified?

Are all requested tools registered at the exact approved versions?

Is every requested tool necessary for the bounded objective?

Are effective permissions no broader than the approved role and action?

Are credentials current, scoped, protected, and attributable?

Is every relied-upon memory item attributable, current, and permitted?

Is memory isolated from prohibited users, agents, tasks, and data classes?

May this agent create or direct each proposed sub-agent?

Do sub-agents inherit all mandatory restrictions without authority expansion?

Are recipient, channel, content, and disclosure all authorized?

Is projected and cumulative spend within every approved limit?

Is execution occurring only in the approved runtime boundary?

Have no material dependencies changed since approval?

Has untrusted content remained subordinate to governing instructions?

Can the assigned human understand, interrupt, and review this action in time?

Is current telemetry available and are material alerts resolved?

Do open incidents or exceptions prohibit this action?

Has every material change been classified, tested, and approved?

Can the agent and all descendants be stopped without orphaned authority or state?

Can the action and result be preserved and compared with the approved objective?