A developer describes building a runtime governance layer for AI agents that fixes contract mutability via cryptographic sealing and an append-only version registry, supports contractless dynamically-spawned agents through programmatic declarations, and adds a credential gateway with CI linting as a third enforcement barrier.
Been building a runtime governance layer for AI agents for the past few months. Two problems kept surfacing that I haven't seen addressed anywhere in the ecosystem. Problem 1 - Contract mutability You write a contract that says `approval_points: [before: github.merge]`. Agent runs under that contract for a week. A developer edits the file, removes the approval point. The agent now merges without asking anyone. The audit log references a contract version that no longer exists. Nothing catches this. That's not governance. That's documentation with a governance-shaped label. What we built: cryptographic sealing. Every contract is hashed the moment it loads. If the file changes after the agent starts, ContractTamperError fires and the agent stops. Combined with a versioned append-only registry - editing a contract creates a new version, the old one is permanently queryable. You can always answer: "what contract was governing this agent at 3pm yesterday?" Problem 2 - Contractless agents A dynamically spawned subagent has no contract.yaml. A third-party agent you're wrapping has none. An agent your harness generates at runtime definitely has none. If governance requires a hand-written file for every agent, it can't govern a real multi-agent system. What we built: programmatic declarations at runtime. enforcer = ContractEnforcer.from_declaration({ "node_id": "dynamic-researcher-v1", "permissions": ["qdrant.search", "web.read"], "side_effects": [], "approval_points": [], "lifecycle": "ephemeral" }) Same enforcement. Same audit log. Same tamper detection. No file required. Anything without a file or a declaration defaults to read-only with explicit approval required on every action. **The third thing nobody solves** The gate itself is opt-in. An agent can just not call it. The fix is a gateway layer where all credentials live exclusively inside gated classes - there's no token to steal if the gateway is the only thing holding it. A CI lint check fails the build if any file outside the gateway imports the raw client. Three independent barriers for the same failure mode. Curious whether others building production multi-agent systems have hit these problems and what approaches you're using for contract versioning and governing agents that spawn dynamically.
The article argues that the primary challenge for AI agents in production is not runtime enforcement but the ongoing maintenance of governance policies as agents dynamically gain new capabilities and tools, and suggests using intelligent observation to keep policies aligned.
The paper introduces Aegis, a runtime governance system for agentic AI that mediates tool actions through trusted authorization, preventing risky side effects in evaluated sandbox scenarios.
The article discusses the gap between described and established governance in AI agents, referencing a paper by Paulo Cavallo, and highlights how companies like Microsoft, IBM, and Lyzr are developing control-plane capabilities to enforce policies at runtime.
The article discusses the need for runtime governance in AI agents to balance autonomy with compliance, introducing SAFi, an open-source framework that enforces policies in real-time and audits actions.
The article discusses the gap between documented AI governance policies and the practical enforcement of these rules within runtime AI agent workflows.