§ GovernanceDocument · REG-GOV-2026.06

Don’t trust the agent. Verify it.

Every agent runs on zero standing trust— bounded before it acts, watched while it acts, and provable after. You don’t trust the AI; you bound it with deterministic boundaries, then replay exactly what it did. Evals right-size each step; when something fails, recovery is proposed and human-approved — never silent.

§ 01 — The trust lifecycle

Govern it before. Watch it during. Verify it after.

01Before it runsBind it

No agent gets standing trust.

Before an agent touches real work it is bounded — which tools it can call, which data it can read, how far it can act without a human. Permissions are least-privilege and explicit, the autonomy ceiling is set by operations (the agent can’t self-promote), and the model behind each step is the cheapest one that passed its evals — not a default.

Least privilege
Scoped tokens, bounded tools, per-action capability checks
Autonomy ceiling
Always-review · graduated · restricted — enforced, not self-promoted (S.03)
Human gate
Regulated actions require human approval by construction
Right-sized model
Eval-gated selection; baseline drift can block a change
The service tokens screen — each external capability issued as a separate, scoped, revocable token with its own permissions.
Scoped service tokensEach external capability is a separate, least-privilege, revocable grant
Enterprise controls →Agents & evals →How agents are bounded →
02While it runsWatch it · stop it

Nothing runs unwatched.

A platform coordinator tracks every case, surfaces work that has stalled, and chases the outside parties a case is waiting on. Every step carries an SLA clock with escalation. When a step fails, recovery routes are scored and proposed — but a person authorizes the one that ships. Two brakes sit above it all.

Coordinator
Surfaces stalls and stuck nodes before they breach
SLA clocks
Per-step budgets, escalation policies, at-risk projection
Two brakes
Per-job circuit breaker; workspace-wide emergency brake (S.05)
Recovery
Scored routes proposed — human-approved, never silent
The operations dashboard — active jobs, stuck nodes with elapsed times, open escalations, and recent failed tasks with real error messages.
The coordinatorStuck nodes, open escalations, and recent failures — surfaced for a human
Operator surface →Resilience & recovery →
03After it runsVerify it

Don’t take our word. Replay it.

Every cognitive step writes to an append-only ledger with a propagating trace_id. Reconstruct exactly what happened — who decided, which rule version ran, what evidence was used — and re-run a past case on the forms, agents, and rules that were live when it opened. This is the half most agent stacks can’t hand you.

Append-only ledger
Every decision recorded, immutable (S.01)
Attribution
Which agent or human did what — and why
Deterministic replay
Reconstruct the case from its events
Regulatory versioning
Past work re-runs on the rules that were live (S.02)
A case record history — human and agent actions interleaved on one timeline, each attributed and timestamped.
The audit trailHuman and agent actions, interleaved and attributed, on one case record
The case record →Watch a real trace →
§ 02 — For the CISO

Zero standing trust, applied to your agents.

We’re not selling you a Zero Trust Architecture — that’s a network and identity stack. We took its one durable idea — never trust, always verify — and applied it to the newest actors in your operation: AI agents, treated as non-human identities.

Least privilege
Scoped tokens, bounded tools, and autonomy ceilings — every grant explicit and revocable
No implicit trust
Regulated actions require human approval; an agent is never trusted by default
Always verify
An append-only, replayable audit trail with per-action attribution
Identity-aware
Every agent is a non-human identity with logged, bounded permissions
§ 03 — The seven structural guarantees

Each phase rests on a platform-level mechanism.

Seven of them. Every guarantee below exists whether or not an operator remembers it — enforced by the engine, not a policy document.

S.01Immutability

Audit trail on every decision.

Append-only event ledger with a propagating trace_id on every cognitive step. Reconstruct what happened, who decided, which rule version ran, and what evidence was used.

Storage
Append-only event log
Trace model
Propagating trace_id
Replay
Deterministic from events
S.02Temporal safety

Regulatory versioning. In-flight cases don't break.

Past work remains re-runnable on the exact forms, agents, and rules that were live when it opened. Mid-flight changes do not rewrite running workloads.

Version model
SCD Type 2
Resolution
At case instantiation
Replay fidelity
Byte-identical
S.03Earned autonomy

Configurable autonomy ceilings.

Every agent operates within an operations-set ceiling. The engine enforces it, the agent cannot self-promote, and every promotion is logged.

Level 1 · Default
Always review

Every action routes to a human reviewer before execution. No agent ships without this first.

Level 2 · Earned
Graduated

Routine actions execute; flagged or low-confidence outputs halt for human sign-off. Most agents operate here.

Level 3 · Restricted
Fully autonomous

Reserved for mechanical tasks only. Scoped workflows; never PHI, never pricing, never signed outputs.

S.04Structural determinism

Deterministic, typed agent pipelines.

Agent execution is a deterministic pipeline. AI is one bounded step with typed input and output; validation, MCP calls, schema checks, and routing remain explicit.

Pipeline model
Typed DAG
LLM surface
Single step per node
Contract
Zod + JSON schema
S.05Halt semantics

Workspace-wide emergency brake.

One action pauses every agent, queue, and outbound message across a workspace. A halted workspace resumes only on explicit operator release. Below it, a per-job circuit breaker trips a single runaway case — without halting the workspace.

Scope
Workspace-wide
Enforcement
Every task, every tick
Release
Explicit operator command
S.06Operator-owned

Configurable without engineers.

Process managers adjust graphs, prompts, autonomy, and MCP scopes in conversation. Every change is versioned; engineering owns the engine, not the ops logic.

Authoring
Conversational graph
Change unit
Versioned template
Deploy
Zero — published
S.07Rehearsed

Tested before trusted.

Run any agent against a real scenario with the outside world mocked — no email sent, no record written, no external call — while its reasoning runs for real, and inspect every step of the trajectory before it goes live. Optionally gate publishing on a passing eval: a draft cannot ship unless its latest eval run passed and that run is pinned to the exact draft being published.

Run mode
Dry-run · side effects mocked
Inspection
Full step trajectory
Publish gate
Opt-in · fail-closed · pinned
§ 04 — Why it’s different

RPA can’t reason. Agent frameworks can’t account for themselves.

Legacy RPA has no judgment; raw agent frameworks have no causal audit, no runtime compliance, no autonomy ceiling, and no brake. Regisseur is the production scaffold that makes an agent both capable and accountable — the difference between a demo and something legal will sign off.

Compared with LangChain →Security & compliance controls →
§ Next step

See an agent governed end to end.

We’ll bound an agent, run a case, trip the emergency brake, and then replay the whole trace — who decided what, on which rule version, with which evidence.

Book the walkthrough →Read the security controls
Before
Least privilege · ceilings · human gate
During
Coordinator · SLA · two brakes
After
Append-only · attributed · replayable
Document
REG-GOV-2026.06