Platform · Govern
Finding an agent takes a connector. Owning one takes a person.
Discovery produces a list. Governance produces accountability - a named person answerable for each AI system, a signed purpose, a tier that matches what it can actually do, approval routing that fits your real org, and instrumented oversight so human review is measured rather than assumed. This is the half that cannot be automated away, so the work is making each decision small, ranked and obvious.
What a register needs
Demonstration tenant625 agents reduced to 40 decisions — 3 individual, 10 cluster, 27 acknowledgements. Ranked by exposure closed, not alphabetically.
Governance answers one question: who is answerable for this AI system, and what was it approved to do? An inventory nobody is accountable for is a list, not a control - and until someone is named, the accountable party defaults to whoever signed off the platform it was built in.
Today’s reality
An inventory tells you what exists. It does not tell you who answers for it.
Most AI governance programmes begin with a policy document and a spreadsheet. The policy describes what should happen; the spreadsheet is accurate the day it is written and stale a week later. Neither is connected to the systems actually running.
The gap shows the first time somebody asks a plain question: who approved this agent, what is it for, and who is accountable if it acts badly. On one connected estate, 80 of 94 autonomous agents had nobody accountable. That is not a documentation problem, and more documentation will not close it.
What govern covers
Eight things, named as the modules that do the work rather than the outcomes they promise.
Purpose Register
A signed, versioned statement of what each agent is for, from a named owner, evaluated daily against what the agent actually does so drift surfaces rather than accumulates.
An unsigned purpose drifts; a signed one can be checked.Ownership resolution
A business owner and a security owner per system, proposed from platform data - creator, environment owner, connector owner - so the task is confirmation rather than authorship.
An empty field stays empty. A proposed name gets confirmed or rejected.Autonomy tiering
What an agent can do irreversibly, derived from platform signals rather than self-declared: read only, act on systems, act without confirmation.
Irreversibility is visible in configuration before anything goes wrong.Decision queue
Every finding ranked by how much exposure the decision would close, so three decisions that matter beat thirty that do not, and the first week of a programme is productive.
Approved, declined or deferred - with a reason and a date.Access requests & approvals
Multi-level approval routing for new agents, new connectors and expanded scopes, mapped to your real org rather than a generic workflow.
Declined is a legitimate outcome. Forced approvals are worse than recorded refusals.Architecture review
Findings mapped to NIST AI RMF, the OWASP Agentic Top 10 and MITRE ATLAS, so a design review produces framework-aligned evidence rather than an opinion.
Published as an honest coverage matrix, including what is not covered.Oversight instrumentation
Human-in-the-loop is the control most programmes rely on and the one nobody measures: approval volume per reviewer, override rate, time to decision, and whether review sits at the irreversible actions.
An override rate near zero means excellence or inattention. Those look identical on a dashboard.Agent Passport
One agent on one page - owner, purpose, tier, identity, reach, decisions and evidence - for an auditor, a board pack or a handover.
Exportable, versioned, and traceable to the configuration behind it.How it works
Four stages. The order matters more than the speed.
Order the estate by how much exposure each decision would close. Agents that can write, delete or send data outside the tenant come first; read-only assistants can wait without anything getting worse.
Each entry arrives with a candidate accountable person drawn from platform data, a derived autonomy tier and the finding that put it in the queue. Nothing starts from a blank form.
A human confirms, declines with a reason, or defers with a date. The decision, the reason and the decider are written to a hash-chained audit log that can be verified rather than trusted.
A signed purpose is checked daily against observed capability. An agent that gains a connector it was not approved for becomes a finding rather than a silent change.
Put a name against every agent.Read-only connection, then ownership and purpose evaluated against what each agent actually does.
Get my AI Exposure ScoreWhat the frameworks actually ask for
Accountability is not only good practice. It is the specific obligation most programmes cannot evidence when asked.
- EU AI Act. An inventory of AI systems, a risk classification for each, and records a regulator could inspect. Without an accountable person per system, the later obligations are unreachable.
- ISO/IEC 42001. An AI management system with defined roles and responsibilities - accountability written as a clause.
- NIST AI RMF. The Govern function is explicit that accountability structures come before measurement and management, not after.
- SOC 2 and ISO 27001. Access-governance requirements that apply to non-human identities in principle, and are rarely sampled against them in practice.
Know what you know — and what you do not
A governance product that produces false confidence is worse than none, because it moves risk from visible to invisible. Where a platform is not connected or a dimension cannot be measured, Govern360 reports not measured rather than assuming there is nothing there — so you can always tell the difference between measured and safe and simply not measured.
Governance is consistently the weakest dimension on first measurement, and the one most improvable by decision rather than engineering. It measures the share of systems with a named owner, with a signed purpose, with an autonomy tier derived from platform signals, and with a recorded decision. On one connected estate the register opened with 625 agents and zero signed purposes - which is the normal starting position, not an unusual one.
Where this sits in the platform
Five stages, in order. Each depends on the one before it, which is why an unconnected source weakens everything downstream rather than only its own dimension.
What this page does not claim. Governance records decisions about what configuration shows. It does not observe what an agent did at run time, and a signed purpose is checked against observed capability rather than observed behaviour. A decision in the register changes nothing about the agent by itself. Figures cited here come from a connected demonstration tenant, not a customer estate.
Questions, answered
Is a team or a mailbox an acceptable owner?
No. The test is whether somebody would actually answer if the agent caused an incident at three in the morning. A distribution list fails it, and an auditor will treat the system as unowned.
How do you assign owners to hundreds of agents without stalling?
Rank by exposure closed rather than alphabetically, propose the owner from platform data instead of leaving a blank, and allow a reasoned decline. Most programmes fail by trying to own everything at once and producing a spreadsheet nobody completes.
Who should own AI governance internally?
Inventory and observability sit naturally with the CIO. Risk appetite, tiering thresholds and named ownership belong with the business and the board. A CIO who absorbs all of it takes unbounded liability for judgements they do not make.
Does Govern360 decide what is acceptable?
No, and deliberately so. It measures state and ranks decisions; whether the result sits inside your risk appetite is your judgement. A product that asserted an appetite threshold would be inventing governance rather than reporting it.
What is a signed purpose, and why does it matter?
A statement of what an agent is for, agreed by its named owner and versioned. It matters because it is checkable - an agent whose behaviour diverges from its signed purpose produces a finding, whereas an agent with no declared purpose can never diverge from anything.
How is an autonomy tier decided?
From platform signals - what the agent can reach, whether it can write or delete, whether it can act without confirmation, whether it can send data outside the tenant. Deriving it beats asking, because self-declared tiers are optimistic and stale.
Does deciding in the register change anything about the agent?
No, and the page says so. A decision records what a person concluded. Closing the exposure happens through the enforcement planes, which is a separate step with its own evidence.
What does the audit log actually prove?
That the record has not been altered. Entries are hash-chained and the chain can be verified, so an auditor can check integrity rather than take the vendor's word for it.
Go deeper
The detail behind this page, in the form it is usually asked for.
Make every agent state what it is for: signed, versioned, from a named owner, checked daily against behaviour.
FrameworkEU AI Act readinessLive inventory, per-system risk classification and continuous evidence mapped to the Act and ISO 42001.
ChecklistAgent duplication and collisionTen checks covering replicas versus genuine copies, operation-level comparison and cluster drift.
BriefGovernance BriefWhat each AI governance development actually means for your programme, and what to do about it.
An inventory nobody owns is a list.
Connect read-only and see every agent ranked by the exposure a decision would close, each with a proposed accountable person. Thirty minutes to connect, first queue within twenty-four hours.