From Governance Theater to Runtime Enforced Trust

Part 2 of a two-part series

Introduction

In Part 1 – Enterprise Architecture for Agentic AI: Patterns, Platforms, and the Autonomous-First Shift , I established the architectural patterns and organisational shifts required for autonomous execution. From the Agentic Mesh and Event Driven Architecture to the decisive capability gap in runtime governance.

This post addresses the decisive question, How does enterprise architecture provide the governance infrastructure that makes autonomous agents trustworthy, auditable and reversible?

Enterprise Architecture has always served as the structural backbone for organisational technology decisions. Defining boundaries, enforcing standards and ensuring that systems operate within acceptable risk parameters.

With the emergence of agentic AI systems (autonomous agents that plan, invoke tools and execute multi-step action chains without continuous human direction) the governance challenge has fundamentally shifted.

Traditional governance approaches built around documentation, review boards and periodic audits cannot keep pace with systems making thousands of consequential decisions per hour. The result is what practitioners now explicitly identify as “governance theater”, false confidence in controls that have never been technically enforced.

The data paints a stark picture. Only 21% of organisations have mature governance for autonomous AI agents, while 80% of leaders piloting AI agents cite security and compliance as the leading obstacle (See part 1)

Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur. A sobering indicator that governance as an afterthought is already producing real business failures.

“Governance programs frequently stall at the handoff from policy to enforcement, lacking the technical infrastructure to enforce governance at runtime. Governance theater is actively dangerous because it creates false confidence in controls that have never been technically enforced.” Source: TechRadar/Deloitte

For enterprise architects, this represents both a crisis and an opportunity. The architectural discipline that has long governed integration patterns, data flows and system boundaries is uniquely positioned to provide the structural foundation for trust, control and accountability in agentic systems. The key insight driving this transformation: governance must become infrastructure (runtime-enforced, technically embedded and architecturally integral) rather than remaining a process layered atop systems after deployment.

The Execution Control Plane Pattern

The most significant architectural pattern emerging for agentic AI governance is the execution control plane. A centralised enforcement and observability layer that sits between agent intent and action.

Deloitte defines it as “the shared, centralised layer governing who can run which agents, with which permissions, under which policies and using which models and tools”. This pattern represents a fundamental shift from governance as review to governance as runtime service.

Structured Governance Artifacts

The execution control plane produces structured, auditable artifacts for every AI-initiated action. Implementations launched at Google Cloud Next 2026 exemplify this approach by generating four artifacts per action:

Artifact	Function	Governance Purpose
Intent Record	Documents what the agent intends to do	Captures purpose and scope before execution
Execution Plan	Specifies how it will be executed	Enables pre-execution policy evaluation
Governed Execution	The policy-evaluated, identity-bound action	Proves authorisation and compliance
Execution Evidence	Audit-grade outcome record	Provides immutable proof of what occurred

This ensures every action is policy evaluated, explicitly authorised, identity bound and recorded before execution proceeds.

Vendor-Agnostic Inevitability

Forrester validates that vendor agnostic control planes are inevitable as enterprises deploy heterogeneous agents across vendors and domains, requiring governance to sit outside both build and orchestration environments.

This architectural positioning is critical. The control plane cannot be owned by any single agent framework or cloud provider if it is to provide genuine enterprise wide governance.

Five-Component Reference Model

Architecture & Governance Magazine articulates a comprehensive fivecomponent control plane for multi-agent systems.

• Centralised Agent Registry – the system of record for all agents
• Interaction and Coordination Governance – approved interaction graphs
• Decision Governance – confidence thresholds and risk based escalation
• End-to-End Observability and Auditability – complete visibility
• Resilience Mechanisms – circuit breakers, kill switches and rollback capabilities

This model provides enterprise architects with a concrete decomposition of the governance surface area they must address.

Algorithmic Circuit Breakers: Hard-Stop Safety

Where execution control planes provide the governance framework, circuit breakers provide the hard-stop safety mechanisms that prevent agents from causing irreversible harm.

The Algorithmic Circuit Breaker (ACB) pattern represents a critical evolution in runtime safety. These are stateful, external controls that can pause or halt an agent run based on measurable signals, independent of what the model outputs next. Source: DZone

“Treat tool calls like operating system syscalls: the model proposes, the runtime enforces.” Source: DZone

Design Principles

ACBs are designed around non-negotiable requirements:

• External to the model – not relying on the agent’s own judgment about safety
• Stateful across the full run history – not just evaluating individual actions in isolation
• Deterministic and auditable – producing consistent, explainable decisions
• Fail-closed – defaulting to stopping execution when uncertain

They return one of three decisions ( ALLOW, PAUSE or HALT) that the orchestrator must obey.

Breaker Taxonomy

The ACB pattern encompasses three categories of breakers, each addressing a distinct failure mode:

Breaker Type	Purpose	Mechanism
Budget Breakers	Halt runaway behaviour regardless of intent	Maximum wall time, tool calls, and token consumption per run
Scope Breakers	Detect and prevent unauthorised resource access	Policy boundary enforcement
Drift Breakers	Identify divergence from stated objective	Behavioural alignment monitoring

Rollback Complexity

When circuit breakers trigger, the system must often reverse partially-completed work. Agent rollback is significantly more complex than database transactions because it must reverse multi-step workflows with external API calls, file changes, and state updates across services.

Research indicates that approximately 30% of autonomous agent runs hit exceptions requiring recovery. Source: Fast.io. Making rollback architecture a first class governance concern rather than an edge case.

Proportional Governance and Graduated Autonomy

One of the most consequential architectural decisions is how to calibrate governance intensity to agent autonomy. Applying uniform governance across all agents leads to two predictable failure modes: over restriction of simple agents that slows delivery or under restriction of autonomous agents that increases risk. Source: Gartner

Gartner’s proportional governance model addresses this by classifying agents across distinct autonomy levels, each representing a different trust boundary with corresponding governance requirements:

Autonomy Level	Agent Behaviour	Governance Requirement
Level 1: Observe	Monitors and reports	Scoped data access, logging
Level 2: Advise	Recommends actions	Decision-context capture
Level 3: Act with Approval	Executes with human gate	Approval workflows + rollback
Level 4: Act Autonomously	Decides and executes independently	Continuous monitoring, circuit breakers, enforced guardrails, rapid rollback

Trust Factor Scoring and Governance as a Service

The Governance as a Service (GaaS) framework introduces a Trust Factor mechanism that scores agents based on longitudinal compliance and severity aware violation history. Source: arXiv

This enables graduated enforcement (coercive, normative and adaptive interventions) that penalises untrustworthy agents without constraining compliant ones.

“By treating governance as a runtime service on par with compute, storage, or memory, GaaS establishes a foundation for infrastructure-level alignment in unregulated, interoperable agent ecosystems. It does not teach agents ethics; it enforces them.” Source: arXiv/GaaS Framework

For enterprise architects, this pattern resolves the tension between enabling agent velocity and maintaining control. Governance intensity becomes dynamic and evidence based rather than static and uniform.

Human-in-the-Loop vs Human-on-the-Loop

The distinction between these oversight models is architecturally significant . Source: JumpCloud

• Human-in-the-Loop (HITL): Synchronous control. The workflow stops at a decision gate until a human provides explicit approval. Suited for high stakes, irreversible decisions. Relies on preventative security.
• Human-on-the-Loop (HOTL): Asynchronous oversight. Agents execute continuously while humans monitor telemetry and retain intervention power. Relies on detective security with rapid remediation.

The scaling limitation of HITL is now well established. Traditional human-in-the-loop governance was built for an era of discrete, high stakes decisions but cannot scale with AI decision making volume. A single fraud model may evaluate millions of transactions per hour. Source: SiliconAngle

Enterprise architects must design systems that support both patterns, applying HITL at genuinely high stakes decision points while enabling HOTL for the vast majority of agent operations.

Decision Context Logging and Auditability

Complete visibility into agent reasoning and actions is the foundation upon which trust, debugging, and regulatory compliance all depend. Three complementary patterns have emerged to provide this visibility.

Flight Recorder Observability

This can be demomstrated through Honeycomb’s Agent Timeline that captures every LLM call, tool invocation, agent handoff and downstream service span in one conversation view. Organising telemetry around an agentic conversation containing agent executions, retries, human escalations and system calls.

The flight recorder metaphor is apt: just as aviation investigators reconstruct incidents from black box data, enterprise teams need complete reconstruction capability for agent behaviour.

Decision Traces

Decision traces capture the full chain from data event to agent action to outcome, providing the audit trail enterprises need before deploying autonomous agents at scale. Source: Streamkap

Unlike traditional application logs that record what happened, decision traces record why it happened. Preserving the reasoning context, the data that informed the decision and the policy evaluation that authorised it.

Immutable Audit Logs

The structured audit log schema captures request, response, model version, prompt template, tool calls, retrieved context, guardrail decisions, evaluator scores, user identity and timestamp for every agent decision as an immutable, append only record. Source: FutureAGI

Together, these patterns create what might be called “decision lineage”. The ability to trace any agent outcome back through its complete causal chain to the triggering event, the data consumed, the policies applied, and the authorisation granted. This lineage is not merely useful for debugging. It is the evidentiary foundation for regulatory compliance.

Regulatory Compliance as Architectural Outcome

The relationship between architectural governance and regulatory compliance is becoming increasingly direct. Well designed governance infrastructure does not merely support compliance. It produces compliance as a natural byproduct of operation.

EU AI Act Obligations

AI agents that autonomously plan, invoke tools and execute multi-step action chains fall under the EU AI Act’s risk based framework, with high risk systems required to satisfy requirements for risk management, data governance, logging, human oversight and transparency. Source: arXiv

The timeline creates urgency. Article 50 transparency obligations apply from 2 August 2026, while high-risk Annex III obligations are deferred to 2 December 2027 under the Digital Omnibus agreement. Source: Gibson Dunn

Critically, research indicates that high-risk agentic systems with untraceable behavioural drift cannot currently satisfy the AI Act’s essential requirements, making architectural traceability a regulatory prerequisite.

ISO/IEC 42001 Certification

ISO/IEC 42001:2023 is the first certifiable international standard for AI management systems, specifying requirements for policies, processes, and controls governing AI design, development, deployment and use. With Annex A controls addressing bias mitigation, transparency, accountability and data governance, Source: NSF

Execution control planes that produce structured artifacts for every AI initiated action satisfy ISO 42001 audit requirements by ensuring full traceability from intent to outcome.

The Integrated Governance Control Stack

A 2026 research paper introduces the AI Governance Control Stack integrating six layers (version governance, evidence-based verification, decision-time explainability, telemetry monitoring, drift detection and governance escalation)explicitly aligned with the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework. Source: arXiv

“The time to design for compliance is at the architecture stage, not after launch. Enterprise architects who embed policy-evaluated execution, explicit authorisation, and structured audit evidence into AI agent infrastructure create the preconditions for satisfying both EU AI Act conformity assessments and ISO 42001 certification audits.” Source: TechRadar

This principle (compliance by architectural design rather than retrospective documentation) represents the maturation of governance from overhead to enabler.

Risk Management and Operational Resilience

Connecting governance infrastructure to enterprise risk management transforms abstract architectural patterns into quantifiable risk reduction.

The operational resilience challenge is severe: only 40% of leaders are very confident they can isolate and precisely reverse an agentic AI failure, and only 28% are confident they can detect AI systems operating outside approved parameters. With 88% of organisations already using or piloting AI agents, this confidence gap represents material operational risk.

Organisations should classify agents by both risk level and potential blast radius if something goes wrong, enforce governance through policy as code at process and network layers, assign clear accountability for every agent, implement circuit breakers that halt operation on threshold violations and maintain rapid rollback mechanisms for autonomous agents. Source: TechTarget

Practical Patterns for Enabling Autonomous Execution

The ultimate goal for enterprise architects is not to constrain agents but to create the structural conditions under which agents can operate with maximum effectiveness within defined boundaries.

Governance-as-a-Service (GaaS)

A modular, policy driven enforcement layer that governs agent outputs at runtime without modifying internal model logic, treating governance as a runtime service on par with compute, storage or memory. Source: arXiv

This separation of concerns ( agents focus on capability, the governance layer focuses on policy) preserves agent effectiveness while maintaining enterprise control.

Agent Landing Zones

Microsoft’s Azure AI Agent Landing Zone treats agents as first class governable workloads, provisioned automatically, constrained by policy, and observable from day one. This addresses “agent sprawl” through infrastructure-level controls, applying the same landing zone pattern that proved effective for cloud workload governance to the new challenge of agent governance.

Dynamic Agent Registry

Microsoft’s Multi-Agent Reference Architecture features a Dynamic Agent Registry functioning as a service mesh for agents, with layered responsibilities across Orchestration, Agent, Knowledge, Storage and Integration layers.

Agents register with capability descriptors, enabling runtime resolution by orchestrators and supporting plug-and-play extensibility with governance built into registration and evaluation workflows.

Summary: Governance Patterns and Benefits

Pattern	Mechanism	Governance Benefit
Execution Control Plane	Centralised policy enforcement between intent and action	Complete auditability and authorisation for every agent action
Algorithmic Circuit Breakers	Stateful, external, fail-closed safety controls	Deterministic boundaries preventing irreversible harm
Proportional Governance	Autonomy-level classification with escalating controls	Right sized governance avoiding over/under-restriction
Trust Factor Scoring	Longitudinal compliance tracking with graduated enforcement	Dynamic trust that rewards compliant agents with greater autonomy
Agent Landing Zones	Infrastructure-level provisioning with built-in policy	Governance from day one, preventing agent sprawl
Decision Traces	Full chain capture from event to action to outcome	Regulatory evidence and debugging capability

The Enabling Paradox: Structure Creates Freedom

“Agents operating within well-designed governance infrastructure can be granted greater autonomy precisely because the organisation retains confidence in its ability to observe, intervene, and reverse.” Source: Architecture & Governance Magazine

This is the central insight for enterprise architects: governance infrastructure is not a constraint on autonomous execution. It is the precondition for it. The execution control plane, circuit breakers and decision traces do not limit agents. They create the trust conditions under which enterprises can confidently deploy agents at their highest autonomy levels.

This connects directly to themes explored in How Architecture Supports Regulatory Confidence Without Slowing Delivery. The principle that embedding assurance early in processes and treating it as a design principle enhances rather than hinders progress. In the context of autonomous AI, this principle becomes even more critical. Governance designed as infrastructure enables velocity rather than constraining it.

Similarly, the risk management dimensions connect to STORMWATCH: Evolving a Risk Tool for the Age of AI and Cloud. Risk assessment must now account for autonomous agent behaviour, blast radius classification and the 30% exception rate that makes rollback architecture a first class concern.

Conclusion

Structure Creates Value

For autonomous AI agents, governance cannot be a gate that slows deployment or a review that happens after incidents. It must be the structural foundation that makes autonomous execution trustworthy, auditable and reversible.

The architectural principles that emerge from this analysis are clear:

• Governance must be technically enforced at runtime, not merely documented in policy. An agent that cannot exceed its authority is categorically safer than one that should not.
• Controls must be proportional to autonomy level, avoiding the dual failures of over-restriction (which drives shadow AI) and under-restriction (which creates uncontained blast radius).
• Decision lineage must be complete and immutable, providing both operational debugging capability and regulatory evidence. Every autonomous action must answer: who authorised this, what informed it and how do we reverse it?
• The governance layer must be architecturally separate from the agents it governs, external, deterministic and fail closed. You do not ask the governed to govern themselves.
• Compliance is an architectural outcome, not a retrospective documentation exercise. If your architecture cannot produce compliance evidence as a byproduct of execution, you have a design failure, not a documentation gap.

The Compounding Cost of Governance Debt

Governance debt in autonomous systems compounds differently from technical debt in human paced systems. In traditional architectures, you can retrofit controls. The pace of human decision making gives you time to intervene, review and correct. In agent-paced systems, ungoverned decisions propagate at machine speed. A single uncontrolled agent can execute thousands of consequential actions in the time it takes a governance board to convene.

The cost of architectural neglect is no longer measured in audit findings. It is measured in autonomous actions you cannot explain, cannot reverse, and cannot defend to a regulator who will not accept “we didn’t anticipate that” as an answer.

The Architect’s Mandate

The enterprises that will scale autonomous AI successfully are those that recognise governance infrastructure as a capability. To be designed, built and operated as a first class architectural concern. Not overhead to be minimised. Not bureaucracy to be tolerated. Infrastructure to be invested in with the same rigour as the agents themselves.

The rate of adoption will depend on the interplay of push and pull. From above: market forces, business appetite, regulatory pressure and competitive threat compressing decision timelines. From below: practitioner demand for better tooling, clearer career pathways and demonstrable influence over outcomes. The gap between these forces is closing fast and the organisations caught in the middle without a deliberate governance architecture will find adoption happening to them rather than through them.

Structure creates freedom. And for enterprise architects, that has always been the point.

References

• A Live Operational Risk: Why AI Agents Are Outrunning Your Security – TechRadar/Deloitte
• Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure – Gartner
• Building Agent-First Governance and Security – MIT Technology Review/Deloitte
• Engineering Hard Stop Safety Into Autonomous Agent Workflows – DZone
• The Flight Recorder for Your AI Agents – Honeycomb
• Decision Traces: Building Audit Trails for Autonomous AI Agents – Streamkap
• What Is an AI Audit Log? – FutureAGI
• A Multi-Agent Framework for AI System Compliance and Policy Enforcement (GaaS) – arXiv
• AI Agents Under EU Law – arXiv
• EU AI Act Omnibus Agreement – Postponed High-Risk Deadlines and Other Key Changes – Gibson Dunn
• ISO/IEC 42001 – Artificial Intelligence Management System – NSF
• AI Governance Control Stack for Operational Stability – arXiv
• Agent Control Planes Still Need A Robust Standards Stack – Forrester
• Governing Multi-Agent AI Systems: An Enterprise Blueprint – Architecture & Governance Magazine
• AI Agent Rollback Strategy: Best Practices 2026 – Fast.io
• The AI Agent Governance Gap: How CIOs Can Gain Control – TechTarget
• Human-in-the-Loop vs. Human-on-the-Loop Architectures – JumpCloud
• Human-in-the-Loop Has Hit the Wall. It’s Time for AI to Oversee AI – SiliconAngle
• Governing Agent Sprawl: A Multi-Region AI Agent Landing Zone on Azure – Microsoft
• Multi-Agent Reference Architecture Patterns – Microsoft

STORMWATCH: Evolving a Risk Tool for the Age of AI and Cloud

How Architecture Supports Regulatory Confidence Without Slowing Delivery