From visibility to enforcement to governance, in five phases.
You don't need to solve all 1,612 risks. You need to control the ~337 where AI systems can actually act. If you do nothing else: centralize tool access, enforce policy there, log everything.
§01phase timeline
Phase 1: Visibility
- Instrument agent actions across runtimes and orchestrators.
- Log every tool call with subject, verb, object, channel, and context.
- Stream telemetry into Splunk as a system of record.
Phase 2: Soft controls
- Detect risky patterns against the ten enforcement buckets.
- Simulate policy decisions in shadow mode.
- No blocking yet. Every decision is logged, not enforced.
Phase 3: Guardrails
- Enforce constraints at the tool gateway and data boundary.
- Block obvious bad actions: out-of-scope queries, unknown destinations, over-scoped delegation.
- Introduce escalation paths for ambiguous calls.
Phase 4: Full enforcement
- Inline veto at every enforcement surface.
- Dynamic policy decisions that read identity, intent, context, resource, and trajectory.
- Automated containment on rule trigger: revoke tokens, isolate runtime, halt chains.
- Trajectory evaluation across action sequences, not only single events.
- Induced-action evaluation when an agent routes consequence through a human.
Phase 4 includes the hardening pass. Agent security is not only permission management. It is sequence governance. A chain of allowed verbs can still produce an unsafe outcome, and an agent that routes the final action through a human is still acting. Both must be evaluated.
Phase 5: Appropriateness governance
- Feed the normative context the physics cannot read: regulatory calendar, disclosure windows, organizational state.
- Stand up the should-gate evaluators: de-automation triggers for fraught moments, propriety vetoes for the settled red lines.
- Route the fast, signatureless cases to a human co-sign instead of letting them run on autopilot.
Appropriateness governance starts only after capacity enforcement is real. You cannot gate on whether an action is right for the moment until you can already gate on whether it is safe. This is the layer co-developed with Tamed Autonomy, and the maturity beyond control.
§02before / after
§03the tool gateway is the headline
The most important control is the Tool Gateway. If you do nothing else: centralize tool access, enforce policy there, log everything. That alone covers a large share of the top risks.
Every agent action goes through a single, policy-enforced choke point: databases, APIs, shells, browsers, file systems, ticketing, payments, cloud consoles, MCP servers. One layer to instrument, one layer to govern, one layer to audit.
You don't need to solve all 1,612 risks. You need to control the ~337 risks where AI systems can actually act.