From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI
Organizations: Independent Researcher
Abstract
Agentic AI systems plan, use tools, maintain state, and produce multi-step trajectories with external effects. Those properties create a governance problem that differs materially from single-turn generative AI: important risks emerge dur- ing execution, not only at model development or deployment time. Governance standards such as ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005, ISO/IEC 5338, ISO/IEC 38507, and the NIST AI Risk Management Framework are therefore highly relevant to agentic AI, but they do not by themselves yield implementable runtime guardrails. This paper proposes a layered translation method that connects standards-derived governance objectives to four control layers: governance objectives, design- time constraints, runtime mediation, and assurance feedback. It distinguishes governance objectives, technical controls, runtime guardrails, and assurance evidence; introduces a control tuple and runtime-enforceability rubric for layer assignment; and demonstrates the method in a procurement-agent case study. The central claim is modest: standards should guide control placement across architecture, runtime policy, human escalation, and audit, while runtime guardrails are reserved for controls that are observable, determinate, and time-sensitive enough to justify execution-time intervention.
Figures & tables
| Criterion | High runtime-enforceability | Low runtime-enforceability |
|---|---|---|
| Timing of harm | Harm must be prevented before execution | Harm is mainly evaluable after the fact |
| Pre-action observability | Required state and context are machine-observable | Critical context is absent or only discoverable later |
| Rule determinacy | Policy can be written as a crisp operational rule | Policy requires open-ended interpretation or balancing |
| Judgment load | Limited social or ethical judgment required | Human or contextual judgment is central |
| Reversibility | Mistakes are hard to undo; intervention is urgent | Action can be audited or corrected later |
| Evidence clarity | Control outcomes can be logged and attributed cleanly | Evidence is ambiguous or weakly attributable |
| Requirement | Runtime enforceability | Primary implementation layer(s) | Example evidence artifact |
|---|---|---|---|
| Only approved vendors may receive purchase orders | High | Design-time vendor-directory scoping + runtime vendor-ID allowlist check before PO creation | Signed action trace showing vendor lookup, policy decision, and PO event |
| Purchases above EUR 5,000 require human approval | High | Runtime approval gate with delegated identity and threshold check | Approval token, requester identity, timestamp, and immutable approval log |
| The agent may access only systems necessary for procurement tasks | High to medium | Design-time least-privilege credential scoping + runtime authorization for specific tools and actions | Issued scopes, access logs, denied-action logs |
| Supplier ranking should remain fair, explainable, and contestable | Low | Design-time ranking design + assurance audit + human review for exceptions | Periodic audit report, explanation template, exception register |
| All state-changing actions must be attributable and replayable | Medium to high | Runtime telemetry + assurance retention and replay pipeline | End-to-end trace with actor, tool calls, arguments, results, and policy outcomes |
AI Agent Governance
AI agent governance studies how to authorize, constrain, monitor, and hold autonomous and multi-agent systems accountable.
See all 430 papers