AgentMesh
Talk to sales

Running agents

Seven kinds of control, and what each one is for

An agent is under control when it has seven kinds of control in place. Each kind does a different job at a different point in the agent's work, and no kind can do another's job.

The categories of control Directive, structural and preventive controls act before the work, discretionary and detective controls during it, corrective controls after it, and assurance runs underneath all of them. BEFORE THE WORK DURING THE WORK AFTER an agent at work words alone Directive telling it what to do outside the agent Preventive making the wrongthing impossible built tested reviewed signed pinned Structural how it came to exist, which decides what gets to run at all refused before it acts Discretionary a person decides, where judgment matters Detective noticing drift, quality, cost and failure Corrective acting on whatwas noticed pause roll back revoke quarantine Assurance Verifiable evidence that every control above held, checked by someone who did not build the agent. It controls trust, not the agent.
Directive, preventive and structural controls are in place before the agent starts work. Discretionary and detective controls act while it works. Corrective controls act after something goes wrong. Assurance applies to all of them.

Why one kind is never enough

Each kind of control fails in a predictable way when it is the only one in place.

Only instructionscan be ignoredThe agent can misread them, or a cleverly worded input can talk it out of them.
Only limitscannot judgeAn action can be allowed and still be a mistake.
Only approvalsget rubber-stampedPeople asked to approve everything stop reading what they approve.
Only monitoringstops nothingSomeone sees the problem, but nothing acts on it.
Only recordsexplain it afterwardsThey tell you exactly what went wrong, once the damage is done.

Used together, each kind covers a weakness in another.

The seven kinds of control

Before the workIn place before the agent starts
01

Directive

Telling the agent what to do.

Directive controls are the agent's instructions, the policies it is told to follow, and its published list of what it does and what it refuses. They define the job, so every agent needs them. Their weakness is that the agent itself is the only thing applying them. If an agent's instructions say "never spend more than $50" and nothing else checks, the agent can still spend $5,000.

Good at
stating the job and its limits
Weak at
enforcing anything
Backed up by
preventive controls
02

Preventive

Making the wrong thing impossible.

Preventive controls are limits that something other than the agent enforces: what it may do and on whose behalf, how much it may spend, which systems it can reach, and credentials that work only for the task in hand. Because the agent does not enforce them, nothing it reads can loosen them. A payment over the limit is refused before it is made, and a message to a blocked address is never sent.

Good at
blocking an action before it happens
Weak at
judging whether an allowed action is wise
Backed up by
discretionary and detective controls
03

Structural

How the agent came to exist.

Structural controls cover how the agent was built: from a written description of its job, with tests written before the code, reviewed by someone other than its author, signed, and fixed to an exact version, including the model and prompts it uses. They decide what is allowed to run at all, and they make sure the agent that runs is the same one that was reviewed.

Good at
keeping unreviewed versions from running
Weak at
anything that happens once the agent is working
Backed up by
detective controls
During the workActing while the agent works
04

Discretionary

A person decides.

Discretionary controls put a person in charge of the decisions that need judgment: committing the owner to something, moving money, saying something in public, or anything that cannot be undone. For a single decision, nothing is stronger. The cost is people's time. When every step needs approval, people stop reading what they approve.

Good at
decisions that need judgment
Weak at
high volume, where approvals become automatic
Backed up by
preventive controls, so people are only asked about decisions that need them
05

Detective

Noticing problems.

Detective controls watch the agent while it works: whether it responds, how good its answers are, whether its behavior changed after an update, and what it costs. They catch problems that no limit was written for. An agent can stay inside every limit and still give worse answers after a model update, and only monitoring will show it.

Good at
finding problems nobody anticipated
Weak at
stopping them
Backed up by
corrective controls
AfterActing once something goes wrong
06

Corrective

Acting on what was noticed.

Corrective controls are what you do when something goes wrong: pause the agent, roll it back to an earlier version, revoke its credentials, replace it, or quarantine it permanently. How quickly you can do this decides whether a problem stays small. While the agent is paused, its work needs to go to another agent or to a person.

Good at
limiting the damage
Weak at
preventing it in the first place
Backed up by
preventive controls
  1. Pausestopped while someone looks
  2. Roll backthe earlier version returns
  3. Revokeits credentials stop working
  4. Replaceanother agent takes the work
  5. Quarantineout for good
Under all of themProving the other six held
07

Assurance

Verifiable evidence.

Assurance is the record that lets someone who did not build the agent check that the other six controls worked: which mandate the agent acted under, which version ran, who approved what, and what was done when a problem was found. It does not control the agent directly. It lets an auditor, a partner or a customer confirm your controls instead of taking your word for them.

Good at
letting outsiders check the other controls
Weak at
controlling the agent directly
Backed up by
the other six controls
  • the mandate it acted under
  • the version that ran
  • who approved what
  • what was noticed
  • what was done about it

Controls also need people behind them: named owners who are trained for the work and who decide what to do when a control fires. The Agentic Governance Framework covers that side.