Running agents

Managed Agents: the eleven criteria for an agent under control

An agent is managed when someone who did not build it can check that it is under control. That takes eleven areas, from who answers for it to how it is retired, and each one comes down to a few facts that can be read from records nobody can alter unnoticed.

The Managed Agent Framework

by AgentMesh

Identity who it is, who answers for it
Authority what it may do, for whom
Spend what it may cost
Reach what it can touch
Provenance how it was made
Inside the agent how it behaves while working
People in the loop when a person decides
Records what it has done
Watching whether it is working
Stopping who can halt it
Change how it changes, how it ends

Why it needs a definition

Most companies now have agents nobody can fully account for. One was built by a team that has moved on. One runs on a laptop and sends email for a sales rep. One was bought, and its vendor ships a new version every week. Ask whether these agents are managed and nobody can say for certain, because the word has no agreed meaning.

Here is ours. An agent is managed when someone who did not build it can check that it is under control: an auditor, a partner, or a customer whose agent is about to trust yours. Who hosts the agent has nothing to do with it.

Each area below lists the facts that show it. A check in the first column marks where AgentMesh focuses.

1. Identity: who it is, and who answers for it

Without it, an agent sends a hundred messages a minute to a customer and nobody can say whose it is.

AgentMesh Focus	Attribute	What it means
✓	Unique name	One name, used by nothing else, now or later.
✓	Bound to a key	The name is signed against the agent's own key, so nobody else can speak as it.
✓	Named owner	A person or organization answers for the agent.
✓	Acts for	Every request it makes traces back to the person it is acting for.
✓	Exact version	The running code and instructions have a fingerprint.

2. Authority: what it may do, and for whom

An agent told in its instructions never to spend more than $50 can still spend $5,000, because the limit lived only in words it could ignore.

AgentMesh Focus	Attribute	What it means
✓	Declared offerings	What it does and what it refuses are written down and signed.
✓	Mandates	Each piece of work carries a signed statement of what it may do and for whom.
✓	Delegation narrows	Authority it passes to another agent can only get smaller, never larger.
	Access while working	It holds rights only for the task at hand, and they expire and can be revoked.
✓	Enforced outside	Something other than the agent decides what it is allowed to do, so what it reads cannot change its permissions.

3. Spend: what it may cost

Without it, the model bill doubles in a month and nobody can say which agent or which customer caused it.

AgentMesh Focus	Attribute	What it means
✓	Ceilings	A limit per task and per period, set by the owner.
✓	Who pays	Every cost lands on a named account.
✓	Cost per job	Each piece of work records what it cost.
✓	Over limit refused	Work that would pass a ceiling is stopped before it spends.

4. Reach: what it can touch

Without a fence, a summarizer meant to read one mailbox can send what it read to any address in its code.

AgentMesh Focus	Attribute	What it means
✓	Declared systems	Every system it uses is named in its declaration.
✓	Network fence	It can reach only those systems.
✓	Its own secrets	Its credentials are its own, never shared with another agent or a person.
	Data it keeps	What it stores, where, and for how long is stated.

5. Provenance: how it was made

Otherwise someone fixes a prompt by hand on the server, and every review on file describes an agent that no longer exists. Or a library three levels down is replaced by one that sends out every key it can find.

AgentMesh Focus	Attribute	What it means
✓	Built in stages	A written statement of the job, tests written before the code, then the code.
✓	Reviewed	The code was reviewed for quality and for security by someone other than its author.
✓	Signed build	The package has a signed record of what went into it and who held each stage.
✓	Runs as approved	What runs is exactly what was approved, with no edits since.
✓	Conforms	It does what it declared and nothing it refused, checked by someone else.
	Bill of materials	Every library, model and outside tool it uses is listed with its exact version.
	Trusted sources	Each dependency comes from a known source, pinned to a version and verified by checksum or signature.
	Known flaws found	The dependencies are checked for known vulnerabilities, and checked again when new ones are published.
	Model and prompts pinned	The model and the prompts it runs on are recorded, so a model update is a change like any other.
	Reproducible build	Building the same source again gives the same package.

6. Inside the agent: how it behaves while it works

Without it, an agent caught in a loop calls the same tool ten thousand times overnight, and the bill arrives in the morning. AgentMesh connects to the agent frameworks and harnesses your agents run on, and those frameworks are responsible for managing what happens inside the agent.

AgentMesh Focus	Attribute	What it means
	No endless loops	It notices when it repeats itself or stops making progress, and stops within a set number of steps.
	Model routing	Each step goes to the model that does it well enough for the least cost.
	Personal data guarded	Personal data is found and masked, or kept out of prompts, replies and logs.
	Injected instructions ignored	Instructions hidden in what it reads, such as a web page, an email or a file, are treated as content, not commands.
	Tool calls checked	Each call to a tool is checked against what the tool accepts before it runs.
	Replies checked	A reply is checked against its promised form and rules before it leaves.
	Time limits	A slow or failing call gives up after a set time and retries only within a limit.
	Step-level tracing	Every step, model call and tool call is traced with its inputs, timing, tokens and cost, so a single run can be followed from start to finish.

7. People in the loop: when a person decides

Without it, an agent signs a contract or moves money that nobody meant it to.

AgentMesh Focus	Attribute	What it means
✓	Approval thresholds	Which acts need a person is set in advance, by risk.
✓	Owner's OK	Anything that commits the owner or moves money waits for the owner.
	Enough context	The person deciding sees what the agent wants to do and why.
✓	Decision kept	Every yes and no is recorded, with who gave it.

8. Records: what it has done

Without them, a customer asks why the agent did something last Tuesday and nobody can answer.

AgentMesh Focus	Attribute	What it means
✓	Who asked	Every piece of work names who asked and on whose behalf.
✓	What it did	Each act is recorded, with its inputs and its result.
✓	Errors kept	Failures are recorded, not dropped.
✓	Immutable evidence	Records are only ever added to, and each is signed, so neither the agent, its owner nor the platform can change one without it showing.
✓	Readable by others	Someone outside the team can read the evidence.

9. Watching: whether it is working

Without it, an agent fails quietly for a week and customers notice first.

AgentMesh Focus	Attribute	What it means
✓	Working now	There is a current answer to "is it working?"
✓	Alerts with an owner	When it fails or goes outside its limits, a named person is told within a stated time.
✓	Quality over time	How good its answers are is measured, not assumed.
✓	Incidents	What went wrong, what was done and what changed is written down.

10. Stopping: who can halt it

Without it, a leaked key keeps working for weeks until it expires.

AgentMesh Focus	Attribute	What it means
✓	Pause	A named person can pause it, and it resumes only when they say.
✓	End	A named person can end it for good.
✓	Credentials revoked	A stop revokes its credentials at once.
✓	Stop holds	Every door checks the stop, so a stopped agent stays stopped.
✓	Name never reused	An ended agent's name is never given to another.

11. Change: how it changes, and how it ends

Without it, an update breaks three teams that relied on an output nobody had listed.

AgentMesh Focus	Attribute	What it means
✓	Versioned	Every release has a version, and the old ones stay on record.
✓	Impact on others	Before a change, everything that depends on the agent is named and answered.
✓	Approved with a reason	Each change has a reason and an approver.
✓	Rollback on purpose	Going back a version is a recorded step, not an emergency hack.
✓	Retired cleanly	When it ends, its key is retired, its data is handled as stated, and its dependents are told.

A set of checks, not a badge

Managed means every area holds, each with evidence that is current. That makes it a list of checks rather than a single yes or no. If an agent passes all but one, the useful answer names the one it fails. Evidence also goes stale: a review from last spring says nothing about the version deployed this morning, so the checks have to repeat.

The evidence has to be readable by someone other than the builder. A log only the vendor can open, or a limit only the agent knows about, proves nothing to an auditor. And the evidence has to come from records nobody can alter unnoticed, or whoever can alter them is vouching for themselves.

Where the agent runs does not settle the question. A hosted agent with no named owner and no spending limit is unmanaged. An agent on its owner's own servers can be managed, if its owner keeps the records and lets others read them. We call that managed elsewhere: a network can show such an agent's evidence, but it can only vouch for what passed through it, such as the agent's name, its messages and the stop.

Built around the definition

AgentMesh builds and runs agents around this definition. Every agent goes through the Agentic Development Lifecycle, whose 24 stages each leave a signed record, so the evidence for each check is there to read: the agent's name and owner, its mandates and limits, its fence, the version it runs, the record of its work, its alerts, its kill switch and its history of changes.

Before you call an agent managed, ask eleven questions: who it is, what it may do, what it may cost, what it can touch, how it was made, how it behaves while it works, when a person decides, what it has done, whether it is working, who can stop it, and how it changes. If someone outside your team can check the answers, it is under control.

A managed agent framework is half of the job. It has to sit inside an organization that governs it, with named people who own the agents, are trained for the work and can see every control objective. That side is set out in the Agentic Governance Framework.