Skip to main content
Agentic Architecture Skills.
Start hereUse casesArchitectureIntelligence ladderKnowledge & memoryResearchSkills
Layers

Governance, risk and sovereignty

What the governance layer must provide for agents: one official register with a named sponsor and risk tier for every agent, records that grow with risk, a tested stop, and data that runs only where it may.

By Murali SidLinkedInPublished Updated
Download the architecture diagram (SVG)

The governance, risk and sovereignty layer (R11) is one of the fourteen layers you already own. It is where the organisation answers for what it runs. Today it holds risk tools, obligations registers, regulator reporting and safety governance. When agents arrive, the organisation must answer for them too. So this layer must provide four things for every agent. Each agent sits on one official register, with a named sponsor, a named owner and a risk tier. Each agent keeps an audit trail, and agents that could count as high-risk keep fuller records. Any agent can be stopped fast, and a serious incident is reported on time. Each agent runs only where its data may be processed.

What sits in this layer today

Every organisation in the site's industries already runs this layer for its people and its plant. The table shows what the research found in four typical estates. Vendors in brackets are examples, not a claim about any named organisation.

Standards and interfaces: ISO 31000 for risk and ISO 37301 for compliance. AS/NZS 10002:2022 covers complaints, and ISO/IEC 42001 covers AI management. Hospitals add the NSQHS Standards and Nga Paerewa NZS 8134:2021. Energy and mining add ISO 45001, the ICMM critical control guide, GISTM and IOGP 510. The full estates are on the utilities, healthcare and energy pages.

Two gaps stand out. The hospital research looked for an agent register and found none. In utilities, most duties sit in the obligations register. Few are linked to the system steps that meet them.

What agents add

Agents need the same accountability as people, recorded in one place. This layer adds a register, two levels of evidence, answers that carry their sources, and placement by data sensitivity. Board reports draw on the register and on live data from observability and FinOps (R12).

layer · architecture

The registry-centred evidence machine

The agent registry is the compliance inventory; records come at two levels, and deployment is routed by data classification for sovereignty.

  1. 01

    Control

    Agent registry

    Owner, purpose, risk tier, tools and credentials, model and prompt versions

  2. 02

    Control

    Autonomy levels

    Observe / Advise / Act-with-approval / Autonomous

  3. 03

    Evidence

    Audit trail baseline

    Per-action logs retained, named oversight, provenance-carrying grounding

  4. 04

    Evidence

    EU AI Act record keeping

    For plausibly high-risk workloads

  5. 05

    Boundary

    Kill switch

    Wired before autonomy expands

  6. 06

    System

    Classification-routed deployment

    Data class selects region and platform

An audit trail baseline for every production agent; EU AI Act record keeping for the plausibly high-risk tier.

Diagram description: Governance topology with the agent registry as hub feeding risk tiering, two evidence levels, kill switch, classification-routed deployment, and board reporting. The map contains Agent registry: Owner, purpose, risk tier, tools and credentials, model and prompt versions; Autonomy levels: Observe / Advise / Act-with-approval / Autonomous; Audit trail baseline: Per-action logs retained, named oversight, provenance-carrying grounding; EU AI Act record keeping: For plausibly high-risk workloads; Kill switch: Wired before autonomy expands; Classification-routed deployment: Data class selects region and platform. Its connections are registry to tiers; tiers to floor; tiers to art12 for plausible high-risk; registry to kill; registry to routing.

The registry as compliance inventory

Every agent has one entry on the agent register. The entry records the sponsor, the owner, the purpose and the risk tier. It also records the tools, the credentials, and the model and prompt versions. The agent lifecycle keeps the entry current, from register to retire. Its registry record lists every field.

The register is also a filing duty. It lines up with the EU AI Act's registration articles (49 and 71). The Digital Omnibus kept a simpler registration for systems self-assessed out of high-risk under Article 6(3). Australia's federal policy asks for an internal register shared every six months.

Sources agree on a small set of controls around the register. They are a named owner, autonomy labels and approval gates. They also include a log of every action, a kill switch and an incident runbook. The autonomy labels follow the autonomy contract, from manual (A0) to governed lights-out (A5).

An official agent register records each agent's named owner, purpose, risk tier, data classification, deployment location, model and version, evidence bundle and kill switch. A registered agent moves on to approve, monitor and stop. An agent that is not on the register does not run.
If an agent is not on the register, it does not runRegistration binds an agent to a named owner, a purpose, a risk tier, evidence and a tested stop. An agent that is not registered has no route into production.

Two evidence levels

Records grow with risk, in two evidence levels. The first level is the audit trail baseline. It applies to every production agent and has four parts:

  • a register entry;
  • a log of every action, kept for at least six months;
  • a named person who oversees the agent;
  • answers that carry their sources.

The six-month retention is the deployer duty in Article 26 of the EU AI Act. That article also asks for competent oversight and for workers to be told.

The second level adds EU AI Act record keeping (Article 12). It applies to agents that could count as high-risk. That includes agents that touch employment, credit or essential services. Under the draft guidelines, it also includes broad multi-purpose assistants.

No regulator or auditor has yet said that a retrieval source trail meets Article 12. So the second level adds more on purpose. It keeps logs of actions and decisions, and records of each time a person stepped in. It also protects those records from change and keeps the technical documentation the Act describes (Annex IV).

Every production agent keeps owner, purpose, sources, actions and incident records. Agents that could be high-risk add a technical file, data governance, human oversight, accuracy and robustness, and post-market monitoring. In the middle, data classification decides whether the agent runs in a public, restricted, sovereign or air-gapped estate. Higher autonomy and higher impact require stronger evidence.
Evidence grows with riskThe audit trail baseline applies to every production agent. Agents that could be high-risk also keep EU AI Act records. Data classification decides, separately, where the agent runs.

Answers that carry their sources

Retrieval stores each passage with its source, next to its embedding. An embedding is the numeric fingerprint used for search. The chain then holds by design: source, passage, embedding, retrieval, claim and citation. Nobody has to rebuild it after an incident. The parsing and indexing work behind it sits in agent data engineering (R14).

A source trail is needed for audit, but it is not enough on its own. Action logs, oversight records and technical documentation still have to be added.

Where the agent runs follows the data

Sovereignty means rules on where data may be stored and processed. Those rules keep changing in the EU, India, the US and China. So the data's classification decides where each agent runs. The options are public, restricted, sovereign or air-gapped. Infrastructure and compute (R01) builds the routing. Managed sovereign cloud offerings now cover more of these cases.

What must be true before an agent touches it

An agent may not touch a live system until these hold. The register holds the facts. The checks run outside the model, at the tool gateway and the policy decision point. Enforcement outside the model shows where.

  • Registered, with a sponsor and an owner. The register entry and the agent's own identity exist before any credential. The delegation chain then traces each action to the person who asked.
  • Scored and approved. The risk tier comes from the risk profile. It sets who signs before release.
  • An audit trail the agent cannot touch. Logs are collected outside the agent and kept for at least six months.
  • A tested stop. A kill switch can stop the agent at once. It is wired and tested before autonomy grows. The EU AI Act asks for this stop (Article 14(4)(e)). Agent platform (R07) and security and identity (R10) build it at several points.
  • A drilled incident runbook. Serious incidents are reported on the Article 73 timeline. Incidents that arise between several agents have no reporting frame yet.
  • Placement by classification. The region and estate follow the data's classification before go-live.
  • Disclosure, and the rule for decisions about people. People are told when they deal with AI (Article 50). Experience and channels (R09) designs that notice. A named person decides any significant decision about a person. The deterministic zones set out that rule and the formal records zone.

The dates that set the pace

In the EU, the Digital Omnibus moved the high-risk dates. Stand-alone high-risk systems (Annex III) now start on 2 December 2027. High-risk systems built into regulated products (Annex I) start on 2 August 2028. Two duties have applied since 2 August 2026. People must be told when they deal with AI, and synthetic content must be marked (Article 50). The Commission can also enforce the rules for general-purpose AI models. The draft classification guidelines read broadly. Rebranding or substantially changing a general-purpose tool can make you its provider (Article 25).

In Australia, the federal policy for AI in government has applied since 15 December 2025. It asks for an accountable official, a named owner per use case and a shared register. Use-case impact assessments are due by 15 December 2026. Queensland's AI governance policy has been mandatory for departments since August 2026. From 10 December 2026, privacy policies must disclose programs that make, or substantially help make, significant decisions about people. APRA expects an AI inventory and named ownership under its existing standards (30 April 2026). In Singapore, the Monetary Authority issued final AI risk guidelines on 7 October 2026. Firms have 12 months for governance, an inventory and risk ratings, and 24 months for the rest.

India, several US states and China set their own dates. The research block below lists every date in one table.

Choices and their verdicts

Each choice below is the common choice, tested against the simplest credible alternative. The full records are in the decision catalog.

  • How widely the EU AI Act's high-risk rules apply (decision record CD-14). Do not bet on a broad or a narrow reading. Keep the audit trail baseline for every agent, and EU AI Act record keeping for agents that could be high-risk.
  • Wait for the moved deadlines, or start the records now. Start now. Each standard needs more than a year of work, some duties already apply, and boards already ask.

Concerns this layer must honour

This layer owns three of the ten cross-cutting concerns and carries duties for three more.

  • Traceability and audit (owned here). Records are kept, protected from change, and shaped for EU AI Act documentation where needed.
  • Sovereignty and residency (owned here). Data classification sets the region and the estate for every agent.
  • Privacy (owned here). Memory and record retention follow privacy law. Workers are told when agents are used.
  • Impersonation and authenticity. People know when they deal with AI, and synthetic content is marked.
  • Safety and oversight. Every agent has a tested stop and a design for human oversight.
  • Resilience. Incident reporting meets the Article 73 timeline.

Evidence and limits

The EU dates and article numbers come from the Act, the Digital Omnibus and dated legal commentary. Some dates still differ between sources. Check the final texts on EUR-Lex before relying on them. Some Australian items were read through search summaries or law-firm notes. The government pages timed out.

No regulator or auditor has endorsed a retrieval source trail as meeting EU AI Act record keeping. This guide recommends it as the most useful single piece of evidence. Recent research points the same way, but it remains a recommendation.

Vendor capability claims carry [vendor]. Board and audit figures come from surveys. The sources on compliance costs are weak. So costs are given only as orders of magnitude. No enforcement action under the AI Act against an enterprise had been made public as of August 2026.

Next step

See this layer at work in collecting and checking compliance evidence. Reading the layers in order? The next one is observability and FinOps (R12).

Explore this topic

Dates by place. Status as of 15 October 2026. Check each against the primary text.

More on the EU AI Act. Article 25 turns a deployer into a provider on rebranding, substantial modification or repurposing. Rebranding a general-purpose chatbot as an internal assistant likely triggers provider status (Freshfields). The Omnibus delivered what the July 2025 "Stop the Clock" letter from about 50 chief executives asked for. The Commission had first refused. The delay came from standards slipping. The draft serious-incident guidance (September 2025) is written for single systems. The gap for incidents between agents is documented (TechPolicy.Press, January 2026).

Standards. ISO/IEC 42001, the AI management standard, has about 350 certified organisations. No official register exists. Treat that count with care. ISO/IEC 42005 covers impact assessment (May 2025). ISO/IEC 42006 sets requirements for certification bodies (July 2025). The Cloud Security Alliance has published an agentic AI profile of the NIST AI Risk Management Framework.

Board and audit surveys. 40 percent of boards assign AI oversight to a committee, up from 11 percent a year earlier (ISS, 2026). 62 percent reserve agenda time (NACD, 2026). Only 28 percent of internal-audit leaders are confident they can audit AI risks (Deloitte). Only 21 percent of organisations report a mature agentic governance model (Deloitte). Organisations that run AI trust, risk and security management are 3.4 times as likely to report effective governance (Gartner) [vendor]. Gartner expects the governance-platform market to pass $1 billion by 2030 [vendor].

Autonomy labels. Gartner names four agent autonomy levels: observe, advise, act with approval, and autonomous (26 May 2026, press release). They mix a read-or-write line with an approval line. The risk profile maps them to the autonomy levels A0 to A5.

Provenance research. Compliance-by-construction argument graphs pair grounded retrieval with a provenance ledger in the W3C PROV standard (arXiv 2604.04103, April 2026). Explicit-provenance agent designs are linked to AI Act accountability (arXiv 2605.17169, May 2026). Harness-engineering work addresses auditability (arXiv 2607.08028, July 2026). NIST AI 600-1, the US profile for generative AI, centres provenance. A Big Four firm partly refunded the Australian government over fabricated citations (October 2025).

Stop and governance products. ServiceNow AI Control Tower added real-time agent kill switches at Knowledge 2026 (May 2026) [vendor]. They cover AWS, Azure, Google Cloud and Microsoft 365. OneTrust added continuous monitoring and agent detection (March 2026) [vendor]. Credo AI, Holistic AI and watsonx.governance govern inventory, risk workflow, policy mapping and evidence storage [vendor]. Enforcement at runtime is still mostly a separate product.

Sovereignty. The EU provider share of cloud fell from roughly 29 percent to 15 percent between 2017 and 2022.

Refusals. Compliance-cost figures are held to orders of magnitude: tens of thousands for a deployer, hundreds of thousands for a provider. Sourcing is weak. The guide publishes no exact ranges.

Re-verify. The final Omnibus text. The final classification guidelines. The final Article 73 guidance. The first JTC 21 standards cited in the Official Journal. That citation starts the compliance clock. The first enforcement actions, checked quarterly. The RBI's final model risk guidance. CADA's progress. China's final agent rules.

Cite this page

Written by Murali Sid, Founder and AI Systems Architect, last updated 15 October 2026. Licensed CC BY-SA 4.0, so quote it freely with attribution.

Murali Sid (2026). Governance, risk and sovereignty. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r11-governance-risk-sovereignty

Machine-readable version of this page: /layers/r11-governance-risk-sovereignty.md

Security and identity

A model cannot tell instructions from data, so build for a tricked agent: its own short-lived identity, a policy check it cannot skip on every action that matters, and filters that warn but never decide.

Observability and FinOps

What the observability layer must provide for agents: a record of every run that the agent cannot change, a tested gate on every change, and a budget with hard caps that a named sponsor owns.

On this page

What sits in this layer todayWhat agents addThe registry as compliance inventoryTwo evidence levelsAnswers that carry their sourcesWhere the agent runs follows the dataWhat must be true before an agent touches itThe dates that set the paceChoices and their verdictsConcerns this layer must honourEvidence and limitsNext step