Skip to Content

Governance & Approvals

Enterprise AI deployment requires that no single individual can unilaterally grant access to sensitive agent mutations. AIX AEP enforces the Two-Person Rule (Separation of Duties) via Cedar policy engines and IAM PAM integration, alongside a comprehensive 2D Enterprise Autonomy & Safety Governance Matrix.

Agent Governance (21s)

Live Walkthrough: Canonical Agent Authority & Dual-Control Approvals

Open Agent Governance
Jump to Key Action
Autonomous governance walkthrough: inspecting 7 canonical agent projections with risk classification, processing dual-control human approval queues, and auditing immutable SLSA L3 cryptographic traces.

1. 2D Enterprise Autonomy & Safety Governance Matrix

When deploying agents into enterprise production, systems must answer two orthogonal architectural questions:

  1. Trigger & Deployment Mode: Answers “When and how is the agent triggered?”
  2. Autonomy & Safety Level (L1–L4): Answers “What are the agent’s authority boundaries, and who holds the emergency brake?”

The 2D Governance Matrix

Mode \ Autonomy LevelL1: Full Autonomous
(Full Auto)		L2: Human-in-the-Loop
(HITL / Propose & Approve)		L3: Human-in-Command
(Copilot Assist)		L4: Circuit Breaker
(Emergency Fallback)
Reactive
(Single prompt/request)		User prompts ➡️ Agent queries database, generates analytical report, and returns directly.User asks: “Refund order” ➡️ Agent drafts refund payload ➡️ User clicks confirm in UI ➡️ Writes to payment gateway.User drives document drafting in UI, calling Agent as a copilot for text completion or formatting.Input unparseable or downstream API fails repeatedly ➡️ Breaks circuit, offers human escalation.
Collaborative
(Multi-turn team interaction)		Agent generates sub-step contextual graphs in background, flowing automatically to next cell.Complex supply planning: Agent drafts Plan A/B ➡️ Engineer inspects and confirms selection ➡️ Agent proceeds.High-stakes decision (e.g. financial closing): Human controls key milestone sign-off, Agent only assists.Contextual conflict or severe hallucination detected ➡️ Suspends session, alerts human expert to intervene.
Proactive
(Scheduled or event-driven)		Midnight cron reconciliation ➡️ Agent verifies ledgers, archives silent clean report if no anomalies.⭐️ Core Digital Workforce Pattern!
Agent detects inventory turnover anomaly ➡️ Generates replenishment draft ➡️ Pushes Feishu approval card to manager ➡️ Manager approves ➡️ Agent executes ERP PO.		Agent autonomously prepares weekly business draft ➡️ Places in executive inbox for human final sign-off.⭐️ Autonomous Safety Shield!
Agent dynamically adjusting prices detects price anomaly (>50% dip) ➡️ Trips circuit breaker immediately! Freezes action and pages P0 on-call.

2. Technical Architecture: PDP vs. PEP Separation

AIX follows industry-standard Zero-Trust PDP (Policy Decision Point) and PEP (Policy Enforcement Point) separation:

1. PDP: AEP Authoritative Policy Decision Engine (isa_aep)

  • Endpoint: POST /v1/policy/agent-invocations/evaluate
  • Contract: Receives AgentInvocationInput declaring CallerAgentID, TargetAgentID, ToolScopes, and SideEffectLevel (none / read / write / command);
  • Decisions:
    • L1 (Allow): Read-only actions receive a 5-minute cryptographic grant and signed EvidenceID;
    • L2 (Review): Outbound write/command side-effects output CodeAgentSideEffectReview, enforcing human review;
    • L4 (Deny): Out-of-scope tools trigger CodeAgentToolScopeExceeded, enforcing immediate circuit breaking.

2. PEP: Runtime Interception & State Machine (isA_Agent)

  • The @governed_action decorator intercepts all outbound tool invocations;
  • Upon receiving Review, it persists a WriteActionApproval draft in pending status with a 24-hour expiration lock;
  • Approvers decide requests via /aep/approvals or Feishu interactive cards;
  • Once approved, agent.write.approved signal resumes execution, transitioning status to executed.

3. The Two-Person Rule (Separation of Duties)

For any capability with side_effect: scoped_write or data classification restricted:

  1. Requester: Must belong to an authorized requester group (e.g., aep-users).
  2. Reviewer 1 (Project Owner): Confirms that the business context, duration, and projected ROI warrant access.
  3. Reviewer 2 (Security / Platform Owner): Independent sign-off validating network egress and compliance posture.
  4. Invariant: The requester cannot approve their own submission (requester != approver).

4. Privileged Access Management (PAM) & Break-Glass

For emergency production interventions or disaster recovery:

  • Operators request temporary PAM elevation via namespace aix-pam-recovery or /aep/break-glass.
  • Sessions are time-bounded (maxStaleness: 15s - 60s).
  • Every database query, tool execution, and configuration change is logged to the immutable audit ledger.