Every AI governance stack was drawn for something that does not act.
The six-layer stack that circulates widely is a good map of one thing: governing
a model that produces an output a person reads. Inventory it, feed it clean data,
lock the data down, test the model, put a human in front of the answer, keep the audit trail.
For that world it is close to complete.
An agent does not produce an output. It takes an action — it moves money, writes to a
system, calls a tool, hands work to another agent. It does this at machine speed, and often
while everyone is asleep. That single difference does not add a layer to the stack. It
invalidates the layer the stack marks as most important.
The published stack circles HUMAN OVERSIGHT in red as the keystone. For an autonomous
agent it is the one control that cannot be in the path. Decision review, escalation, override,
output validation — every one of them happens after the action, because a person is not
standing at the point of execution. In the agent breaches of 2026 the review did happen. It
happened after thousands of actions had already completed. Oversight that arrives after an
irreversible act is not oversight. It is a record.
Count the thirty controls on that page. Five of them sit in the path of something —
encryption, role-based access, least privilege, key management, anonymisation — and all five
sit in the path of data access. Not one of the thirty sits in the path of an
action. Everything else inventories, records, tests or reviews. That is the mistake, and
it is not a small one: a governance stack for something that acts must be able to change what
happens, not only describe it afterwards.
THE SEVEN LAYERS — ordered by the path of an action, not by project phase
A stack drawn top-to-bottom reads as a sequence of phases, with compliance last.
That is a project plan, not an architecture. These are ordered the way an action actually
travels: an agent exists, it is identified, it loads a model, it attempts to act, it is
contained or allowed, it is measured over time, and only then is any of it provable.
1
The model-era layer
AI Inventory — a register you build once
Shadow AI detection, system classification, risk tiering, ownership assignment, model
registry. A project deliverable, signed off at the end of a phase.
What an acting agent needs
CENSUS — a number that is true today
An agent is created in an afternoon by someone who is not in security. A register is
stale the day it is signed. What you need is a continuous count of what is actually
running — including everything nobody declared — because you cannot govern a population you
re-measure once a year.
CONTINUOUS
2
The model-era layer
Ownership Assignment — a name in a column
Key management appears, but it protects data. Nothing on the page gives the agent
itself a credential.
What an acting agent needs
IDENTITY & MANDATE — carried, signed, delegable
Every agent holds a cryptographic identity and a declared mandate, so who
authorised this? has an answer that does not depend on anyone's memory — and the answer
survives delegation, when one agent hands work to another. The signature must be
post-quantum: an agent credential is a long-lived exposure, and every signature in the
published stack is classical.
IN-BAND
3
The model-era layer
Model Cards & Registry — a name and a hash
Model assurance covers benchmarks, fairness testing, red-teaming and drift. It assumes the
file you registered is the file that behaves.
What an acting agent needs
PROVENANCE OF BEHAVIOUR — not only of bytes
A hash proves a file was not tampered with. It does not prove the file still refuses.
A derivative with the safety direction removed is not a corrupted copy — it is a new file,
with a valid hash and its own model card, and every byte-level seal passes. For an
open-weight model an organisation self-hosts, behaviour must be measured and attested,
not inferred from a checksum.
IN-BAND
MISSING ENTIRELY
4
The model-era layer
— nothing —
There is no box anywhere on the published page that sits between an agent and the thing it
is about to do. Not one of the thirty.
What an acting agent needs
THE ACTION GATE — deterministic, in the path, fail-closed
The decision to allow an action is made before the action, by machine, on rules that
do not vary with load or mood — and when the gate cannot reach a verdict it refuses
rather than permits. This is also where the tool surface lives: agents act through
tools, and a governance page with no view of a tool call has no view of the action.
IN-BANDFAIL-CLOSED
THE MISTAKE
5
The model-era layer
Escalation Paths & Incident Reporting
Routes to a human, opened once something has already happened. Severity decides how loudly
the alarm rings.
What an acting agent needs
CONTAINMENT — reversibility decides who acts
The question is never how severe it was. It is whether it can be undone. An
irreversible action must be stopped by the machine, because no escalation path is fast
enough to reach a person in time. A reversible one can be escalated safely. Severity is a
human ranking; reversibility is a property of the action itself.
IN-BAND
6
The model-era layer
Drift Detection — is accuracy sliding?
A data-science concern: the model's performance moving away from its training baseline.
What an acting agent needs
DEVIATION FROM DECLARED INTENT
Not is the model still accurate but is this agent still doing what it said it
would do. We cannot read an agent's true intent and we do not need to — we can measure
the distance from the mandate it declared. That is computable, it is continuous, and
it moves before harm rather than after it.
CONTINUOUS
7
The model-era layer
Compliance & Audit — the bottom layer, built last
EU AI Act mapping, GDPR alignment, policy enforcement, incident reporting, audit trails.
Drawn as the final phase of the programme.
What an acting agent needs
PROOF — an output of the six above, never a layer
If the layers above are cryptographically verifiable, the regulator's evidence is a
by-product. If they are not, no audit layer can manufacture it — a log written by
the same system that took the action proves nothing unless it is signed and independently
checkable. And the obligation is not only to report: a regulator can order a model
recall, which means being able to stop every agent running a named model and show that
you did.
DERIVED
WHAT ELSE THE SIX LAYERS DO NOT CONTAIN
Absent from the published stack
Any control that sits in the path of an action
A credential belonging to the agent, rather than to a person or a dataset
Agent-to-agent delegation — who authorised the second agent
The tool surface an agent acts through
Attestation of behaviour, as distinct from bytes
Revocation that reaches — including estates that are offline by design
Post-quantum anything; every signature implied is classical
Where the six layers are genuinely right
Shadow discovery belongs first. The undeclared agent is the real population, and
the stack is correct to open there
Data lineage still matters — an agent acting on unsourced data is a governance
problem even when the action is allowed
Least privilege and key management are real in-band controls. They are simply in
the path of data, not of action
Compliance mapping is necessary work. It is placed wrongly, not wrongly included
THE TEST WE APPLY TO EVERY LAYER
What property of the machine makes this true without anyone's cooperation?
A control that needs a person to look, to report, to review or to remember is a human security
pattern imported into a place where humans are not present. Audit, sampling, trust and alerting
are all patterns from a world where the actor was a person and the clock was slow. Nothing on
the page is wrong for that world. It is simply not the world an autonomous agent
operates in — and a stack that never asks this question will keep producing layers that describe
the breach instead of preventing it.
What we do not claim. No stack, ours included, prevents every novel attack. Seven layers
is not a certification and there is no such thing as a governed agent that cannot be wrong.
Where a control only partly covers a risk, it should be written down as partial — on our
own registers it is. The claim here is narrower and, we think, harder to argue with: a
governance model built for outputs does not become a governance model for actions by adding a
seventh box to the bottom.
CryptoShield AI BV · Amsterdam · adama@cryptoshieldai.ai SECURITY FOR AI AGENTS — NOT AI FOR SECURITY.
This page discusses a widely circulated six-layer governance diagram on its merits. No
organisation, vendor or author is named, and no client names appear anywhere on this site.