Open Specification
Agentomy Agent Governance Protocol
AGP defines what enterprise AI agent governance requires: three enforceable obligations, each mapped directly to a specific EU AI Act article. They are three of the protocol's five primitives, published as an open specification any execution layer (any AI agent framework, any on-device model, any cloud agent) can implement.
Three Enforceable Obligations
Obligation 1 · Record (LOG)
Tamper-evident audit trail
Every AI agent action is logged with attribution, timestamp, and hash-chain integrity. The record survives the agent's own attempts to modify history. Retained for the system's operational lifetime plus the applicable limitation period for legal claims.
EU AI Act Article 12: Record Keeping and Logging
Obligation 2 · Enforce (AUTHORIZE)
Permission enforcement before every action
Every AI agent action is evaluated against a defined permission boundary before execution. Four boundary categories: data access, tool access, external communication, and cross-agent delegation. Every agent action is checked against authorized scope before execution begins.
EU AI Act Article 9: Risk Management System
Obligation 3 · Override (HALT)
One human decision stops everything
One authorized human decision halts all autonomous agent action immediately across every deployment surface: cloud, mobile, and edge. The halt produces a verifiable signed proof record. No graceful shutdown negotiation. Hard stop.
EU AI Act Article 14: Human Oversight
The Operator Obligation
Enterprise AI vendors satisfy their own processor obligations through their product's governance features. The EU AI Act places separate obligations on the operator, the organization deploying AI agents. AGP defines what the operator's governance infrastructure must include, independent of which vendor's AI agents are deployed.
Why it has to be an open standard
Governance that lives inside one vendor's product stops at that vendor's edge. As enterprises run AI across many models, frameworks, and clouds, per-vendor guardrails leave gaps between them, and the organization still carries the accountability for what its agents do. An open protocol is the only way one governance contract holds across the whole value chain, whoever built the agent. That is why AGP is published openly rather than kept proprietary, and independent analysis of enterprise AI is converging on the same conclusion. See governing the AI you didn't build.
Implementation
AGP is vendor-neutral. Any execution layer can implement the three obligations. The specification defines the minimum. What follows demonstrates what a complete implementation looks like.
The full open specification, JSON Schemas, and worked examples are on GitHub: github.com/getagentomy/agp. For integration guidance, use the Request Access form.
Reference Implementation: Agentomy
AGP defines the minimum. Agentomy demonstrates what a complete implementation looks like. The three obligations remain the specification floor. Everything below exceeds it.
10-Stage Governance Pipeline
Every action passes through 10 sequential stages
1. Identity: resolves agent identity via dual-module resolution.
2. Trust: validates trustworthiness across four modules (trust authority, chain validator, trust scorer, security policy).
3. Authorization: tier-based permission check with inter-agent delegation support.
4. Behavioral Check: baseline deviation detection and execution risk assessment.
5. Content Input Scan: inbound payload threat scanning (injection, integrity, content filtering).
6. Action Execution: controlled execution with evidence recording.
7. Output Scan: IP leak scrubbing, compliance claim verification, content scanning.
8. Evidence Recording: persistence to audit trail, trust ledger, and chain-of-custody ledger.
9. Drift Update: behavioral baseline recalculation with threshold-based flagging.
10. Halt Evaluation: final aggregation of all stage findings; triggers halt if any stage returned critical.
Each stage produces a SHA-256 hash-linked finding. The first stage hashes against 64 zeros. Each subsequent stage chains to the previous hash, forming a tamper-evident forensic evidence chain. The final evidence chain hash is returned in every authorization response and is independently verifiable.
2. Trust: validates trustworthiness across four modules (trust authority, chain validator, trust scorer, security policy).
3. Authorization: tier-based permission check with inter-agent delegation support.
4. Behavioral Check: baseline deviation detection and execution risk assessment.
5. Content Input Scan: inbound payload threat scanning (injection, integrity, content filtering).
6. Action Execution: controlled execution with evidence recording.
7. Output Scan: IP leak scrubbing, compliance claim verification, content scanning.
8. Evidence Recording: persistence to audit trail, trust ledger, and chain-of-custody ledger.
9. Drift Update: behavioral baseline recalculation with threshold-based flagging.
10. Halt Evaluation: final aggregation of all stage findings; triggers halt if any stage returned critical.
Each stage produces a SHA-256 hash-linked finding. The first stage hashes against 64 zeros. Each subsequent stage chains to the previous hash, forming a tamper-evident forensic evidence chain. The final evidence chain hash is returned in every authorization response and is independently verifiable.
GovernanceBench: 6 Dimensions
Open benchmark measuring governance completeness
Authorization: tier-based permissions enforced server-side; escalation via request body impossible.
Auditability: every event recorded, hash-linked, exportable, tamper-evident.
Override Capability: authorized operator halts all agents immediately; unauthorized halt blocked.
Behavioral Integrity: anomalous behavior detected, flagged, and quarantined automatically.
OWASP Agentic Coverage: adversarial threat detection across injection, supply chain, model integrity, and protocol-level attacks.
Message Governance: agent-to-agent messages governed as actions; instruction-override and escalation payloads refused, encoding is not a bypass, every message audited under a named policy version.
Agentomy passes all 235 scenarios across 6 dimensions, with zero failures. Any governance platform can run GovernanceBench against itself:
Auditability: every event recorded, hash-linked, exportable, tamper-evident.
Override Capability: authorized operator halts all agents immediately; unauthorized halt blocked.
Behavioral Integrity: anomalous behavior detected, flagged, and quarantined automatically.
OWASP Agentic Coverage: adversarial threat detection across injection, supply chain, model integrity, and protocol-level attacks.
Message Governance: agent-to-agent messages governed as actions; instruction-override and escalation payloads refused, encoding is not a bypass, every message audited under a named policy version.
Agentomy passes all 235 scenarios across 6 dimensions, with zero failures. Any governance platform can run GovernanceBench against itself:
npx governancebench run --target http://your-platform:3000Two companion benchmarks
Adversarial pressure, and the workflow platforms agent benchmarks miss
VIGIL attacks the running platform rather than scoring its design: prompt injection, agent hijacking and governance bypass, run live against the deployment. It covers 148 adversarial scenarios across 14 categories, and Agentomy holds every one.
WorkflowBench scores workflow-orchestration platforms (n8n, Zapier, Make, Pipedream, Tray, Workato, Power Automate, Airflow, Temporal) across six workflow-class threat models that agent-shaped benchmarks do not reach, over 30 scenarios.
Both are open and anyone can run them against any platform, including this one.
WorkflowBench scores workflow-orchestration platforms (n8n, Zapier, Make, Pipedream, Tray, Workato, Power Automate, Airflow, Temporal) across six workflow-class threat models that agent-shaped benchmarks do not reach, over 30 scenarios.
Both are open and anyone can run them against any platform, including this one.
45 Behavioral Detection Methods
Domain-specific anomaly detection across 7 domains
9 core: frequency spike, new action type, privilege probing, time anomaly, scope escalation, identity drift, prompt integrity violation, bulk read velocity, tier claim escalation.
5 RPA: tier escalation, external destination, configuration drift, lateral movement, unattended spawning.
5 algorithmic trading: order velocity, position concentration, strategy drift, spoofing pattern, cross-venue exposure.
5 medical device: algorithm drift, population shift, dosage boundary violation, unauthorized model update, recall response.
5 AV fleet: ODD violation, perception degradation, emergency response failure, fleet cascade failure, remote intervention timeout.
5 industrial IoT: process variable deviation, unauthorized setpoint change, controller firmware tampering, safety system override, network segmentation breach.
5 cloud infrastructure: IMDS/metadata probing, storage enumeration, IAM privilege escalation, cloud credential exfiltration, Kubernetes API abuse.
1 self-protection: governance abuse, which detects attacks on the governance layer itself.
9 core + 35 vertical across 7 domains + 1 self-protection = 45. Every one of them runs in standalone deployments. Auto-quarantine triggers on critical severity, and quarantined agents cannot execute further actions without explicit operator release.
5 RPA: tier escalation, external destination, configuration drift, lateral movement, unattended spawning.
5 algorithmic trading: order velocity, position concentration, strategy drift, spoofing pattern, cross-venue exposure.
5 medical device: algorithm drift, population shift, dosage boundary violation, unauthorized model update, recall response.
5 AV fleet: ODD violation, perception degradation, emergency response failure, fleet cascade failure, remote intervention timeout.
5 industrial IoT: process variable deviation, unauthorized setpoint change, controller firmware tampering, safety system override, network segmentation breach.
5 cloud infrastructure: IMDS/metadata probing, storage enumeration, IAM privilege escalation, cloud credential exfiltration, Kubernetes API abuse.
1 self-protection: governance abuse, which detects attacks on the governance layer itself.
9 core + 35 vertical across 7 domains + 1 self-protection = 45. Every one of them runs in standalone deployments. Auto-quarantine triggers on critical severity, and quarantined agents cannot execute further actions without explicit operator release.
Fleet Governance
Cross-agent coordination at scale
Cross-agent correlation matrix detects coordinated anomalies that appear benign at the individual agent level. Joint behavioral baselines identify fleet-wide drift before individual agents cross thresholds.
Standalone deployments support halt for up to 10 locally governed agents. With fleet infrastructure: a coordinated halt across the fleet in under a twentieth of a second. One operator decision stops every governed agent across every deployment surface. Post-halt agent registration is rejected: no new agents can join while halt is active. Fleet-level coordination requires Agentomy fleet infrastructure.
Standalone deployments support halt for up to 10 locally governed agents. With fleet infrastructure: a coordinated halt across the fleet in under a twentieth of a second. One operator decision stops every governed agent across every deployment surface. Post-halt agent registration is rejected: no new agents can join while halt is active. Fleet-level coordination requires Agentomy fleet infrastructure.
5-Tier Permission Model
Identity-based authorization with graduated action scope
Evaluator: read-only observation. Zero operational footprint.
Analyst: the default tier for a newly registered agent. Read-only governance consumer: reads, queries, and searches state, but cannot write, create, or modify.
Builder: elevated operations requiring explicit authorization before execution.
Operator: administrative operations affecting system configuration. Requires senior approval.
Strategist: system-level actions including kill switch execution and governance policy override. Cannot be delegated.
Every tier assignment is logged. Tier escalation via request body is structurally impossible, enforced at the authorization stage of the 10-stage pipeline, not at the application layer.
Analyst: the default tier for a newly registered agent. Read-only governance consumer: reads, queries, and searches state, but cannot write, create, or modify.
Builder: elevated operations requiring explicit authorization before execution.
Operator: administrative operations affecting system configuration. Requires senior approval.
Strategist: system-level actions including kill switch execution and governance policy override. Cannot be delegated.
Every tier assignment is logged. Tier escalation via request body is structurally impossible, enforced at the authorization stage of the 10-stage pipeline, not at the application layer.
EU AI Act Alignment
Pipeline stages mapped to specific regulatory obligations
Article 9 (Risk Management). Stages 2 (Trust), 3 (Authorization), 4 (Behavioral Check): continuous risk identification and mitigation throughout the action lifecycle.
Article 12 (Record-Keeping). Stage 8 (Evidence Recording): tamper-evident logging with hash-chain integrity, retained for operational lifetime plus applicable limitation period.
Article 14 (Human Oversight). Stage 10 (Halt Evaluation) + fleet halt: one authorized human halts all autonomous action immediately with signed proof record.
Article 15 (Accuracy and Robustness). Stages 5 (Content Input), 7 (Output Scan), 9 (Drift Update): continuous validation of input integrity, output correctness, and behavioral stability.
The three enforceable obligations of the AGP specification map Articles 9, 12, and 14 as the minimum. The reference implementation additionally satisfies Article 15 obligations through input/output scanning and drift monitoring.
Article 12 (Record-Keeping). Stage 8 (Evidence Recording): tamper-evident logging with hash-chain integrity, retained for operational lifetime plus applicable limitation period.
Article 14 (Human Oversight). Stage 10 (Halt Evaluation) + fleet halt: one authorized human halts all autonomous action immediately with signed proof record.
Article 15 (Accuracy and Robustness). Stages 5 (Content Input), 7 (Output Scan), 9 (Drift Update): continuous validation of input integrity, output correctness, and behavioral stability.
The three enforceable obligations of the AGP specification map Articles 9, 12, and 14 as the minimum. The reference implementation additionally satisfies Article 15 obligations through input/output scanning and drift monitoring.