RPA AND AUTOMATION GOVERNANCE

Govern your bots like you govern your agents.

RPA bots operating without governance create the same risks as ungoverned AI agents: unauthorized actions, no audit trail, no kill switch. Agentomy extends its governance layer to cover bots across any RPA platform or custom automation framework.

119
Behavioral detection patterns
7
Compliance frameworks
34
Mapped controls
16
Behavioral monitor methods
20
GovernanceBench scenarios
Behavioral Detection

119 behavioral detection patterns validated against documented incidents

Every detection pattern is mapped to a real incident, a real regulatory reference, and a real detection method. The 16-method behavioral monitor runs continuously across the bot lifecycle. No theoretical threats. No generic compliance language. Below are 10 representative patterns from the full 119-pattern library.

Runaway Loop
Runaway Bot Loop
Bot executing 100+ identical actions in 60 seconds. Indicates runaway process, infinite loop, or misconfigured retry logic.
Critical
Unauthorized Access
Unauthorized System Access
Bot attempting to access a system or endpoint not on its approved whitelist. Indicates scope creep, misconfiguration, or compromised bot.
Critical
Credential Reuse
Credential Reuse
Multiple bot instances using the same credential or service account. Breaks auditability and enables unauthorized action attribution.
High
Process Escalation
Process Escalation
Bot attempting to trigger a higher-privilege process or escalate its own authorization tier without explicit approval.
Critical
Data Exfiltration
Configuration Drift
Bot's operational parameters changing between scheduled runs without an authorized change record in the governance trail.
High
Schedule Violation
Schedule Violation
Bot executing outside approved windows: maintenance periods, off-hours, or embargo periods. Indicates misconfiguration or unauthorized activation.
High
Configuration Drift
Data Exfiltration
Bot sending data to unapproved external destinations. Detected via destination whitelist with hash verification on every outbound call.
Critical
Lateral Movement
Lateral Movement
Bot traversing from an authorized system to an unauthorized adjacent system. Cross-system access pattern analysis detects the boundary violation.
Critical
Volume Anomaly
Unattended Spawning
Bot creating child processes or spawning new bot instances without operator awareness. Process tree monitoring catches undeclared instances.
High
Unattended Spawning
Audit Gap
Bot operating without producing evidence records. Gaps in the audit trail mean gaps in regulatory defensibility.
High
GOVERNANCE MODULES

5 governance layers for the bot lifecycle

Each layer enforces one aspect of RPA governance -- from individual action validation to fleet-wide emergency halt.

Action Gate
Every bot action validated against approved process whitelist before execution. Blocks unauthorized processes, enforces frequency limits, and flags volume anomalies.
Identity Resolver
Maps every bot instance to a governance identity with unique credentials, platform origin, and permission scope. Detects shared account abuse across instances.
Schedule Guard
Enforces approved execution windows per bot. Flags and blocks out-of-hours execution. Configurable drift tolerance for legitimate operational variance.
Boundary Control
Prevents unauthorized lateral movement between systems. Every cross-system boundary crossing requires explicit authorization. Tracks traversal count per session.
Fleet Halt
One command halts all governed bots across every platform. Scoped halt by platform, process type, or risk tier. Persists across restart. 8ms response time.
Compliance

7 frameworks, 34 controls, real regulatory references

Every control mapping references the actual regulatory document. No generic compliance language. All mappings are self-assessed, pending external validation.

Framework Controls Scope
OCC Bulletin 2023-17 4 Third-party RPA vendor risk assessment, due diligence, ongoing monitoring
OCC 2011-12 / SR 11-7 4 Model risk management for AI-enhanced bots. Pure rule-based bots carved out.
FFIEC IT Handbook 3 Operations monitoring, change management, incident identification
DORA Article 6 6 ICT risk management: annual review, board accountability, 4-hour incident reporting
EU AI Act Article 6 5 High-risk classification for AI/ML bots in Annex III domains
SOX 404 + COSO RPA Framework 6 Bot lifecycle ITGCs: development, deployment, monitoring, decommissioning
PCI DSS v4.0 6 Bot identity, least privilege, audit logging, tamper detection, incident response
Why This Matters

Real incidents, real consequences

Knight Capital Group, August 2012
$440M loss in 45 minutes
Runaway automated trading. No process execution validation, no frequency anomaly detection, no kill switch. SEC Administrative Proceeding File No. 3-15570. Agentomy detects this via the Runaway Loop pattern with auto-quarantine at 100 actions in 60 seconds.
GSA OIG Audit, August 2024
Decommissioned bots retained PII access
Seven recommendations issued after audit found decommissioned RPA bots still had access to systems containing personally identifiable information and procurement data. Report A230020/B/T/F24004. Agentomy detects this via the Unauthorized Access and Credential Reuse patterns.
Citibank, August 2020
$900M erroneous transfer
Automated process transferred the full principal instead of an interest payment. No cross-system boundary check, no authorization validation on transfer amounts. Agentomy detects this via the Process Escalation and Data Exfiltration patterns.
COSO RPA Framework, December 2024
14 control requirements published
COSO published a dedicated RPA governance framework identifying 4 governance areas and 14 specific control requirements for bots touching financial reporting. SOX 404 compliance now requires RPA-specific ITGCs. Agentomy maps all 6 SOX/COSO controls.
Get Started

Three commands to governed RPA

# Install the governance adapter $ npm install @agentomy/governance # Authorize an RPA bot action $ curl -X POST http://localhost:3000/api/claw/authorize \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY" \ -d '{"agentId": "rpa-bot-invoice-processor", "action": "write", "scope": "accounts_payable", "metadata": {"botPlatform": "rpa-engine", "processName": "InvoiceReconciliation"}}' # Halt the entire bot fleet $ curl -X POST http://localhost:3000/api/claw/halt \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY" \ -d '{"reason": "runaway process detected", "operatorId": "admin-01"}'