Governing the commit point: why an AI agent's authority has to hold at the moment it acts
Authorization is usually a stamp collected once, at the start. When an agent acts on its own, minutes later, the conditions that justified that stamp may already be gone. Governing the moment of action, not just the moment of request, is how you close that gap.
Most systems treat authorization as a stamp. An agent asks whether it may do something, a check says yes, and the yes is treated as good until the work is done. That model was fine when a person was always close to the action and could catch a decision that had gone stale. It stops being fine the moment an agent decides and acts on its own, because the gap between "you may" and "it is done" is now filled by software moving faster than anyone can supervise. In that gap, the conditions that justified the yes can quietly change, and nothing re-asks the question.
This is the problem Dr. Travis Lee names precisely in his paper "AI Governance 2.0: Protocol Governance" (the seventh in his AI Governance 2.0 series). We think it is one of the clearest statements of the risk our runtime is built to handle, so this piece uses his framing to explain, plainly, what it takes to govern an agent at the point where its decision becomes a real-world consequence, and what Agentomy actually does about it. Where we lean on his vocabulary, we say so; where we have shipped a mechanism, we show it.
The two-minute gap that breaks a one-time stamp
Lee's central example is a logistics agent. At 10:00 it detects a shipping delay, evaluates the alternatives, decides that rerouting to another carrier is optimal, and it has every credential the workflow requires. By the letter of the system, it is authorized and functioning as designed. But the world did not hold still between the decision and the act. The customer's contract terms changed and this shipment now needs manual approval. Or another system already moved it. Or the manager who delegated that authority withdrew the delegation. The agent is still technically capable and still credentialed, and the action is no longer legitimate.
He makes the timing explicit with a payment: authority to approve is established at 10:00, the relevant authority is withdrawn at 10:07, and execution is attempted at 10:08. The only question that matters is whether the authority was valid at 10:08, when the money actually moved, not at 10:00, when the plan was made. A one-time stamp cannot answer that, because it stopped looking after the yes.
Legitimacy cannot always be inherited indefinitely from an earlier state. (Dr. Travis Lee, Protocol Governance)
Permission is what a system can do; legitimacy is whether it still may
Enterprise systems are good at permission: is this identity real, does this role carry this scope. Lee's sharper point is that permission and legitimacy are not the same thing. Permission establishes what a system can technically do. Legitimacy concerns whether it remains authorized to do it under the conditions that apply at that time. A system can hold valid permission while the conditions that made the action appropriate have already moved on.
That distinction is why Agentomy authorizes per action rather than per login. An agent does not get a session that means "trusted for the next hour." Every consequential action is checked on its own against the current tier, the current controls, and the agent's current standing, and any single one of them can refuse it even though the same agent was permitted a moment earlier. Permission is table stakes; the question we keep asking is legitimacy.
Govern the transition, not the identity
Traditional governance is organized around entities: users, applications, models, service accounts. Lee argues that autonomous systems force the unit of governance to shift to the transition itself, the movement from one state to another. A shipment moving carriers, a payment moving from pending to approved, a deployment moving from staging to production. The useful question is not "does this actor generally have authority" but "is this particular transition authorized under the conditions that exist right now, as it is about to occur."
Agentomy is built the same way. What it governs is the action an agent is about to take, evaluated at the instant it is taken, not a role the agent was assigned earlier. The transition is the thing on trial, every time.
The commit boundary: decide, then check again before it becomes real
There is a moment between a decision (the determination that an action should proceed) and a commitment (the irreversible point where it actually happens). Lee calls the place where a proposed action must prove it is admissible before it becomes committed execution the Constitutional Commit Boundary. Governance, he argues, has to live at that boundary, because financial transactions settle, deployments reach customers, and shipments move, and none of those can be un-done by an audit written afterward.
Agentomy runs its pipeline across exactly that boundary, and we call our version the Governed Commit Point. The pre-action stages decide before the agent acts, at the authorization step. The post-action stages verify after, at the logging step, where the claimed effect finally exists to check. The decision and the commitment are two different events in our runtime, with governance participating at both, which is what lets a commitment be refused even after the decision looked fine.
Three answers, not two
Binary allow/deny hides a real distinction: not knowing whether an action is admissible is not the same as knowing it is forbidden. Lee models this as Permit, Hold, and Reject. Permit when the conditions are satisfied. Hold when admissibility cannot yet be established, so the action pauses until it can. Reject when the action conflicts with a known governing condition.
Agentomy resolves each action to allow, hold-for-approval, or deny for the same reason: a governance runtime that can only say yes or no will say yes to things it should merely have paused on. The hold is the state that keeps an uncertain action from becoming an irreversible mistake.
Live authorization: re-checking at the moment of action
This is the part Lee articulates most sharply and the part we most recently hardened. Authority is not a fixed property attached to an actor; it depends on a grantor, a scope, a purpose, conditions, and a duration, and it can become invalid without the actor changing at all. So authorization has to stay live: an approval granted at the moment of the decision has to still hold at the moment of the act, and the evidence the decision relied on has to still be current when the action lands.
Agentomy now carries this through the Governed Commit Point directly. When an action is authorized, the decision is stamped with how long it stays valid, derived from the tightest constraint in play. At the commit step, the runtime checks that the action actually executed while that authorization was still valid, and that the evidence behind it had not gone stale in the meantime. An action that arrives after its authorization has lapsed, or that leans on evidence which has since expired, is refused at the commit point and recorded as such, rather than waved through because it was fine two minutes ago. That is Lee's continuous legitimacy, running.
Proving why it was allowed, not just what it concluded
Lee draws one more line worth keeping: explainability answers "why did the system reach this conclusion," while governance traceability answers "why was the system entitled to act on it." Accountability needs the second one. It is not enough to reconstruct a model's reasoning; you have to be able to reconstruct the authorization basis, the conditions that applied, and why the action was admissible under them.
Every decision Agentomy makes, allow or deny, is written to a tamper-evident audit trail that records the authorization basis, not just the outcome. The point of that record is precisely Lee's: to be able to prove, later, that the machine was entitled to do what it did, on the terms that were in force when it did it.
What this does not solve, honestly
Lee is candid that his protocol is necessary but not sufficient: it enforces conditions, but it does not on its own decide where those conditions come from or which institution owns them. That honesty is worth matching. Governing the commit point is a mechanism, not a constitution. It does not make an organization compliant or certified, it does not settle who is allowed to set the conditions, and it does not remove the human, it changes the human's job to establishing the conditions the machine then operates within. Cross-system authority, where an action passes through several platforms and no single one owns the whole causal chain, is the frontier of this category, and it plays to our strength: because we govern the transition rather than the identity, carrying that judgment across systems extends the model we already run instead of forcing a re-architecture. That is the natural next reach for a runtime built on the commit point, and it is where we intend to lead.
The governance takeaway
The failure mode is quiet and specific: an agent acts on an authorization that was true when it was granted and false when it was used. Closing it does not take a smarter model; it takes governing the transition at the commit point, keeping the authorization live so it is re-checked at the moment of action, offering a hold as well as a yes and a no, and leaving a record that proves why the action was entitled to happen. Lee named the boundary; we built a runtime that stands on it. If you want to see whether the mechanism holds, the honest answer is the same one we give for everything else: run the benchmark yourself, and try to make it wave through an action whose authority has already expired.