Governance & evidence # Clear authority before action. Evidence afterward. An agent's useful context and its permission to act are separate. CoA checks the requested action, scope and placement against applicable policy, then records the decision and available execution evidence. 01 ยท Requested action Apply an update to a campaign record The write waits for human approval A resumable web run holds this exact operation and its arguments. A different org admin must approve; changed policy or arguments invalidate that approval. Decision and outcome stay distinct No held write executes while approval is pending. Approval bound to one operation Example scenarios, not a live policy evaluation. No model calls, files or external actions. Real run evidence is inspected in Monitoring. The decision pipeline ## Permission is explicit and limited Start with default deny. Every applicable allowlist layer must grant the request, and any matching deny blocks it. Context can inform a response; it cannot grant authority. - 01RequestIdentify the action, object, data class and requested placement. - 02CheckApply the tenant, role, identity, package and connector grants that govern it. - 03ResolveAllow, refuse or attach obligations. A resumable web operation can wait for approval. - 04RecordKeep the decision, dispatch outcome and available evidence distinct. The package manifest can only restrict existing grants. Law, data-classification and device constraints add denials or obligations; they do not grant permission. Invalid or unavailable required policy facts fail closed. Six authority levels ## Choose the least authority the work needs A level sets a capability ceiling. Execution still requires every applicable grant and must satisfy the current policy; selecting a higher level does not bypass those checks. - 01 / AUTHORITY LEVELAnswerExplain within the approved context. - 02 / AUTHORITY LEVELDraftPrepare content for a person to review. - 03 / AUTHORITY LEVELRecommendSuggest a course of action without applying it. - 04 / AUTHORITY LEVELPrepare actionConstruct an action within its granted scope. - 05 / AUTHORITY LEVELExecute with approvalRequire approval where the policy attaches a hold. - 06 / AUTHORITY LEVELExecute automaticallyRun only actions that all applicable policies permit, without a pending hold. Approval is bound to an operation. Resumable web runs can hold a call for a different org admin to review. Changes to the arguments or policy invalidate that approval. Chat and desktop paths that cannot resume a hold refuse the call. Template approval is not blanket execution permission. An unchanged pre-approved template can create an approved agent. Its runs still face runtime policy and any required human approval. Before release ## Changes meet the tests before users meet the agent Policy What-If shows the effect of a proposed change without a model call. Governance experiments compare authority variants. Required containment tests, pinned datasets and domain-pack baselines can block approval or publishing. Review what is permitted and what must remain forbidden. After release, inspect runs and route exceptions to human review. Verified corrections can become dataset cases and required regression tests. Agents do not silently rewrite their own permissions. Run evidence ## Understand what the evidence establishes Inspect a run's decision, steps, outcome, placement and available usage. Evidence retains its provenance; a reported observation does not become verified enforcement just because it has a signature. ### Server-controlled operations Where the server decides and controls dispatch, the evidence describes enforcement through that path. Refused operations are not dispatched through that boundary. ### Device-reported observations Desktop reports remain observations, even when signed. A device signature protects provenance and integrity; it does not independently establish that the device enforced every claimed control. The tenant audit log uses a hash chain to reveal changes, with explicit limitations for database owners. Compliance exports collect supporting evidence. They are not a certification or an independent audit. ## What does local-first mean today? The macOS alpha scopes file access to a project folder. Model reasoning uses the server proxy where policy permits it. Restricted or local-only context is withheld from cloud inference, so a cloud-dependent task can be unavailable. There is no automatic local-model fallback. Hardware attestation, offline leases and hardware-backed proof remain planned capabilities. Source: https://centerofagentic.com/platform/governance ## Related pages - [Book a demo](https://centerofagentic.com/contact?intent=demo) - [Explore use cases](https://centerofagentic.com/use-cases)