AI Agent Governance and Knowledge Platform

Running AI agents against a production system is easy to start and very hard to do responsibly. The interesting problems are not about model quality.

An agent with tools is an unbounded process. Nothing about a language model naturally stops. A reasoning loop that fails to converge will keep calling tools, keep spending tokens, and keep taking actions until something external stops it. Without an explicit ceiling, the ceiling is your bill or your incident.

"What is this agent allowed to do?" had no authoritative answer. Capabilities were implied by whatever tools happened to be wired up. Adding a tool silently expanded what every agent could do.

Agents duplicate work at scale. Several agents observing the same signal generate the same finding repeatedly. Without deduplication, an operator's queue fills with the same problem stated fifteen ways, and the real second problem is buried.

Multiple workers reach the same conclusion simultaneously. Which is fine for observation, and a serious problem the moment any of them can act.

Agents confidently reason from wrong assumptions. An agent that infers architecture from directory names will be wrong in a plausible, well-argued way. Ours had real material to be wrong about: several components share names, and a substantial subtree in the repository does not run at all.

The dangerous middle ground is autonomy without a rollout path. Either agents only observe, which is safe but low value, or they act, which is valuable and frightening. There was no defined route between the two.

Goals

1. Every agent job runs under an explicit token, tool-call and runtime ceiling.
2. Every action names a capability that must exist in a registry, and the check fails closed.
3. Capabilities roll out through observe, then assist, then autofix — never straight to acting on production.
4. Deploy and migration capabilities are denied from autofix by default, as pattern-matched rules rather than case-by-case judgment.
5. Duplicate findings are collapsed within a time window.
6. Exactly one worker acts on a given job, even when several reach the same conclusion.
7. Agents retrieve grounded context from real documentation rather than inferring architecture.

Non-goals

• Not an autonomous operations platform. Production mutation requires human approval; autofix is a narrow, per-capability grant.
• Not a general agent framework. It governs agents against one platform.
• No agent in the sending path. Stated explicitly, permanently.
• Not a replacement for monitoring. Agents explain and propose; deterministic monitoring detects.

• Problem framing — argued that the constraint on agent value was governance and triage cost, not model capability. That reframing shaped everything after.
• Governance design — the three-mode rollout, the capability registry, the budget model and the fail-closed posture are the design decisions I own.
• Policy authoring — the default-deny patterns for deploy, migration and security-adjacent capabilities.
• Architecture — leader election, deduplication windows, rate limiting and the job and attempt record structure.
• Knowledge engine requirements — hybrid retrieval combining vector and keyword search, per-space collections, and an ingestion pipeline that keeps documentation current.
• Grounding strategy — established that agents read curated, verified documents rather than exploring source freely.
• Test planning — including the tests that assert denial on registry failure and correct budget enforcement.
• Honest status reporting — this project is partially operational and is labeled that way. Some capabilities observe; a small set assist; production mutation still requires a human.

A job is the unit. An agent job carries a capability key, a budget, and a deduplication key. Each execution attempt is recorded with its status, timings, metrics and artifacts, so an agent's history is auditable rather than reconstructed from logs.

The capability registry is the authority. Before an action runs, its capability key is checked against a registry. If the check cannot complete — a database problem, a network fault — the action is denied. An outage cannot become an authorization bypass.

Three modes, escalated deliberately. In observe, the agent reports what it would do. In assist, it prepares a change for a human to apply. In autofix, it acts. The global default is observe. Escalation is per capability, and deploy, migration and security-adjacent capabilities are denied from autofix by pattern.

Budgets are ceilings, not guidance. Each job has a maximum token spend, a maximum number of tool calls and a maximum runtime. A loop that does not converge hits a wall instead of a bill.

Deduplication within a window. Findings that repeat inside the window collapse into one, so the operator queue reflects distinct problems.

Leader election for action. Several workers may reach the same conclusion; one lease-holder acts. Leases expire, so a dead leader does not block progress permanently.

The knowledge engine grounds it. Curated documents are ingested, chunked, embedded and indexed into per-space collections. Retrieval merges vector similarity with keyword matching, because the questions agents ask are often exact-term questions — a service name, an invariant, an error string — where pure semantic search underperforms.

This is the section I would most want a technical interviewer to read, because the honest answer is more interesting than a clean one.

The declarative catalog is complete and unexecuted. Thirty-eight agent workflows are declared as capability graphs — ordered steps, parallel groups, named tools, an autonomy mode, required evidence — alongside 41 capabilities, 15 tools, 36 cron schedules each carrying its own token, tool-call and runtime budget, six event trigger rules with dedup windows, and two predefined chains. All of it version-controlled and reviewable in a pull request.

None of it runs. The definitions were never seeded into the database, and every run path checks an environment flag that is unset, so the orchestrator refuses to start a workflow at all.

Meanwhile agents are doing real work through a simpler path. The same worker runs a second route that takes a free-text task and a mode, executes it, and records the result with no workflow key attached. That path has completed more than 53,000 runs across over 125,000 steps, spread across a knowledge agent, a code agent and a runtime agent, and it is still producing runs today. Its event mapping covers incident detection, configuration drift, run failure and post-run distillation.

The governance gate is ahead of the thing it governs. The gate is wired and has emitted several hundred audited events, and its live policy rows sit at the strictest possible settings — concurrency of one, ten runs per hour, with both verification and canary required. But it has recorded no job-level allow or deny, because the runtime it protects is switched off. The guard was built before the door.

Retrieval is currently degraded. The hybrid retriever is designed to merge vector similarity with keyword search by reciprocal rank fusion. Right now the vector store holds no collections, so retrieval has fallen back to keyword search alone, and the document sync against the upstream source is erroring. The corpus itself is intact — over 8,300 documents and nearly 23,000 chunks across four spaces — but semantic retrieval is not currently happening.

Budgets alone do not bound cost. A job that terminates cleanly at its token ceiling and is then immediately rescheduled costs the same as an unbounded loop, just in installments. Budgets needed rate limiting and deduplication next to them before the ceiling meant anything.

Deduplication keys are subtle. Too broad and genuinely distinct problems get collapsed into one, which is worse than duplication — you lose a real finding. Too narrow and near-identical findings all come through. Getting this right took several iterations against real finding streams, and it is still tuned rather than solved.

Leader election without lease expiry deadlocks. The first implementation had a worker acquire leadership and die holding it. Nothing errored; the capability simply stopped running. Expiring leases fixed it — the same lesson the enrichment queue taught, learned separately, which says something about how easy it is to forget that the holder of a lock can die.

Agents are confidently wrong when ungrounded. Early diagnostic agents produced well-argued analyses of a component that does not run in production. Not hallucination in the usual sense — correct reasoning from a directory that plausibly looked like the live system. This is why grounding is curated.

Escalation stalls without a driver. Three modes give a safe path from observe to autofix. They also make it very comfortable to leave everything in observe forever. Escalation needs someone to own it, and I have not solved that with process yet.

This project is genuinely partially operational — which is why the status on this page says so. The governance layer works. Retrieval works. The set of capabilities actually escalated beyond observe is small, and production mutation still goes through a human.

• Capability policy configuration

  Global mode, per-capability overrides and the pattern-based deny rules.

• Agent finding review queue

  Deduplicated findings with proposed actions and current mode.

• Job attempt record

  Status, timings, budget consumption and artifacts for a single attempt.

• Retrieval evaluation output

  Hybrid search results against known question and answer pairs.

What worked. Treating authorization as a deterministic, fail-closed lookup that no model participates in. Everything else about agent safety follows from that being true and unarguable.

What failed. I shipped budgets before rate limiting and thought the cost problem was solved. A bounded job rescheduled immediately is an unbounded job with extra steps. Bounding a single execution is not the same as bounding a system.

What changed. Grounding moved from automatic to curated. Free exploration produced confident, well-argued analyses of code that does not run — and the counter-measure had to be curation, with drift detection as its own capability to manage the cost.

What I would do differently. I would have designed the escalation process, not just the escalation mechanism. Three modes make the safe path available; without someone owning the decision to escalate, everything stays in observe and the value never arrives.

What this demonstrates about AI-product leadership. The hard part of agent systems is not making them capable — it is deciding what they are permitted to do, proving that boundary holds when things fail, and building a route from observation to action that an operations team will actually accept. That is product and governance work, not prompt work, and it is the difference between an agent demo and an agent you can leave running.

• Drive capabilities out of observe. Define what evidence justifies escalating a specific capability to assist, and give that decision an owner.
• Deduplication tuning from outcomes. Use human dispositions on findings to tune the window and key, rather than tuning by hand.
• Cost attribution per capability, so budget policy is set from observed spend rather than from an initial guess.
• Retrieval freshness guarantees. Track document age against the code it describes and surface staleness before an agent relies on it.