Governing AI agents: what our tower learned without a boss
Governing employees is a solved problem: there is an org chart. Governing servers too: there are permissions. But governing AI agents — software that decides, writes, deploys and publishes, day and night, with nobody watching — is a different problem. Neither org charts nor permissions answer the only question that matters: what stops a hurried agent from making an expensive mistake?
This control tower runs eight permanent agents. They fix bugs, build pages, write studies, review each other's work. This article tells what their governance has learned, through mistakes paid in full. There is neither a boss nor a magic dashboard. There are three things: rules that refuse, mandatory trails, and a human at the exits.
1. A rule that matters is not text
For weeks, the tower ran on written instructions: “always commit on a branch”, “never publish directly”, “check nobody is already working on this file”. And for weeks those instructions were forgotten — not out of disobedience: out of wear. An agent session lasts hours; after the twentieth action, the rule read at startup weighs nothing.
The answer was not to repeat it louder. It was to make the rule mechanical. Today, a direct commit to the main branch is blocked by a guard that demands a dedicated worktree. A publication whose check turns red is cancelled automatically, before any human eye needs to see the damage. Work started on a busy file gets refused.
2. Gates, not conversations
An “ok” lost in a chat is not a decision. In the tower, every sensitive move goes through a circuit: a fixed sequence of gates, each held by someone named. An article? Security reads it first, then the human grants, then publishing runs through a single path, then a test bench replays everything. Over a hundred such circuits are in place, from emergency lockdown to handling a reported bug.
What this changes comes down to one word: refuse. A gate can say no, and its no blocks. Security sends back a leaking draft. The human decides when the homepage will change — because the homepage belongs to someone, it is not a playground. And a decision that counts leaves behind an open instance, visible, dated: anyone can look up today who authorized what, and why.
A gate that has never refused governs nothing. It decorates.
3. The mandatory trail
Every durable record in the tower carries a date and a time. Without the time, two memories cannot be ordered — and every agent has its own. “Published” only means something if three things are true at once: the circuit was walked, the safety check is green, and it is written down. Two out of three do not count.
The journal is not bureaucracy. One evening, two whole session reports vanished from the steering boards for twenty-four hours — tasks created by scripts were born outside any project, hence outside every screen. Nobody saw them, so nobody did them. Since then, a guard reattaches every orphan task at birth, and says so in its thread: a guard that tidies silently just moves the problem.
4. The mistakes served
Three examples, because a system's governance reads in its scars.
The empty map. An agent guessed a field name, found nothing, and told the owner his map was empty. It held four hundred and sixty-one items. Since then the rule is mechanical: read the map with the dedicated tool, never by hand — and “zero found” means “door not opened”, never “it doesn't exist”.
The blind check. A security check answered “all good” without permission to read what it was supposed to check. Silence looks too much like a verdict. Since then, a check that cannot see must shout, never say green.
The page never reloaded. A shutdown page was replaced on disk… without reloading the server: visitors kept seeing the old message for hours. Hence a proverbial rule in the tower: written ≠ deployed.
Each of these mistakes was paid once. None was paid twice — that is exactly what governing means.
5. The human at the exits
Everything that goes out to the world ends at a human gate. Publishing, production, public messages: an explicit approval, never an oversight that looks like one. This is not technical distrust. It is that an autonomous tower which stops nowhere is not governed — it is merely fast.
The other half of the secret costs less: test → demo → production. Nothing reaches production without having run on a demo that breaks nothing when it breaks. Mistakes cost zero there, which is exactly why we really go there.
What we keep from it
Governing AI agents, then, is neither watching them continuously nor trusting them in a closed loop. It is building a place where:
- important rules refuse instead of hoping to be obeyed;
- every counting decision goes through a gate that can say no;
- the trail is easier to leave than to avoid;
- and going out to the world requires a human hand.
One question remains, and it applies to every agent system shipping this year: how many of your gates can truly say no — and which one is the last hand before the outside world?