Watchlight AI
Defining the Category

Agent Runtime Governance (ARG)

Agent Runtime Governance is the discipline of governing what an AI agent does at runtime: authorizing, enforcing, and recording its actions before and during execution.

Watchlight AI defined the category. As the market converges on runtime authorization, Watchlight goes deeper: we govern delegated authority across the entire execution lifecycle, from intent through propagation, enforcement, lineage, and containment.

The Category Creator

The Market Converged. Watchlight Goes Deeper.

Identity, PAM, cloud, MCP, and agent-security vendors are now adding agent identity, per-tool-call authorization, and runtime policy checks. We read that convergence as validation of the category we defined, not as evidence that it is a commodity. A single runtime check on one action is a feature. Governing delegated authority across an entire execution chain is an architecture.

The question is no longer who can perform a runtime policy check. It is who has built the architecture to govern delegated authority across the complete execution lifecycle, and can prove and contain what follows.

Delegated Authority

Model who or what granted authority, for which task, with which constraints, and how that authority narrows through every downstream delegation.

Execution Governance

Make a deterministic pre-action decision using identity, delegated authority, the task and goal, the action arguments, execution state, policy, and risk context. No language model in the trust path.

Authority Propagation

Track agent-to-agent delegation, prevent authority from expanding as it flows down the chain, and preserve the relationship back to the original human principal.

Execution Lineage

Preserve the causal chain from human intent through delegation, decisions, actions, downstream agents, and effects, so lineage can inform subsequent authorization and containment, not just after-the-fact logging.

Runtime Effects

Move beyond allow and deny to termination, quarantine, subtree severance, and revocation when an execution chain has to be contained.

Independent Enforcement

Govern heterogeneous frameworks and infrastructure with two independent control points, in-process and on the wire, without requiring one agent platform, cloud, or gateway.

We defined Agent Runtime Governance, published the 12 Non-Negotiable Principles, and submitted a 37-page technical architecture with 20 sequence diagrams to NIST’s National Cybersecurity Center of Excellence. The market is implementing pieces of that architecture. Watchlight AI Beacon was built around the whole of it, deterministically, framework-independent, and sovereign.

The Origin of the Category

How Agent Runtime Governance Was Built

We defined the category in February 2026, when we published the 12 Non-Negotiable Principles for Agent Runtime Governance. These are the milestones since.

February 2026

The category is created

We define Agent Runtime Governance and publish the 12 Non-Negotiable Principles for Agent Runtime Governance, the foundational framework, alongside the position paper establishing ARG as the missing layer between IAM and agent execution.

March 2026

Architectural principles submitted to NIST

We submit the architectural principles of Agent Runtime Governance to NIST, in response to the NCCoE Concept Paper on AI Agent Identity and Authorization.

April 2026

Early access and execution lineage

We open the Founding Design Partner Program and introduce the Agent Execution Graph, making every agent action and its full lineage visible as it happens.

May 2026

Watchlight AI Beacon

Watchlight AI Beacon is named publicly as the enterprise runtime control plane, and the Beacon Plugin Suite brings runtime governance across agent frameworks.

August 2026

Governing the long-horizon loop

We publish Securing the Agentic Loop and ship the plugin for LangChain deep agents, extending governance to long-running autonomy across eight framework integrations.

What Agent Runtime Governance Is

One control layer sits between an agent and the systems it acts on, and decides every action at the moment it happens.

Humaninitiates the work
Identityverifies who is acting
Agent Runtime Governance
AuthorizeEnforceRecord
every action, before and during execution
Agentacts on its own
Systemsdata and tools

Agent Runtime Governance decides, for every single action, whether the agent may proceed, at the moment it acts. If a control does not govern the action itself at runtime, it is not Agent Runtime Governance.

What Is Not Agent Runtime Governance

These layers matter, and Watchlight AI Beacon works alongside them. None of them governs the agent's action at runtime, so none of them is ARG.

AI Security & Detection

Inspects content and flags risk, often after the fact. It does not authorize the action itself.

IAM & PAM

Authenticates the agent once and grants standing access. It cannot decide each action at runtime.

SIEM & Logging

Records what already happened. That is evidence, not enforcement.

Agent Frameworks

Run agents and orchestrate tools. They carry no concept of governance.

MCP & AI Gateways

Route and standardize how agents reach models and tools. They manage connectivity and traffic, not whether a given action is authorized against policy at runtime.

The Six Structural Gaps

These are not feature requests for existing products. They represent a missing architectural layer.

No Intent Layer

IAM answers "can this entity access this resource?" — it cannot answer "why is this entity accessing it right now, and does that reason align with an approved business objective?"

No Delegation Model

When agents delegate to sub-agents, IAM cannot track the trust chain from the authorizing human through every agent in the path — or verify that scope narrowed at each link.

No Runtime Context

RBAC assigns permissions at provisioning time. Neither RBAC nor ABAC evaluates the evolving runtime context of an autonomous agent — its current goal, action count, plan deviation, or TTL expiry.

No Secrets Governance for Agents

PAM vaults use human approval workflows. Agents need credentials injected into execution context — scoped to a specific action, with TTLs measured in minutes, not stored credentials with broad access.

No Behavioral Observability

SIEM logs "agent-47 READ customers." ARG requires: which agent, what intent, what goal, who authorized it, what policy was evaluated, and whether the action was consistent with declared purpose.

No Agentic Loop Runtime Governance

Existing controls govern one request at a time. Nothing governs the agent's loop as a whole: the plan, act, and observe cycle that runs on its own at machine speed, where each result steers the next action and a chain of individually-allowed steps can still cross a line.

The Seven Minimum Requirements

Any system that claims to provide Agent Runtime Governance must deliver these capabilities. This is the floor, not the ceiling.

1

Agent Identity & Registry

Every agent has unique, cryptographically verifiable identity. Unregistered agents are denied execution.

2

Intent Declaration & Validation

Agents declare purpose, goal, and intent. Inconsistent declarations result in denied execution.

3

Runtime Policy Enforcement

Policy evaluated on every action, at the moment of execution, using formal policy languages — not prompt guidelines.

4

Delegation Chain Tracking

Cryptographically verifiable trust chains from human decisions through every agent in the path, with scope narrowing at each link.

5

Secrets Governance

Short-lived, purpose-bound capability tokens. No long-lived credentials in agent hands. Proxy-based injection without code changes.

6

Behavioral Observability

Every action logged with full governance context: identity, intent, goal, delegation chain, policy evaluation result, and outcome.

7

Safe Failure & Kill Switches

Fail-closed semantics. Emergency stops at individual agent, agent group, and system-wide levels — independent of the agents themselves.

These requirements come from the framework that defines the category.

Read the 12 Non-Negotiable Principles

Frequently Asked

Agent Runtime Governance, answered

What is Agent Runtime Governance (ARG)?

Agent Runtime Governance is the discipline of governing what an autonomous AI agent is allowed to do at runtime: authorizing, enforcing, and recording every action before and during execution, against current policy. It sits above identity and below the application, and it governs the exercise of delegated authority across an agent's entire execution, not just a single tool call. Watchlight AI created the category and authored its 12 Non-Negotiable Principles.

Who created Agent Runtime Governance?

Watchlight AI created Agent Runtime Governance and authored the 12 Non-Negotiable Principles that define it. The company, founded by Aldo Pietropaolo, published the architectural principles and submitted a technical architecture to NIST's National Cybersecurity Center of Excellence in response to its concept paper on AI agent identity and authorization.

How is Agent Runtime Governance different from IAM, PAM, and AI security?

Identity and access management authenticates an agent and grants standing access, but it cannot decide each action at runtime. Privileged access management vaults credentials for human approval workflows, not machine-speed agent execution. AI security inspects content and flags risk, often after the fact, without authorizing the action itself. Agent Runtime Governance is the enforcement and evidence layer above all of them: it makes a deterministic decision on each action, tracks delegated authority across agent-to-agent delegation, preserves execution lineage, and can contain a run in flight.

Does Agent Runtime Governance replace my identity provider like Okta, Ping, or Entra?

No. Your identity provider decides who the agent is and what token it carries, and Watchlight sits downstream of it, provider-neutral. Identity establishes who the agent is and what it can access. Agent Runtime Governance decides whether, how, and under whose delegated authority the agent may act, enforces it where actions execute, and preserves the lineage of what follows.

What is delegated authority, and why does a single per-tool-call check miss it?

An agent almost never acts for itself. It acts on authority delegated from a human, and the legitimacy of an action depends on that grant, not only on the token the agent holds. A per-tool-call check answers whether this agent may call this tool, but it does not ask under whose authority the agent is acting, how far that authority has narrowed as work passed to sub-agents, or where in the execution chain the action sits. Governing delegated authority across the whole chain, deterministically and with lineage, is a different architecture from a single check.

Is a language model in the authorization decision?

In Agent Runtime Governance as Watchlight defines it, no. The authorization decision is deterministic. If a language model is anywhere in the trust path, a persuasive justification can talk its way past the control and it is no longer enforcement. This is the sharpest question to ask any agent authorization vendor.

What are the 12 Non-Negotiable Principles for Agent Runtime Governance?

The 12 Non-Negotiable Principles are the architectural framework Watchlight AI authored to define Agent Runtime Governance. They cover agent identity and registry, intent declaration and validation, runtime policy enforcement on every action, delegation chain tracking with scope narrowing, secrets governance, behavioral observability with full governance context, the plan-act-observe lifecycle, and fail-closed kill switches, among others. They are published in the governance framework whitepaper.

Request a Demo to Watchlight AI Beacon

Beacon is the enterprise runtime control plane that puts Agent Runtime Governance into practice, authorizing, enforcing, and recording every agent action at runtime. Join the Founding Design Partner program to deploy it and help shape the roadmap.

Request a Demo

We value your privacy

We use cookies to enhance your browsing experience, analyze site traffic, and personalize content. You can choose to accept all cookies or customize your preferences. Learn more