Agent Runtime Governance (ARG)
Agent Runtime Governance is the discipline of governing what an AI agent does at runtime: authorizing, enforcing, and recording its actions before and during execution.
Watchlight AI defined the category. As the market converges on runtime authorization, Watchlight goes deeper: we govern delegated authority across the entire execution lifecycle, from intent through propagation, enforcement, lineage, and containment.
The Market Converged. Watchlight Goes Deeper.
Identity, PAM, cloud, MCP, and agent-security vendors are now adding agent identity, per-tool-call authorization, and runtime policy checks. We read that convergence as validation of the category we defined, not as evidence that it is a commodity. A single runtime check on one action is a feature. Governing delegated authority across an entire execution chain is an architecture.
The question is no longer who can perform a runtime policy check. It is who has built the architecture to govern delegated authority across the complete execution lifecycle, and can prove and contain what follows.
Delegated Authority
Model who or what granted authority, for which task, with which constraints, and how that authority narrows through every downstream delegation.
Execution Governance
Make a deterministic pre-action decision using identity, delegated authority, the task and goal, the action arguments, execution state, policy, and risk context. No language model in the trust path.
Authority Propagation
Track agent-to-agent delegation, prevent authority from expanding as it flows down the chain, and preserve the relationship back to the original human principal.
Execution Lineage
Preserve the causal chain from human intent through delegation, decisions, actions, downstream agents, and effects, so lineage can inform subsequent authorization and containment, not just after-the-fact logging.
Runtime Effects
Move beyond allow and deny to termination, quarantine, subtree severance, and revocation when an execution chain has to be contained.
Independent Enforcement
Govern heterogeneous frameworks and infrastructure with two independent control points, in-process and on the wire, without requiring one agent platform, cloud, or gateway.
We defined Agent Runtime Governance, published the 12 Non-Negotiable Principles, and submitted a 37-page technical architecture with 20 sequence diagrams to NIST’s National Cybersecurity Center of Excellence. The market is implementing pieces of that architecture. Watchlight AI Beacon was built around the whole of it, deterministically, framework-independent, and sovereign.
How Agent Runtime Governance Was Built
We defined the category in February 2026, when we published the 12 Non-Negotiable Principles for Agent Runtime Governance. These are the milestones since.
The category is created
We define Agent Runtime Governance and publish the 12 Non-Negotiable Principles for Agent Runtime Governance, the foundational framework, alongside the position paper establishing ARG as the missing layer between IAM and agent execution.
Architectural principles submitted to NIST
We submit the architectural principles of Agent Runtime Governance to NIST, in response to the NCCoE Concept Paper on AI Agent Identity and Authorization.
Early access and execution lineage
We open the Founding Design Partner Program and introduce the Agent Execution Graph, making every agent action and its full lineage visible as it happens.
Watchlight AI Beacon
Watchlight AI Beacon is named publicly as the enterprise runtime control plane, and the Beacon Plugin Suite brings runtime governance across agent frameworks.
Governing the long-horizon loop
We publish Securing the Agentic Loop and ship the plugin for LangChain deep agents, extending governance to long-running autonomy across eight framework integrations.
What Agent Runtime Governance Is
One control layer sits between an agent and the systems it acts on, and decides every action at the moment it happens.
Agent Runtime Governance decides, for every single action, whether the agent may proceed, at the moment it acts. If a control does not govern the action itself at runtime, it is not Agent Runtime Governance.
What Is Not Agent Runtime Governance
These layers matter, and Watchlight AI Beacon works alongside them. None of them governs the agent's action at runtime, so none of them is ARG.
AI Security & Detection
Inspects content and flags risk, often after the fact. It does not authorize the action itself.
IAM & PAM
Authenticates the agent once and grants standing access. It cannot decide each action at runtime.
SIEM & Logging
Records what already happened. That is evidence, not enforcement.
Agent Frameworks
Run agents and orchestrate tools. They carry no concept of governance.
MCP & AI Gateways
Route and standardize how agents reach models and tools. They manage connectivity and traffic, not whether a given action is authorized against policy at runtime.
The Six Structural Gaps
These are not feature requests for existing products. They represent a missing architectural layer.
No Intent Layer
IAM answers "can this entity access this resource?" — it cannot answer "why is this entity accessing it right now, and does that reason align with an approved business objective?"
No Delegation Model
When agents delegate to sub-agents, IAM cannot track the trust chain from the authorizing human through every agent in the path — or verify that scope narrowed at each link.
No Runtime Context
RBAC assigns permissions at provisioning time. Neither RBAC nor ABAC evaluates the evolving runtime context of an autonomous agent — its current goal, action count, plan deviation, or TTL expiry.
No Secrets Governance for Agents
PAM vaults use human approval workflows. Agents need credentials injected into execution context — scoped to a specific action, with TTLs measured in minutes, not stored credentials with broad access.
No Behavioral Observability
SIEM logs "agent-47 READ customers." ARG requires: which agent, what intent, what goal, who authorized it, what policy was evaluated, and whether the action was consistent with declared purpose.
No Agentic Loop Runtime Governance
Existing controls govern one request at a time. Nothing governs the agent's loop as a whole: the plan, act, and observe cycle that runs on its own at machine speed, where each result steers the next action and a chain of individually-allowed steps can still cross a line.
The Seven Minimum Requirements
Any system that claims to provide Agent Runtime Governance must deliver these capabilities. This is the floor, not the ceiling.
Agent Identity & Registry
Every agent has unique, cryptographically verifiable identity. Unregistered agents are denied execution.
Intent Declaration & Validation
Agents declare purpose, goal, and intent. Inconsistent declarations result in denied execution.
Runtime Policy Enforcement
Policy evaluated on every action, at the moment of execution, using formal policy languages — not prompt guidelines.
Delegation Chain Tracking
Cryptographically verifiable trust chains from human decisions through every agent in the path, with scope narrowing at each link.
Secrets Governance
Short-lived, purpose-bound capability tokens. No long-lived credentials in agent hands. Proxy-based injection without code changes.
Behavioral Observability
Every action logged with full governance context: identity, intent, goal, delegation chain, policy evaluation result, and outcome.
Safe Failure & Kill Switches
Fail-closed semantics. Emergency stops at individual agent, agent group, and system-wide levels — independent of the agents themselves.
These requirements come from the framework that defines the category.
Read the 12 Non-Negotiable PrinciplesFrequently Asked
Agent Runtime Governance, answered
What is Agent Runtime Governance (ARG)?
Agent Runtime Governance is the discipline of governing what an autonomous AI agent is allowed to do at runtime: authorizing, enforcing, and recording every action before and during execution, against current policy. It sits above identity and below the application, and it governs the exercise of delegated authority across an agent's entire execution, not just a single tool call. Watchlight AI created the category and authored its 12 Non-Negotiable Principles.
Who created Agent Runtime Governance?
Watchlight AI created Agent Runtime Governance and authored the 12 Non-Negotiable Principles that define it. The company, founded by Aldo Pietropaolo, published the architectural principles and submitted a technical architecture to NIST's National Cybersecurity Center of Excellence in response to its concept paper on AI agent identity and authorization.
How is Agent Runtime Governance different from IAM, PAM, and AI security?
Identity and access management authenticates an agent and grants standing access, but it cannot decide each action at runtime. Privileged access management vaults credentials for human approval workflows, not machine-speed agent execution. AI security inspects content and flags risk, often after the fact, without authorizing the action itself. Agent Runtime Governance is the enforcement and evidence layer above all of them: it makes a deterministic decision on each action, tracks delegated authority across agent-to-agent delegation, preserves execution lineage, and can contain a run in flight.
Does Agent Runtime Governance replace my identity provider like Okta, Ping, or Entra?
No. Your identity provider decides who the agent is and what token it carries, and Watchlight sits downstream of it, provider-neutral. Identity establishes who the agent is and what it can access. Agent Runtime Governance decides whether, how, and under whose delegated authority the agent may act, enforces it where actions execute, and preserves the lineage of what follows.
What is delegated authority, and why does a single per-tool-call check miss it?
An agent almost never acts for itself. It acts on authority delegated from a human, and the legitimacy of an action depends on that grant, not only on the token the agent holds. A per-tool-call check answers whether this agent may call this tool, but it does not ask under whose authority the agent is acting, how far that authority has narrowed as work passed to sub-agents, or where in the execution chain the action sits. Governing delegated authority across the whole chain, deterministically and with lineage, is a different architecture from a single check.
Is a language model in the authorization decision?
In Agent Runtime Governance as Watchlight defines it, no. The authorization decision is deterministic. If a language model is anywhere in the trust path, a persuasive justification can talk its way past the control and it is no longer enforcement. This is the sharpest question to ask any agent authorization vendor.
What are the 12 Non-Negotiable Principles for Agent Runtime Governance?
The 12 Non-Negotiable Principles are the architectural framework Watchlight AI authored to define Agent Runtime Governance. They cover agent identity and registry, intent declaration and validation, runtime policy enforcement on every action, delegation chain tracking with scope narrowing, secrets governance, behavioral observability with full governance context, the plan-act-observe lifecycle, and fail-closed kill switches, among others. They are published in the governance framework whitepaper.
Request a Demo to Watchlight AI Beacon
Beacon is the enterprise runtime control plane that puts Agent Runtime Governance into practice, authorizing, enforcing, and recording every agent action at runtime. Join the Founding Design Partner program to deploy it and help shape the roadmap.
Request a Demo