Question 1

What is Agent Runtime Governance (ARG)?

Accepted Answer

Agent Runtime Governance is the discipline of enforcing governance continuously during AI agent execution. It governs every action, delegation, and tool invocation in real time — based on declared intent, scoped authority, and current policy. ARG sits between identity infrastructure (IAM) and the agent frameworks that execute work.

Question 2

How is ARG different from IAM?

Accepted Answer

IAM answers "who is this entity and what can they access?" — evaluated at authentication time with static roles and periodic reviews. ARG answers "why is this agent taking this action right now, and does it align with an approved, time-boxed business objective?" — evaluated on every action, in real time, with full delegation and intent context. IAM governs access. ARG governs execution.

Question 3

Is ARG just ABAC with extra steps?

Accepted Answer

No. ABAC evaluates attributes at request time — subject, resource, action, environment. ARG evaluates runtime context that ABAC has no model for: declared intent categories, active goals with TTLs and action limits, delegation chains with scope narrowing, plan-act-observe lifecycle state, and behavioral consistency between declared intent and actual action. ABAC is a policy evaluation pattern. ARG is an architectural layer.

Question 4

Does ARG replace IAM or PAM?

Accepted Answer

No. ARG complements them. IAM continues to manage identity lifecycle and access provisioning. PAM continues to manage privileged access workflows. ARG adds the runtime governance layer that neither provides — intent validation, delegation tracking, continuous policy enforcement, and behavioral observability for autonomous agents.

Question 5

What is the minimum to get started with ARG?

Accepted Answer

Start with agent identity and registry — know what agents exist, who owns them, and assign unique verifiable identities. Then add intent declaration and runtime policy enforcement. These three capabilities move you from Level 0 (Unmanaged) to Level 1–2 on the governance maturity model. Our position paper details all seven minimum requirements.

Question 6

What does Watchlight AI do?

Accepted Answer

Watchlight AI created the category of Agent Runtime Governance and builds Watchlight AI Beacon, the enterprise runtime control plane that discovers, authorizes, enforces, and records what autonomous agents are allowed to do at runtime. Beacon is available now in early access. Practitioner-led services (consultation, executive briefings, workshops, implementation, and an advisory retainer) help teams put runtime governance into practice.

Question 7

Who is Watchlight AI for?

Accepted Answer

We work with CISOs, CTOs, enterprise architects, and security leaders at organizations deploying or planning to deploy AI agents in production. If your agents access enterprise systems, make autonomous decisions, or orchestrate multi-step workflows, you need Agent Runtime Governance — and we can help you build it.

Question 8

What industries do you work with?

Accepted Answer

We focus on industries where autonomous agents are moving into production, including financial services, healthcare, technology, government, and professional services. Agent Runtime Governance is industry-agnostic: any organization deploying autonomous agents needs governance infrastructure, regardless of sector.

Question 9

How is Watchlight AI different from IAM vendors or AI governance platforms?

Accepted Answer

IAM vendors focus on identity lifecycle and access provisioning — they govern who can access what. Broad AI governance platforms focus on model inventories, bias detection, and compliance checklists. Watchlight AI focuses on what happens at runtime — governing what agents actually do during execution. We address the architectural layer between identity infrastructure and agent frameworks that neither category covers: intent validation, delegation chains, runtime policy enforcement, and behavioral observability.

Question 10

How can we engage with Watchlight AI?

Accepted Answer

Two ways. The product: Watchlight AI Beacon, the runtime control plane for Agent Runtime Governance, available now in early access. And five practitioner-led services, calibrated to where you are in your agent program: a free consultation, a half-day executive briefing, hands-on workshops, an implementation engagement that takes a blueprint into production, and an advisory retainer that puts an Agent Runtime Governance architect on call.

Question 11

How does an engagement typically start?

Accepted Answer

Most engagements begin with an Agent Governance Assessment — a structured evaluation of your current agent deployments, governance maturity, and security posture. We identify ungoverned agents, map delegation chains, assess policy gaps, and deliver a prioritized roadmap. From there, engagements can progress into architecture, implementation, or ongoing advisory depending on your needs.

Question 12

Do you offer assessments or maturity evaluations?

Accepted Answer

Yes. Our governance maturity assessment maps your organization against a four-level model, from Level 0 (Unmanaged) to Level 3 (Governed). It identifies which of the 12 governance principles you have addressed, where gaps exist, and what to prioritize next. Most organizations discover they are at Level 0 or Level 1.

Question 13

Can you work with our existing IAM, PAM, and SIEM stack?

Accepted Answer

Yes. Agent Runtime Governance is designed to complement your existing security infrastructure, not replace it. We integrate with your IAM (Okta, Entra ID, Ping, etc.), PAM (CyberArk, Delinea, etc.), SIEM (Splunk, Sentinel, etc.), and policy engines. ARG adds the agent-specific runtime layer on top of what you already have.

Question 14

Do you build custom solutions or provide advisory only?

Accepted Answer

Both. We provide advisory and architecture services — assessment, strategy, and governance design — as well as hands-on implementation. Some engagements are purely advisory (helping your team build it). Others involve us building and deploying governance infrastructure directly. We tailor the engagement to your team and maturity level.

Question 15

What agent frameworks do you support?

Accepted Answer

Watchlight AI Beacon governs agents across the frameworks enterprises actually run, through drop-in plugins: LangGraph, Google ADK, AWS Bedrock Agents, MCP servers, the Microsoft Agent Framework, the Claude Agent SDK, and OpenClaw, plus custom and in-house agents. Coverage per framework varies by what its lifecycle exposes. The network-layer proxy is framework-agnostic: it governs every outbound request on the wire regardless of how the agent produced it, so enforcement is not coupled to any one orchestration tool.

Question 16

Does ARG require changes to our existing agent code?

Accepted Answer

Often not. Beacon enforces at two layers. A network-layer proxy governs every outbound request without agent code changes: agents make standard requests through it, and policy is evaluated on the wire. In-process plugins add semantic, plan-stage governance for supported frameworks with a drop-in install (a few configuration values, no rewrite). Deeper intent declaration and goal registration can be adopted incrementally.

Question 17

How does runtime policy enforcement work without adding latency?

Accepted Answer

Runtime policy evaluation is designed for production workloads and runs inline at the point of action. Policies are expressed in formal policy languages (not natural language) and evaluated by a purpose-built engine that selects the relevant policy subset for each request rather than scanning every policy. The overhead is designed to be comparable to an API gateway check.

Question 18

What is intent-based authorization?

Accepted Answer

Intent-based authorization shifts the question from "what can this agent access?" to "why is this agent taking this action?" Every agent declares its purpose (why it exists), goal (what it is trying to achieve, with scope and time limits), and intent (what it is doing right now). Authorization decisions evaluate all three against the requested action. An agent declaring "research" intent cannot perform a delete operation — the intent and action are inconsistent.

Question 19

What are delegation chains?

Accepted Answer

A delegation chain is the cryptographically verifiable trust path from the human who authorized an action through every agent in the execution path. When a user asks an orchestrator agent to generate a report, and that agent delegates to a data retrieval agent, the chain traces: Human → Orchestrator → Data Agent. At each link, scope can only narrow — a child agent never possesses more authority than its parent delegated. The chain is auditable end-to-end.

Question 20

How does ARG relate to NIST AI RMF, ISO 42001, and the EU AI Act?

Accepted Answer

ARG is complementary to these standards. NIST AI RMF provides organizational risk management. ISO 42001 provides management system requirements. The EU AI Act provides regulatory requirements. ARG provides the agent-specific prescriptive depth they lack — the concrete architectural patterns for identity, authorization, observability, secrets management, and multi-agent coordination that broader standards do not prescribe. Use them together: standards for compliance frameworks, ARG for implementation.

Question 21

Can ARG help us pass an AI-related audit?

Accepted Answer

Yes. ARG creates the evidence trail auditors need: which agent took which action, under what business objective, authorized by whom, evaluated against which policy, and what the outcome was. This is the data that NIST AI RMF, ISO 42001, and SOC 2 auditors are increasingly asking for — and that most organizations cannot provide today because they lack runtime governance infrastructure for their agents.

Question 22

How does ARG support SOC 2 or regulatory compliance?

Accepted Answer

SOC 2 requires demonstrable controls over system access, change management, and monitoring. ARG provides these controls for AI agents: verifiable identity and registry (access controls), runtime policy enforcement (change management), and behavioral observability with full audit trails (monitoring). For regulated industries, ARG also supports data governance requirements by ensuring agents only access data consistent with their declared purpose and approved goals.

Question 23

How do we know if we need Agent Runtime Governance?

Accepted Answer

If you are deploying AI agents that access enterprise systems, make autonomous decisions, delegate to other agents, or invoke tools dynamically — you need ARG. Ask yourself: Can you enumerate every agent in your environment? Can you explain why any agent took any action? Can you trace agent permissions back to a human decision? Can you stop a specific agent in under 30 seconds? If you cannot answer yes to all four, you have governance gaps that ARG addresses.

Question 24

What does a governance maturity assessment look like?

Accepted Answer

We conduct a structured evaluation. We inventory your AI agents, map their access patterns and delegation chains, assess your current governance controls against our 12-principle framework, score your maturity level (0–3), and deliver a prioritized roadmap with specific, actionable recommendations. The output is an executive-ready report and a detailed technical plan.

Question 25

Where can we read more?

Accepted Answer

Start with our pillar page on Agent Runtime Governance for the category definition. Then read our position paper "Why Agent Runtime Governance Is the Missing Layer in IAM" for the full argument. For the complete technical framework, download "12 Non-Negotiable Principles for Agent Runtime Governance." Our blog covers individual principles and topics in depth.

Frequently Asked Questions

Agent Runtime Governance

Watchlight AI

Services & Engagement

Technical & Architecture

Compliance & Standards

Getting Started

Ready to Govern Your AI Agents?

We value your privacy