Governed Runtime Standards · Specification 3 of 3
Governed Runtime Profile
"Governed" is an unregulated word. Any runtime that executes AI agents can claim it. This profile defines what the word has to mean for the claim to be checkable: twelve guarantees about attribution, effects, approval, policy, failure, control, isolation, models and integrity, in three conformance levels, with the evidence a reviewer can ask for and a procedure to test a claim in an afternoon.
Why a profile
An organisation adopting AI agents has to answer to an audit committee, a regulator or its own board for what those agents do. It cannot do that by reading vendor marketing. It needs a short, fixed list of properties it can put in a procurement questionnaire, test in a proof of concept, and hold a vendor to in a contract. This profile is that list.
Put differently: if an AI operating system is the layer that lets agents act on real systems, this profile is the set of kernel guarantees that layer must provide before anyone should let it act. It is the companion of the Action Provenance Record (what happened) and the Action Approval Attestation (what was permitted). Those specify documents. This one specifies the runtime that produces them.
The twelve guarantees
Attribution
Every action is attributable to a principal, and where an agent acted, to the agent and the model. Impersonation and delegation are recorded as such, never hidden.
Evidence: provenance records at Level 1 for a sample of actions.
Provenance
The runtime produces an Action Provenance Record for every action, on every plan or tier, retained for a period the tenant controls.
Evidence: the retention setting; records for a chosen day; an export.
Effect classification
Every tool is classified read or write before it can be used, and the classification is recorded in every effect entry. Unclassified tools are treated as write.
Evidence: the tool registry with classifications.
Approval gate
No side-effecting action executes without a covering Action Approval Attestation from a human, or an auto grant under a policy the tenant configured. Coverage is evaluated immediately before execution.
Evidence: attempt a write without approval; observe that it is held, not executed.
Versioned policy
Every action is evaluated against a policy identified by reference and version, and the verdict is recorded. Policy changes are attributable.
Evidence: the policy history; a record showing policy ref and version.
Fail closed
When policy evaluation is unavailable, degraded or times out, side-effecting actions are blocked, not bypassed. Read-only work may continue. The outcome is recorded as blocked.
Evidence: stall the policy service in a test tenant; observe that writes stop.
Kill switch
A tenant administrator can halt all agent execution immediately, effective before the next side-effecting action, without vendor intervention.
Evidence: engage it; observe in-flight work stopping.
Autonomy levels
A defined scale of agent autonomy and an organisation-wide cap. The effective level of any agent is the lesser of what it is configured for and what the organisation allows.
Evidence: set the cap to approve; observe that an auto-configured agent is held for approval.
Tenant isolation
Records, policies, approvals, agents and connected credentials are scoped to a tenant. No request reads or writes another tenant's data. Platform-level administrative access is itself recorded.
Evidence: the data model; a penetration test finding on cross-tenant access.
Model control
The resolved model and provider are recorded for every action, and the tenant can restrict which models and providers its agents may use, including only models it hosts or licenses itself.
Evidence: the model allow-list; a record's model member.
Integrity
Records are sealed at Action Provenance Record Level 3 and chained per tenant. The tenant can export records and verify them offline.
Evidence: an export; an independent verification of its chain.
Least privilege
An agent receives only the tools and connections it has been granted and cannot acquire more at run time. Grants are attributable.
Evidence: an agent's grant list; an attempt to use an ungranted tool.
Autonomy levels
| Level | Meaning |
|---|---|
| observe | The agent produces analysis only; no tool calls. |
| suggest | The agent may call read tools and propose writes; it never executes a write. |
| approve | The agent executes writes only under a covering approval. |
| auto | The agent executes writes under policy-granted auto approvals, within the organisation's cap. |
Conformance levels
| Level | Name | Guarantees |
|---|---|---|
| 1 | Attributable runtime | GR-1, GR-2, GR-3, GR-9, GR-10 |
| 2 | Governed runtime | Level 1 plus GR-4, GR-5, GR-6, GR-7, GR-8, GR-12 |
| 3 | Verifiable runtime | Level 2 plus GR-11 |
Conformance statement
A runtime claiming conformance publishes a statement in this form. Reviewers should test it against the guarantees rather than accept it.
{
"spec": "governed-runtime/1.0",
"runtime": { "name": "Example Runtime", "version": "4.2", "vendor": "Example Pty Ltd" },
"level": 3,
"guarantees": { "GR-1": "yes", "GR-2": "yes", "GR-3": "yes", "GR-4": "yes",
"GR-5": "yes", "GR-6": "yes, Enterprise plan", "GR-7": "yes",
"GR-8": "yes", "GR-9": "yes", "GR-10": "yes", "GR-11": "yes", "GR-12": "yes" },
"records": { "provenance": "action-provenance/1.0 Level 3", "approval": "action-approval/1.0 Level 3" },
"statedAt": "2026-09-02",
"evidence": "https://example.com/trust/governed-runtime"
}
How to audit a claim in an afternoon
- Ask for the conformance statement and the tool registry (GR-3).
- In a test tenant, attempt one write without approval (GR-4) and one write with the policy service stalled (GR-6).
- Engage the kill switch during a running job (GR-7).
- Lower the autonomy cap and rerun an auto agent (GR-8).
- Export a day of records and verify the chain with the reference implementation (GR-11).
- Read three records end to end and confirm every member the level requires is present (GR-1, GR-2, GR-5, GR-10).
If any step fails, the runtime is not at the level it claims, whatever the marketing says.
Relationship to other frameworks
This profile does not replace security frameworks. ISO/IEC 42001 asks an organisation to manage AI responsibly; this profile tells it what its runtime must guarantee so that management is possible. NIST AI RMF's Govern and Manage functions map to GR-5, GR-7 and GR-8. The Australian Government's Policy for the responsible use of AI in government requires accountable officials and records of AI use; GR-1, GR-2 and GR-11 are what make those records exist and hold. Platform security controls such as the ISM and the Essential Eight apply underneath the runtime and are out of scope here.
Conformance statement for Renly
Renly conforms at Level 3. Every guarantee is implemented on all plans with one stated exception: GR-6 fail-closed semantic policy evaluation is an Enterprise plan capability; structural policy gates fail closed on every plan. Renly's autonomy scale is suggest, approve and auto with an organisation-wide cap, plus a finer-grained scale for coding agents. The full statement is on the standards page.