Agents · Compliance · Draft
How to make an AI World work and stay compliant
Give one agent a task and you can read what it did. Give twenty agents long-running loops, several hosts and a handful of people who must stay in charge, and nobody can read everything. The world holds together only if three things are true: every action is gated, every agent is isolated, and every step leaves evidence.
The good news: these are the same building blocks. The controls that make such a world work are the evidence a compliance auditor asks to see. Compliance is not a second system on top.
One rule, four layers
Every layer assumes the layer above it can be wrong, and limits what a mistake can reach.
- People own the decisions: they approve merges, set scope and accept risk.
- Agents do the work in separate loops with measurable progress rules.
- Hosts and platforms are designed to be small, isolated and allow-listed: no inbound port, signed messages.
- Evidence: every step leaves a record that someone else can follow.
Making it work: hard controls, not good intentions
Core and instances. One shared core repository; each organisation gets its own instance. Work arrives branch by branch, so nothing changes in place.
Independent review gates. A reviewer is bound to the exact commit it reviewed, so what was reviewed is what ships. A marker scan blocks organisation data from leaking into the shared core. The owner approves the merge.
A tiny host agent (a design, not yet in use). It would contain no model. It would run only allow-listed commands over git and signed messages, and listen on no inbound port. A manipulated agent would find almost nothing to reach.
Four loops against drift. Long autonomous work wanders. Separate loops, each with a measurable progress rule, keep it on track.
A map of the world. A zoned, clickable overview of agents, hosts and platforms is in development.
Heavy jobs one at a time. Serialising expensive work keeps shared resources predictable.
What is gated and what is only logged
Saying every action is gated would be wrong, and it would not work. The gates are placed by kind of action.
Gated, with a person deciding:
- anything that changes the shared core,
- anything that goes outward, such as posting, following, replying or sending,
- changes to credentials, to permissions or to allow-lists,
- any step that needs a secret.
Only logged, with no one waiting:
- reading and searching,
- drafting in local files,
- analysis, notes and reports.
The log is reviewed afterwards. Reads and drafts are cheap to undo, so they stay free; the gate is kept for what is hard to take back.
A limit: approval fatigue. If everything asks for approval, people stop reading what they approve and click through. A gate that is always open protects nothing. The remedy is fewer, clearer gates, placed by risk, each showing the exact thing being approved, with the rest left to the log.
Making it compliant: the same controls, read as evidence
| Building block | What it evidences | Framework hooks (indicative) |
|---|---|---|
| Owner-approved merge | A human decides before change goes live | ISO 27001 change management; EU AI Act human oversight (high-risk systems); NIST AI RMF Govern |
| Independent review bound to a commit | Separation of duties; reviewed equals shipped | ISO 27001 secure development; SOC 2 change management |
| Isolation and allow-lists | Least privilege; limited blast radius | ISO 27001 access control and configuration management; SOC 2 logical access |
| Signed messages and logs | Who did what, when | ISO 27001 logging; EU AI Act record-keeping (high-risk systems) |
| Risk register and task tracking | Known risks have owners and dates | ISO 27001 risk treatment; ISO/IEC 42001; NIST AI RMF Map and Manage |
| Readiness tracking | Gaps against the EU AI Act and Cyber Resilience Act are visible early | EU AI Act; EU Cyber Resilience Act |
These hooks are indicative, not a certification claim or legal advice.
How to start: five steps
- Map it. List every agent, host and platform, and what each can touch. You cannot govern what you cannot see.
- Isolate it. Limited credentials, sandboxes, allow-lists. Assume any agent can be wrong or manipulated.
- Gate it. Independent review and an owner approval before anything leaves the sandbox.
- Record it. Make evidence a by-product: signed messages, commit-bound reviews, task history.
- Map to frameworks. Link each control to the expectation it answers, track readiness, and review on a rhythm.