Enterprises must govern autonomous AI agents at runtime, not just at build-time: five irreducible primitives—discovery, identity, governance, attestation and supply-chain provenance—are required to bound agent authority and provide verifiable evidence. Implementing them works (four primitives in private pilots) but costs per-request latency, a sidecar per workload, and turns some availability failures into explicit denials.

Main Finding

Governing autonomous AI agents is primarily a runtime problem that requires five irreducible primitives — Discovery, Identity, Governance, Attestation, and Supply Chain — each with distinct trust models, failure modes and timescales. The paper argues and demonstrates an architecture that enforces policy at request time (deny-by-default), authenticates ephemeral agent principals via workload attestation, writes verifiable audit records to a signed, hash-linked ledger that customers can independently verify, and treats supply-chain provenance as a cross-cutting (between-requests) condition. Four primitives are implemented and running in private pilots; the supply-chain primitive exists as separate tooling and is not yet in the request path.

Key Points

• The problem framing

  • Agents differ from humans and long-lived services: they are ephemeral, choose actions at runtime (model-selected), and are discovered (anyone can instantiate one via an API). These properties make pre-deployment controls insufficient.
  • Runtime governance is distinct from model-alignment or build-time controls: you still need to bound authority and record decisions even for a "perfectly aligned" model.

• The five primitives (derived from the sequence of questions to permit an action and to prove it later)

• Discovery — Does this agent exist and what is it attempting? - Two halves: population discovery (enumeration, scanning) and capability discovery (an unrecognised attempted action signals missing policy). - Design rules: aggregate (upsert) rather than append per-attempt; record names, never values (avoid retaining unanalyzed data); discovery must be observability-only (must not be able to deny requests).
• Identity — What is it, provably? - Use attestation-based workload identity: observe immutable workload properties and issue short-lived credentials; present identity at the transport layer (mTLS), not as a payload header. - Multiple vocabularies (storage, audit, policy) with canonical mappings; avoid storing derivable identifiers unnecessarily.
• Governance — May it do this (decided before effect)? - Mediator sits on request path; deny-by-default; action vocabulary must be per-tenant and extensible (vendor cannot enumerate all agent actions). - Definitions must be immutably versioned so past audit records remain meaningful. - Disclosure (which fields are visible to policy) is a separate decision from authorisation and must be handled deliberately. - Kill switch consulted on each authorisation to stop running agents quickly (imposes strict latency/efficiency constraints).
• Attestation — What happened, in a form others can check? - Every authorisation decision is written to an append-only, hash-linked ledger, canonicalised and signed by per-tenant keys (never exported). - Verification must be possible out-of-band (vendor-out-of-loop) so customers can independently answer disputes. - Exports must conservatively indicate completeness; errors in completeness must default to “false.”

• Supply Chain — What is the agent made of, and has that changed? - Cross-cutting, operates between requests: provenance at deploy-time conditions future requests but can be invalidated by changes (pulled tags, transitive dependency updates, model endpoint changes, prompt/tool changes). - Without this, a compromised dependency can make all other primitives attest to a compromised-but-authentic-seeming agent.

• Implementation & operational costs / trade-offs

  • Enforcement sits on the request critical path → adds latency and converts some availability incidents into authorization denials.
  • Identity requires a sidecar or equivalent per workload.
  • Deny-by-default plus discovery via refused attempts makes the governance loop self-updating but requires operator action to define new action types.
  • Attestation with vendor-out-of-loop verification reduces trust in the vendor but requires customer-side verification tooling and clearly specified export windows.
  • Four primitives are implemented and running in private pilots; supply-chain tooling is built but not yet integrated in the request flow.

• What this is not

  • Not an empirical evaluation of outcomes. The paper reports design rationale, architecture, implementation status and honest failure modes rather than deployment-wide metrics.

Data & Methods

• Method: conceptual derivation plus system design. The five primitives are derived from an analysis of the necessary questions that must be answered before an action takes effect and afterwards for auditability. The authors argue necessity and separability by examining what fails if any primitive is absent.
• System architecture / components described and prototyped:
  • Agent-side sidecar for workload credential acquisition and presenting identity over mTLS.
  • Management server running: mediator (policy evaluation + action catalog), attestation factory and verifier.
  • Identity plane implementing attestation-based workload identity (short-lived credentials).
  • Append-only, hash-linked ledger (relational DB holding chain) with per-tenant signing keys in a KMS; exportable evidence packages for independent verification.
  • Discovery tooling: implemented as a library (scanning code, manifests, network behaviour) but not fully integrated; capability discovery is in the live mediation path.
• Implementation status: four primitives (Discovery [capability discovery], Identity, Governance, Attestation) are built and running in private pilots. Supply-chain primitive (comprehensive provenance checking, BOM-style tooling) exists as separate tooling but is not yet in the request path.
• Evaluation: no cross-deployment empirical outcomes presented. The account is design-plus-implementation and an honest reporting of failure modes and operational costs. Appendix traces one end-to-end action through the four built primitives and notes what supply-chain integration would add.

Implications for AI Economics

• Risk allocation and moral hazard
  • Independent attestation and vendor-out-of-loop verification reduce information asymmetries between customers and providers. This should lower providers’ unilateral ability to conceal incidents and reduce moral hazard, but it increases upfront compliance and operational costs for customers (verification tooling, handling denials).
• Compliance, liability and insurance markets
  • Verifiable, tamper-evident attestation records enable clearer liability assignments and drive demand for new insurance products around agent misbehavior and supply-chain compromise. Insurers and regulators can rely on independent evidence packages, making pricing and compliance enforcement more tractable.
• Costs of adoption and concentration effects
  • The architecture imposes non-trivial fixed and operational costs (sidecars per workload, added latency, deny-by-default operational overhead). Larger platforms and vendors may absorb these costs more easily, potentially increasing vendor lock-in or platform concentration unless standards/interoperability reduce integration friction.
• Productivity vs. transaction costs
  • Runtime governance enables safer deployment of autonomous agents, potentially accelerating automation and productivity gains. However, the transaction costs of defining per-tenant action vocabularies, handling discovery-driven policy updates, and verifying evidence may slow iteration and raise marginal costs of deploying new agent behaviors.
• Market for attestations and provenance
  • The supply-chain primitive (provenance, BOMs for agentic systems) creates an information good with economic value. Markets can emerge for third-party provenance attestations, certified components, or trusted registries of model/tool provenance. Such markets change pricing power (trusted components can command a premium).
• Externalities and social welfare
  • Fail-closed mediation turns certain availability incidents into denials, creating negative externalities (downtime, lost functionality). Firms and regulators will need to balance safety against availability; this trade-off can influence sector-level resilience and social welfare calculations when autonomous agents are used in critical domains (finance, healthcare).
• Incentives for standardization
  • Per-tenant, vendor-authored action vocabularies and custom discovery mechanisms risk fragmentation. Standards for action vocabularies, attestation formats and export windows would lower coordination costs, reduce lock-in, and enable interoperable verification ecosystems (improving market efficiency).
• Competitive advantage and product differentiation
  • Firms that offer robust, low-latency governance stacks, easy supply-chain integration, and user-friendly independent verification will have a competitive edge. Conversely, vendors that impede independent verification face reputational and regulatory risks.
• Labor and organizational impacts
  • The governance loop (attempt → refused → visible → define → governable) institutionalizes an operator burden for defining behaviors and authorising new actions. This creates new operational roles and labor demand (policy authors, verifiers), altering the division of labor between humans and automation.
• Regulatory implications
  • Verifiable attestation and independent verification can enable more practical enforcement of auditability and reporting requirements. Regulators may mandate aspects of these primitives (e.g., independent attestability, provenance reporting), which would reshape compliance costs across firms.

Overall, the paper identifies a concrete, implementable stack for making autonomous agents governable at runtime and highlights the trade-offs. For AI economics, the architecture changes information flows, shifts compliance costs, creates new market opportunities (attestations, provenance services, verification tooling), and affects market structure through fixed-cost and standardization dynamics.