An agent is not one thing. It is nine parts that each fail in a different way. Naming them separately is what makes governance tractable, because every part gets its own owner, its own control and its own evidence.
The bounded objective the agent accepts, with its success criteria, its scope limits and its stop conditions written down before it runs.
Fails as goal hijack, scope creep, silent objective drift.
The model-driven cycle that decomposes the goal, picks the next action, reads the result and revises. This is where cost, latency and loop risk live.
Fails as infinite loops, runaway spend, plan hallucination.
The component that decides what goes into the window on each turn: instructions, retrieved knowledge, tool schemas, prior state, and what gets compacted away.
Fails as context poisoning, stale grounding, token bloat.
Working state within a task, plus durable memory across tasks. Both need a retention policy, a scope boundary and a way to correct or delete an entry.
Fails as memory poisoning, cross-tenant leakage, un-deletable personal data.
Every capability that touches the outside world: read APIs, write APIs, code execution, file access, payments. Each one is a separate permission and a separate blast radius.
Fails as tool misuse, excessive privilege, unexpected code execution.
A registered identity for the agent, the human or system accountable for it, and the credential it acts under. Delegated authority is explicit and time-bound.
Fails as privilege abuse, orphaned agents, confused-deputy attacks.
The runtime gate that sits between intent and action. It evaluates who is asking, what they are asking for, against which data, and either allows, blocks, redacts or escalates.
Fails as policy bypass, advisory-only controls, prompt-level enforcement.
Structured traces of every step, decision, tool call and token, written to an append-only record that can answer "what did this agent do and why" months later.
Fails as unexplainable outcomes, failed audits, unreproducible incidents.
Approve, pause, take over, roll back, shut down. If a person cannot do all five within seconds, the agent is not ready for anything that matters.
Fails as no kill switch, approval fatigue, trust exploitation.
If you are standing up an agent platform, tightening the controls on one you already have, or preparing for an audit that now includes agents, I am happy to look at it with you.
Tell me where you are with agents and what you are trying to make safe. I reply to every enquiry within two business days.
