chapter nine

9 Governance: Constraints that enable freedom

 

This chapter covers

  • Deciding what your agent is allowed to do with Approval Gate risk-based routing
  • Bounding worst-case damage through Blast Radius Control and nested containment layers
  • Building trust through Progressive Commitment with staged verification and trust escalation
  • Making non-deterministic behavior debuggable with the Observability Harness
  • Upgrading Argus from capable reviewer to governed production system
  • Mapping governance controls and evidence to requirements
"Safety is a system property, not a component property."

— Nancy Leveson, Engineering a Safer World (2011)

By this point in the book, Argus can gather context, remember earlier reviews, reason about a change, call tools, reflect on its work, and collaborate with other agents. Each new capability makes the reviewer more useful. Each one also gives a mistake more ways to leave the model and change something outside it.

That is why governance arrives after capability. A system that can only suggest an action has little freedom and a limited blast radius. Once it can edit a repository, call an API, send a message, or delegate work, the practical question changes. We need to decide how much choice to hand over, what evidence must travel with that choice, and where the hard boundary remains.

9.1 What is governance? Autonomy without accountability is a liability

9.1.1 The governance spectrum

9.1.2 Constraints enable freedom

9.2 Pattern: Approval Gate

9.2.1 Risk classification and the approval ladder

9.2.2 Classifying action risk

9.2.3 In production: Claude Code's permission modes

9.2.4 Approval is a contract across time

9.2.5 Building it

9.2.6 When it breaks

9.3 Pattern: Blast Radius Control

9.3.1 Nested containment: Sandbox inside sandbox

9.3.2 Layer 1: Capability restriction (least privilege)

9.3.3 Layer 2: Execution isolation (sandboxing)

9.3.4 Layer 3: Damage limitation

9.3.5 Building it

9.3.6 When it breaks

9.4 Pattern: Progressive Commitment

9.4.1 Earning trust through evidence

9.4.2 Human sovereignty triggers

9.4.3 Enforcing the current trust boundary

9.4.4 A configured baseline and an earned trust level

9.4.5 Building it

9.4.6 When it breaks

9.5 Pattern: Observability Harness

9.5.1 Making the invisible visible