Pillar — Agent Governance

Prefix: AGV- Catalog: v1.1 (new pillar). What it measures: the contract between agent autonomy and human intent — policy-as-code, approval gates, and explicit bounds on what an agent may change, merge, or deploy unattended.

Without governance, agent-driven delivery is unbounded authority. This pillar is how an organization states, in artifacts an assessor can read, where the agent stops and a human starts. There is no v1.0 AGV catalog; IDs in the AGV-1xx band are the first published criteria for this dimension.

Criteria in this pillar

AGV-100 — Autonomy bounds published

Level: 2 · Scope: portfolio · Check: deterministic
The portfolio publishes a machine-readable policy stating which paths and actions (edit, merge, deploy, secret read, production write) an agent may perform unattended. Each application in the subject is covered, or is listed as an owned exception. Absence of a bound is not an implicit grant.
Rationale: an agent given a repository and a token will use both. Bounds that live only in chat are not a contract an assessor — or the next agent — can read.
Evidence expected: a committed policy file, ruleset, or equivalent structured record; actions and path (or application) scopes enumerated; default-deny or an explicit default stated; exception list owned.

AGV-110 — Privileged actions require an approval gate

Level: 3 · Scope: application · Check: deterministic
Merge to a production-shipping ref, production deploy, and use of secrets or long-lived credentials require a recorded approval — a human review, a named policy exception, or a two-party check. An agent MUST NOT be the only actor on those actions unless AGV-100 explicitly allows that action on that path.
Rationale: autonomy without a gate on merge, deploy, and secrets is production write access with extra steps. The gate is how a human remains in the loop for blast-radius actions.
Evidence expected: branch protection, deploy approval, or equivalent on the production-shipping ref; secret use is not available to the unattended identity without the gate; a sample of recent privileged actions shows the recorded approval.

AGV-120 — Policy-as-code enforced in the pipeline

Level: 4 · Scope: repository · Check: deterministic
Autonomy bounds (AGV-100) are enforced in CI or the merge and deploy pipeline, not only documented. A change or action that exceeds the bound fails the job. A wiki policy with no failing check does not satisfy this criterion.
Rationale: documentation is advice. Agents follow the pipeline. Policy that cannot fail a job cannot bound an unattended operator.
Evidence expected: a pipeline job or required check that evaluates the bound; a failing fixture or recorded incident where an out-of-bound action was blocked; the check is required on the production-shipping ref.

AGV-130 — Agent identity is distinct and attributable

Level: 4 · Scope: repository · Check: deterministic
Agents act under a named identity distinct from any human personal account. Commits, merges, deploys, and tool calls that the agent performs record that identity. Shared human tokens, forwarded personal credentials, or an anonymous bot account used by several agents do not satisfy this criterion.
Rationale: when something merges at 03:00, the first question is "who". If the actor is a person's token, governance cannot tell agent action from human action, and revocation hits the wrong principal.
Evidence expected: a named machine or workload identity per agent (or per agent class); audit or SCM records showing that identity on agent-authored commits and deploys; human personal tokens absent from unattended paths.

AGV-140 — Portfolio exception register

Level: 4 · Scope: portfolio · Check: manual
Exceptions to autonomy bounds are enumerated per application, owned, and time-bounded. A newly added application inherits the published default (deny, unless AGV-100 states otherwise) within one review cadence or is marked not_applicable with a one-line justification. An unbounded "just this application" carve-out does not satisfy this criterion.
Rationale: portfolio scoring (CSPC-31) fails closed when one slice is exempt forever. The exception list is how an assessor sees where the agent is still unbounded.
Evidence expected: a committed exception register; owner and expiry (or review date) on each entry; k/n applications under the default bound; cadence stated.

v1.1 pillars — draft catalog, including these AGV-1xx criteria.
Cost & FinOps — spend ceilings an unattended operator must honour.
v1.0 specification — the published standard.

Criteria in this pillar

Level: 2 · Scope: portfolio · Check: deterministic

The portfolio publishes a machine-readable policy stating which paths and actions (edit, merge, deploy, secret read, production write) an agent may perform unattended. Each application in the subject is covered, or is listed as an owned exception. Absence of a bound is not an implicit grant.

Rationale: an agent given a repository and a token will use both. Bounds that live only in chat are not a contract an assessor — or the next agent — can read.

Evidence expected: a committed policy file, ruleset, or equivalent structured record; actions and path (or application) scopes enumerated; default-deny or an explicit default stated; exception list owned.

Level: 3 · Scope: application · Check: deterministic

Merge to a production-shipping ref, production deploy, and use of secrets or long-lived credentials require a recorded approval — a human review, a named policy exception, or a two-party check. An agent MUST NOT be the only actor on those actions unless AGV-100 explicitly allows that action on that path.

Rationale: autonomy without a gate on merge, deploy, and secrets is production write access with extra steps. The gate is how a human remains in the loop for blast-radius actions.

Evidence expected: branch protection, deploy approval, or equivalent on the production-shipping ref; secret use is not available to the unattended identity without the gate; a sample of recent privileged actions shows the recorded approval.

Level: 4 · Scope: repository · Check: deterministic

Autonomy bounds (AGV-100) are enforced in CI or the merge and deploy pipeline, not only documented. A change or action that exceeds the bound fails the job. A wiki policy with no failing check does not satisfy this criterion.

Rationale: documentation is advice. Agents follow the pipeline. Policy that cannot fail a job cannot bound an unattended operator.

Evidence expected: a pipeline job or required check that evaluates the bound; a failing fixture or recorded incident where an out-of-bound action was blocked; the check is required on the production-shipping ref.

Level: 4 · Scope: repository · Check: deterministic

Agents act under a named identity distinct from any human personal account. Commits, merges, deploys, and tool calls that the agent performs record that identity. Shared human tokens, forwarded personal credentials, or an anonymous bot account used by several agents do not satisfy this criterion.

Rationale: when something merges at 03:00, the first question is "who". If the actor is a person's token, governance cannot tell agent action from human action, and revocation hits the wrong principal.

Evidence expected: a named machine or workload identity per agent (or per agent class); audit or SCM records showing that identity on agent-authored commits and deploys; human personal tokens absent from unattended paths.

Level: 4 · Scope: portfolio · Check: manual

Exceptions to autonomy bounds are enumerated per application, owned, and time-bounded. A newly added application inherits the published default (deny, unless AGV-100 states otherwise) within one review cadence or is marked not_applicable with a one-line justification. An unbounded "just this application" carve-out does not satisfy this criterion.

Rationale: portfolio scoring (CSPC-31) fails closed when one slice is exempt forever. The exception list is how an assessor sees where the agent is still unbounded.

Evidence expected: a committed exception register; owner and expiry (or review date) on each entry; k/n applications under the default bound; cadence stated.