Amit Agarwal asked a question on Substack that most agent governance work skips: who governs the agent at runtime?
Pre-deployment review, model evaluation, red-teaming, and prompt engineering all happen before the agent acts. They are necessary, but the consequential moment comes later, when the agent is about to do something.
The runtime gap
Most governance today targets the model or the prompt. Guardrails constrain what the model can say. Evaluations measure whether the model behaves as expected under test conditions. Alignment research tries to make the model want the right things.
None of this governs what the agent does at runtime. An agent can receive a well-formed prompt, generate a reasonable response, and then execute a tool call that deletes production data. Prompt-level governance cannot intercept that call, because it happens downstream of the model’s output, where the agent meets its tools.
Where runtime governance should sit
A runtime governance layer can sit in one of two places.
Inside the agent’s process, as middleware in the agent’s framework, it shares the agent’s trust boundary. A compromised dependency, a sufficiently capable agent, or a malicious actor with access to the process can bypass it. Our NIST submission calls this the bypass-by-architecture problem.
Outside the agent’s process, at the network boundary and in a separate trust domain, the agent cannot reach it. Policy is evaluated deterministically against observable actions, and the evidence does not come from the agent.
Panopticore sits there. Out-of-process control is an old pattern; firewalls, reverse proxies, and external authentication services all use it. Panopticore is the first to combine enforcement at the network layer, in a separate trust boundary, with offline-verifiable cryptographic evidence.
What runtime governance produces
So the answer to “who governs the agent at runtime?” is an independent system that can answer three questions after the fact:
- What did the agent do?
- Which policies were in effect?
- Were those policies actually enforced?
Panopticore answers them with an Evidence Binder: a cryptographically signed, self-contained record that any third party can verify offline.
