Governing one AI agent, end to end
An organisation puts an agent to work on strategic questions — market entry, vendor selection, risk posture. Every governance product on the market can tell you what that agent did. Almost none can tell you whether its judgment was any good, and none of them can prove the record was not edited afterwards.
Below is one agent's call passing through five surfaces. Every block is verbatim output from a real run against a live database — about three seconds, no model calls, and you can run it yourself.
What this does that adjacent tools do not
Guide
What shapes the judgment before it exists?
The agent writes under an analytic-tradecraft contract derived from ICD 203, the US intelligence community's standard for analytic products: calibrated probability bands, facts separated from judgments, at least one alternative that would reverse the call, named assumptions, declared information gaps, and an explanation of what changed since the last assessment. A deterministic linter scores the output and returns machine-readable corrections. A judgment that does not meet the contract does not proceed.
Draft 1 (what an unguided agent produces): │ We should enter the Japanese market in H1 2027. It seems like a good │ opportunity and our models put the chance of hitting the year-one │ revenue target at 73.2%. The market is growing and competitors are │ distracted, so this is basically a sure thing if we move fast. ICD 203 Tradecraft Lint: 15/100 (FAIL) — 8 violations [error] No ICD 203 probability language detected [error] No fact-judgment distinction markers detected [warning] No assumptions explicitly identified [warning] No information gaps explicitly flagged [warning] No alternative explanations offered [warning] Overly precise probability: 73.2% [warning] No explicit source attribution detected [warning] No change-from-prior explanation detected ✗ BLOCKED at the guidance gate. Correction hint returned to the agent. Draft 2 (revised under the contract): ICD 203 Tradecraft Lint: 90/100 (PASS) — 1 warning
Govern
Who checks the checker?
A critic reviews the agent's call and returns FAIL. But the critic has a measured reliability score — built from a bias audit and, over time, from how often its verdicts were borne out. Below threshold, its verdict cannot act alone: the system escalates to a second judge from a different model family, takes consensus, and records the reliance decision with the reliability figure that applied at the time. The oversight decision is itself sealed. In production this is not hypothetical — the live critic currently sits well below the escalation threshold on its own measured record.
The primary critic reviews the judgment and returns: FAIL. But this critic has a MEASURED track record: judge=demo/agent-critic::exec reliability=0.550 (bias audit: severe self-preference, κ=0.31) Reliance controller: decision=escalate, needsEscalation=true ✓ An unreliable critic does not get to kill the judgment alone. Second judge (different model family): PASS. Consensus: decision=discount, effectiveVerdict=borderline reliance_decisions row persisted: id=840ae148-… ✓ oversight decision SEALED into the integrity spine: contentHash=71550d321f8b67cb57ca757d…
Record
What survives the meeting?
The decision, the action it requested, and the execution that followed are written to an append-only ledger. Each artifact is content-hashed on write and chained to the previous hash for that artifact. Hashes roll into a daily Merkle tree whose root is published to a public repository, so the timestamp does not depend on trusting the system that produced it. Each write also emits a CloudEvent, so an organisation's own GRC or SIEM stack can subscribe rather than integrate.
DecisionRecord: id=ffd86973-… decidedBy=agent:atlas/strategy-analyst
confidence=0.68
ActionRequest: id=37da2e92-… (prepare_japan_entry_plan)
ActionExecution: id=7411c181-… status=completed
✓ decision → action → execution chain closed and individually hashed.Outcome
Was the agent actually right?
This is the part the rest of the market does not do. The decision is scored against what happened, not against a rubric or a preference label. The observed outcome and the after-action review close the loop — and the result flows back into the reliability of the critic that vouched for the call. Note the restraint in the numbers below: after a single confirming outcome the critic's score does not move at all, because the estimator requires a minimum track record before outcomes are allowed to shift it. A governance system that lurched on n=1 would be worse than none.
OutcomeObservation: severity=positive
AfterActionReview: qualityScore=0.82
Outcome learning: vindicated=true
Critic reliability: 0.550 → 0.550 (trackN 0 → 1)
↑ deliberately unmoved: the blend requires n ≥ 5 before
outcomes outweigh the bias prior.
Agent decision ledger: 1 decision, closure rate 100%,
1 positive / 0 negative outcomes, mean AAR quality 0.82Verify
Why should an auditor believe any of it?
They should not have to. An auditor recomputes the content hash from the stored payload using nothing but a standard SHA-256 implementation, and compares it to the sealed record. The verifier used for evidence packs imports no code from this platform at all. Below, an edit to a single field after the fact — nudging the recorded confidence from 0.68 to 0.95 — is caught immediately, because the hash no longer matches.
Stored integrity record: updateSequence=0 stored contentHash = 965b087a72a4fcc4ec26934c800bc5e5f448b417c17400a0… recomputed (offline) = 965b087a72a4fcc4ec26934c800bc5e5f448b417c17400a0… ✓ hashes match — the stored decision is exactly what was logged. Tamper test — someone edits confidence 0.68 → 0.95 after the fact: tampered hash = f8f88c71e454ca342f179ae0bb0caac26aebd3ae0599b653… ✓ detected — hash no longer matches the sealed record.
What is real, and what is staged
The governance machinery is real production code and the database rows are real. The judgment inputs are authored, because what is being demonstrated is the governance, not the analysis.
- Real: the tradecraft linter and its scores; the reliability estimator and escalation controller; every hash, chain link and seal; the ledger writes; the outcome-learning update; the offline re-derivation and tamper detection.
- Staged: both drafts are written by hand rather than generated, and the critic's FAIL, the second judge's PASS, the bias-audit figures and the observed outcome are supplied as inputs. In production these come from model calls, a published bias audit, and automatic resolution against observed data.
- Inert here: event emission runs but reaches no subscribers in the demo workspace, and the daily Merkle roll-up and public anchoring happen on their own schedule rather than inside the three seconds.
Run it yourself
The walkthrough is a single script. It needs a database connection and nothing else — no model API key, because logging, scoring, sealing and verifying are hashing and arithmetic. It writes to an isolated demo workspace and is safe to re-run; each run appends a new decision to the ledger.
npx tsx scripts/demo/single-agent-governance-demo.ts
Governing agents that make judgment calls?
Tell us what your agent decides and we'll show you what the record would look like.