PALO FRAMEWORKAgentic Governance Modality
From Model Governance to Delegated-Action Governance
PALO-AM is the agentic governance modality inside the PALO Framework. It is distinct from the PALO-AI runtime. It defines the identity, delegated authority, autonomy, oversight, reversibility and assurance model for AI systems that select tools, write to systems, trigger workflows and act on behalf of the organization.
The Governance Shift
Model governance asks whether the model behaves responsibly. Delegated-action governance asks whether the authority delegated to the system has been justified, bounded, monitored and evidenced.
Model Governance
Does the model behave responsibly? Accuracy, bias, explainability, robustness, privacy, data lineage, output safety.
Delegated-Action Governance
Is the delegated authority justified, bounded, monitored and evidenced? Identity, permissions, tools, memory, autonomy, checkpoints.
A hallucinated sentence can mislead. A hallucinated tool call can alter a customer record, leak sensitive data, trigger a transaction or damage an operational environment.
PALO-AM Simulator
Route a delegated-action configuration to a governance tier and a practical control, evidence, and KPI/KRI starting set. Results are educational governance support, not legal advice, certification, or a compliance determination.
Controls
Evidence
KPI / KRI
This result is a transparent routing aid. It does not decide whether a use case is lawful, prohibited, compliant, certified, or acceptable to a specific organization.
Developer-preview contract & approval viewer
Demonstrates profile, decision and approval exchange in Web and mobile clients. It is not a production authorization interface.
No runtime contract loaded.
Developer preview: the online endpoint is Internet-reachable but is not production-ready. Its bearer token is only a coarse developer control and does not authenticate an accountable reviewer or separate administrative roles. Use isolated test data and non-consequential tools. For a local evaluation, replace the URL with http://127.0.0.1:8787.
Five Operational Object Cards
Each object is a governance domain that can be documented, implemented, tested and audited. Together they translate PALO-AM from a concept into a working operational model.
Agent Identity Profile
Defines who or what the agent is inside the enterprise environment. Records the agent identifier, cryptographic provenance, accountable human owner, business unit, topology, credential lifecycle, data clearance and revocation procedure. Eliminates anonymous or shared AI execution contexts and provides the basis for attribution.
Agent Authority Profile
Defines what the agent may do. Lists permitted tools, environments, data classes, read/write/delete privileges, financial thresholds, approval requirements, external endpoints, multi-agent coordination rules and abort conditions. The enforceable contract between the business and the agentic system.
Agentic Risk Matrix
Determines the risk tier by examining action-space impact, autonomy level, reversibility, data sensitivity, third-party dependency, speed/volume and multi-agent complexity. Acts as the routing mechanism for required controls and decision gates.
Agentic Control Layer
Implements structural safeguards around the agent: policy-as-code, API gateway constraints, token scopes, rate limits, schema validation, tool allow-lists, sandboxing, circuit breakers, human checkpoints and change-management rules.
Agentic Evidence Layer
Captures auditable execution evidence without relying on private model chain-of-thought: planning artifacts, tool calls, structured inputs/outputs, policy decisions, human approvals, overrides, anomalies, incidents, KPI values and decommissioning proofs.
Engineering Control Layer
PALO-AM treats governance as an enforceable architecture, not a policy statement. The language model is treated as an untrusted reasoning engine for purposes of authority. The model may propose an action; the orchestration layer decides whether it is allowed.
Why Prompt-Layer Safeguards Are Insufficient
A prompt instruction such as "do not access confidential data" is not equivalent to an access control. It can be misunderstood, bypassed, or contradicted. In agentic systems, the consequence is not merely an unsafe response - it may be an unauthorized action.
Cryptographic Identity & Zero-Trust
Every agent execution must carry a verifiable identity. Tool calls must include signed identity headers. Credentials must be short-lived, rotated and centrally managed. No agent may share credentials with another agent or a human user.
Tool Allow-Lists & Schema Validation
Agents may only call tools explicitly listed in their Authority Profile. Each tool call must conform to a validated schema. Unrecognized tool calls must be blocked at the orchestration layer before execution.
Human-in-the-Loop Checkpoints (HITL)
Human checkpoints must be designed structurally, not optionally. High-stakes or irreversible actions require explicit human approval via a decision packet - not a vague approval button. Approval telemetry must be measured against the Automation Bias Index (ABI).
Circuit Breakers & Abort Conditions
Each agent must have defined safe-state, rollback path and stop conditions. Circuit breakers must interrupt cascading failures in multi-agent topologies. Abort conditions must be tested in Phase 3 and validated against the CECR metric in Phase 4.
OpenTelemetry Observability
All tool calls, approval events, policy decisions and anomalies must feed into a tamper-evident audit endpoint (SIEM, OpenTelemetry collector or governance dashboard). Evidence must be structured and machine-readable for KPI measurement.
Action-Space vs Autonomy Matrix
The primary PALO-AM routing instrument. Examines two dimensions: what can the agent change (action-space impact) and how independently can it decide (autonomy level). Any increase in autonomy or action-space after approval triggers Phase 2 reassessment.
Scroll horizontally to inspect all matrix columns →
(read-only, reversible)
(internal write)
(cross-system)
(financial/safety/legal)
PALO Five-Phase Lifecycle Overlay
PALO-AM does not create a parallel lifecycle. It overlays agentic controls onto the existing PALO five-phase architecture. Governance is embedded across the full system lifecycle, not concentrated at a single checkpoint.
Ideation & Agentic Screening
Could a deterministic workflow, conventional automation or human-controlled assistant achieve the same value with lower risk?
Assessment & Planning
Complete Agent Identity Profile, Agent Authority Profile, AI System Impact Assessment, threat model, HITL design and KPI framework.
Development & Validation
Tool schema validation, sandbox tests, agentic red-team report, policy-as-code bundle and control test evidence.
Ethical Deployment & Monitoring
Shadow-mode, phased rollout, runtime monitoring dashboard, incident playbook, override telemetry and KPI baseline.
Continuous Improvement & Decommissioning
Tradecraft audit, credential revocation log, memory retention/deletion record and decommissioning certificate.
KPI / KRI Registry for Agentic AI
PALO-AM extends the PALO KPI compendium with indicators specific to delegated action. The goal: measure whether the organization can bound, observe, interrupt, recover from and retire autonomous behavior.
Scroll horizontally to inspect all registry columns →
| Metric | Category | Measurement | Governance Rationale | Phase |
|---|---|---|---|---|
| Human Override Rate (HOR) | Oversight | Overrides / total action checkpoints | Detects rubber-stamping or unusual intervention patterns. | 4 |
| Review-Time Distribution (RTD) | Oversight | Median and distribution of review time by action complexity | Flags superficial validation or alert fatigue. | 4 |
| Automation Bias Index (ABI) | Behavioral | Composite of approval speed, rationale quality, dismissal clustering | Measures whether human oversight remains meaningful. | 4/5 |
| Tool Call Error Rate (TCER) | Technical | Malformed + hallucinated + unauthorized calls / total calls | Detects semantic misalignment, poor schemas or tool-use drift. | 3/4 |
| Agent Identity Sprawl Index (AISI) | Security | Unregistered identities / total detected identities | Detects shadow agents, rogue subprocesses or unmanaged credentials. | 4/5 |
| Multi-Agent Conflict Rate (MACR) | Systemic | Terminated/deadlocked workflows / total multi-agent runs | Detects goal conflict, message loops or coordination failure. | 3/4 |
| Mean Time to Intervention (MTTI) | Response | Time from anomaly detection to human or automated intervention | Measures whether control is operationally real. | 4 |
| Cascading Error Containment Rate (CECR) | Systemic | Contained cascade events / total cascade events | Shows whether circuit breakers stop downstream propagation. | 3/4 |
| Agent Identity Revocation Time (AIRT) | Decommission | Time from decommission trigger to confirmed credential revocation | Validates retirement and shadow-agent prevention. | 5 |
| Tradecraft Degradation Score (TDS) | Human Agency | Score from manual drills, fallback proficiency and skill-retention audits | Measures human resilience and dependency risk. | 4/5 |
| Policy Violation Rate per 1k Actions (PVR) | Governance | Violations of authority, data classification or compliance boundaries / 1,000 actions | Signals control design failure or misuse. | 4 |
No single metric is decisive. Interpret HOR, RTD, ABI and sampled audit results as a pattern, not in isolation.
Worked Scenarios
Concrete examples of PALO-AM applied to real enterprise agent configurations. Each shows the same pattern: define identity, bound authority, score risk, design controls, capture evidence, plan decommissioning.
Software Engineering Agent
Inspects repository issues, writes code to non-protected branches, runs tests and opens pull requests.
Controls: Restrict write to non-protected branches; deny secret access; require human approval for PR creation; log diffs, tests, tool calls and failed access attempts.
Procurement Vendor Shortlisting Agent
Analyzes supplier proposals, ranks vendors and prepares negotiation questions.
Controls: Separate ranking from final decision; audit fairness signals; prohibit direct vendor communication without approval; preserve scoring rationale and conflict-of-interest checks.
Finance Payment Recommendation Agent
Reads invoices, detects anomalies and recommends payment release.
Controls: Read-only invoice access; no direct payment execution; dual approval for thresholds; anomaly escalation; strict evidence logging and revocation tests.
Customer Support Refund Agent
Retrieves order status, drafts refund recommendations, sends support summaries, requests human approval.
Controls: Denied: refund execution above EUR 50; modification of customer master data; access to payment card data. HITL checkpoints for any refund above EUR 50, legal threats, vulnerable-customer flags.
PALO Agentic Interface (PALO-AI)
Developer-preview contracts and reference components for exploring governance of autonomous agents and agent teams.
Modality A: Hierarchical Subagents, Prototype
Parent-child contract: The preview models identities, authority limits, delegation depth, subagent count and parent metadata. Trusted spawning, lineage verification and evidence handback are not complete.
- Identity & Authority checks: Hashes the subagent's prompt and verifies allowed tools.
- Reference evidence: The prototype can redact and HMAC-sign records with developer-supplied server-side key material.
- Missing production controls: Parent authority, spawning, exactly-once execution and evidence handback require further implementation.
Modality B: Collaborative Agent Teams, Specified
Proposed P2P Task Claims: This release documents the intended gatekeeper and Shared Task List model; it does not implement a collaborative-team runtime.
- Specified: Team Registry, teammate capabilities, Shared Task Claims and team-level evidence.
- Not implemented: Peer assignment, task leases, conflict handling, shared sequence state and production human escalation.
- Current boundary: The reference runtime evaluates individual Action Claims only.
Developer Integration Specs
Use the schemas, OPA policies, and MCP server tools to connect PALO to your agent workflows:
JSON Governance Schema
Define profiles, policy inputs, Action Claims, Effect Contracts, capabilities, receipts, outcome attestations, incidents and signed evidence with twelve interoperable contracts.
Open Schema Action Claim Effect ContractPolicy-as-Code (Rego)
Evaluate draft Rego v1 policy over registered tools, operations, scopes, network targets, delegation and approval metadata. Organization-specific production policy ownership and attestation are not included.
Open PolicyModel Context Protocol
Evaluate nineteen reference tools over stdio or experimental bearer-authenticated MCP Streamable HTTP, including governed execution, outcome verification and incident handling.
Open MCP Spec Capability MatrixStandards Alignment
PALO-AM is designed as an operational extension that translates global governance standards into PALO-compatible lifecycle phases, templates, matrices, KPIs and evidence gates.
IMDA MGF v1.5 (2026)
ISO/IEC 42001:2023
ISO/IEC 42005:2025
EU AI Act (2024/1689)
NIST AI RMF 1.0
GDPR
Developer preview available
v2.5 extends canonical governance into a complete reference assurance cycle: Action Claim 1.2, Effect Contract, one-time capability, trusted receipt, authoritative outcome attestation and held assurance incident. These components remain a developer preview and are not a production authorization or evidence service.
Twelve contracts, nineteen MCP tools, full-cycle runtime tests and an n8n governed-action preview.
Add durable distributed processing, connector attestation, workload identity, KMS/HSM and policy attestation.
Add principal identity, role separation and meaningful action context for accountable human approval.
Complete collaborative-agent teams, production connectors, mobile delivery and distributed staging assurance.