The First Principle of Governance
Accountability always stays with humans. Loop modes can change by action, but responsibility cannot.
This isn’t a technical limitation — it’s a legal and ethical bottom line.
Governance Checklist
| Dimension | Question | Mechanism |
|---|---|---|
| Who approves merges | Who clicks merge on a PR? | Human sign-off (no Agent self-merge) |
| Who decides on release | Who triggers production deployment? | Human approval + audit log |
| Who handles security incidents | Who fixes it after an Agent makes a mistake? | Human-led remediation + Agent assistance |
| Who manages permissions | What sensitive data can the Agent see? | Least privilege + periodic review |
| Audit logging | How do you trace every step an Agent takes? | Tamper-proof logs + session records |
Common Governance Gaps
- “The Agent’s own review passed” — the same Agent both generates content and reviews it
- “It wasn’t logged, so it didn’t happen” — missing audit logs
- “Permissions were granted and never revoked” — no periodic access review
- “It’s just an experimental project anyway” — experimental projects touch production data too
References
- MIT CSAIL AI Agent Index (2025)
- “The HITL Illusion” — Static Oversight in AI Governance (Medium, 2025)