What an agent may touch is a predicate over a policy — checkable before the agent starts rather than regrettable after. Either every path to your secrets crosses a gate, or there is a concrete path that doesn't, and you would rather be handed that path than discover it.
Governance is the deterministic form of trust. Trust is a judgement you make once and cannot re-examine; a mandate is a predicate you can evaluate on every change.
The agent is given credentials and a list of permitted tools, and the rest is hope. Each call passes its own check, so nothing in the system has a vocabulary for the composition — read untrusted content, open a secret, send — that turns three allowed steps into one leak.
The policy is an object you can evaluate. Ask it a question with a yes or no answer — can this session ever reach a situation it must never be in? — and get back either a verdict that holds over every reachable path, or the shortest sequence that breaks it.
The check runs against the configuration, not the transcript. You learn what a policy permits while you can still change it, rather than reconstructing what happened from logs.
A redline is a state the system must never reach. That is a different object from a guideline in a prompt: it is checkable, it fails loudly, and it does not degrade under a persuasive instruction buried in someone else's issue text.
An agent can take a sequence of individually authorised actions whose net effect is harm. That is not a lapse in judgement to be patched with better instructions — it is a property of the permission model, and it is fixed where the model is.
No model sits on this decision path. The same policy produces the same verdict, and a failing verdict comes with the concrete path, so it can be replayed and kept as a regression.
Three, at three different distances from the run.
The mandate an agent is held to — what it is obliged to do and allowed to touch — and the red lines it must never cross. Answered before the run rather than asked about after, over what a session has accumulated rather than one message at a time.
The polysec page → polycheck what your policy permitsReads your .claude settings and MCP configuration and determines whether the policy allows a path from untrusted input to credential or source egress. Free, and it runs on your own machine in seconds.
A free, browser-local designer for goal-driven systems — four diagrams over one shared model, built on the BOLT strategy notation. Where the mandate and the redlines get drawn before anything enforces them.
Open Cartograph →The argument that this failure is architectural rather than operational — and the public incidents that make it concrete — live on the governing-agents hub, together with the tools that answer each question.