Execution-Layer Governance for AI Agents
A March 2026 response to the National Institute of Standards and Technology Center for AI Standards and Innovation Request for Information on Security Considerations for Artificial Intelligence Agents, proposing execution-layer governance as a distinct architectural concern for secure AI-enabled automation.
Security at the Point Where AI Decisions Become Actions
The response addresses a shift in artificial intelligence systems from analytical tools toward operational actors capable of initiating actions in enterprise systems and critical-infrastructure environments.
The submission argues that model-layer concerns such as prompt injection, adversarial inputs, and hallucination remain important, but that AI agents introduce an additional security problem when probabilistic outputs are connected to infrastructure, identity systems, security automation, data-governance tooling, and software deployment pipelines.
Its central architectural response is to separate probabilistic reasoning from operational execution authority. AI-generated actions are represented as proposed actions and evaluated through deterministic governance mechanisms before execution is authorized.
The submission combines the Practitioner’s Blueprint for Secure AI (PBSAI) as a multi-domain governance ecosystem with the AI Governance Control Plane (AGCP) as the deterministic execution-validation layer.
Reasoning and Execution Authority Should Be Separated
The submission treats secure AI-agent deployment as an execution-governance problem as well as a model-security problem.
AI-generated decisions become security-relevant when they can change operational state.
The response proposes that outputs from probabilistic reasoning systems be treated as proposed operational actions rather than as self-authorizing instructions. Before execution, those proposed actions pass through deterministic governance evaluation against policy constraints, authorization requirements, cross-domain rules, and architectural invariants.
When governance requirements are satisfied, an authorization artifact can record the validated policies, supporting evidence, authorization decision, and execution parameters associated with the action.
When Probabilistic Outputs Reach Operational Systems
The response identifies risks that arise when AI-generated outputs can initiate actions within infrastructure, identity, security, data, and deployment environments.
Unauthorized Infrastructure Modification
AI-generated actions may modify infrastructure state beyond authorized operational boundaries when execution is not independently governed.
Identity and Privilege Escalation
Automated workflows may initiate identity changes or privilege-expansion actions that exceed intended authority.
Erroneous Automated Remediation
Incorrect reasoning can propagate into incident-response actions and operational changes when model output is directly coupled to execution.
Cascading Automation Failures
Actions initiated across connected automated systems can trigger additional responses and produce cascading operational effects.
Cross-System Actions
AI agents may affect several operational domains simultaneously while reasoning from incomplete or inconsistent context.
Probabilistic Errors Becoming Deterministic Effects
Without a separate governance layer, uncertainty or error in probabilistic reasoning can propagate directly into systems whose resulting state changes are operationally real.
PBSAI Governance Ecosystem + AI Governance Control Plane
The March 2026 response organizes its proposed approach around two complementary architectural elements.
PBSAI Governance Ecosystem
The Practitioner’s Blueprint for Secure AI describes a multi-domain governance architecture for secure AI-enabled enterprise environments.
The submission identifies operational domains including:
- identity and access management
- infrastructure orchestration
- security monitoring and response
- data governance
- system resilience and reliability
- policy enforcement and compliance
AI Governance Control Plane
AGCP is presented as the deterministic architectural layer responsible for mediating execution of AI-generated actions.
Proposed actions can be evaluated through mechanisms including:
- schema validation
- policy constraint evaluation
- domain policy validation
- authorization checks
- architectural invariant validation
Six Principles for Secure AI-Agent Execution
The response summarizes its governance approach through six architectural principles intended to inform secure AI-agent deployment.
Separate Reasoning and Execution Authority
Treat AI-generated outputs as proposed actions requiring governance validation rather than granting probabilistic reasoning systems direct operational execution authority.
Deterministic Governance of Actions
Evaluate policy constraints, authorization requirements, and architectural invariants through deterministic governance mechanisms before operational execution.
Structured Decision Artifacts
Represent proposed actions with structured fields for intent, evidence references, policy references, provenance, and authorization requirements.
Evidence-Centric Governance
Link telemetry, agent outputs, policies, authorization decisions, and operational actions so automated activity can be reconstructed and audited.
Cross-Domain Policy Validation
Evaluate proposed actions across affected enterprise domains rather than relying solely on local tool-level controls.
Deterministic Authorization
Permit operational execution only after defined authorization criteria have been satisfied and recorded in auditable governance artifacts.
Threats Beyond Traditional Software Automation
The submission identifies several threat classes that become particularly important when AI agents are connected to operational tools and systems.
Prompt Injection & Context Manipulation
Adversarial inputs can influence agent reasoning and cause proposed actions that conflict with operational policy.
Tool Invocation Abuse
Agents connected to tools may propose or attempt actions outside intended policy and operational constraints.
Privilege Escalation Through Automation
Automated workflows can inadvertently expand system or user privileges beyond authorized boundaries.
Cascading Automation Failures
Interacting automated systems can amplify an incorrect decision when one operational action triggers subsequent automated responses.
Incomplete Context Evaluation
Agents may propose technically possible actions without possessing the complete operational context needed to determine whether those actions are appropriate.
AI-Agent Security Requires More Than Model Benchmarks
The response proposes evaluating whether governance mechanisms reliably mediate automated actions, preserve evidence, and maintain authorization integrity.
Governance Enforcement Coverage
Measure the proportion of AI-generated actions evaluated through deterministic governance mechanisms before execution.
Policy Compliance Validation
Evaluate whether automated actions remain consistent with defined governance policies.
Evidence Completeness
Assess availability of structured artifacts linking decisions, supporting evidence, governing policies, and execution events.
Authorization Integrity
Evaluate how reliably automated actions remain bounded by defined deterministic authorization processes.
Connecting Execution Governance to Existing Risk and Security Frameworks
The response maps its architectural concepts to the NIST AI Risk Management Framework and established NIST SP 800-53 security-control families.
NIST AI Risk Management Framework
- Govern: explicit policy enforcement, structured decision artifacts, and traceability
- Map: evidence linking telemetry, decision inputs, and policy constraints
- Measure: governance-enforcement, evidence-completeness, and authorization-integrity metrics
- Manage: deterministic mechanisms for controlling risks from automated decision-making
NIST SP 800-53 Control Families
- AC — Access Control
- AU — Audit and Accountability
- CM — Configuration Management
- IA — Identification and Authentication
- IR — Incident Response
- PL — Planning
- RA — Risk Assessment
- SA — System and Services Acquisition
- SI — System and Information Integrity
Why Guardrails Alone Are Not an Execution Control
The response distinguishes controls intended to influence probabilistic model behavior from deterministic mechanisms intended to govern operational execution.
Direct Tool Invocation
Model outputs may directly trigger tools without an independent deterministic policy evaluation step.
Weak Separation
Reasoning and operational execution can be tightly coupled within the same agent workflow.
Limited Traceability
Agent frameworks may fail to preserve structured evidence connecting reasoning inputs to resulting operational actions.
Mutable Agent State
Changing internal state can contribute to inconsistent behavior across repeated or evolving execution contexts.
Prompt-Level Policy Enforcement
Policy instructions embedded in prompts influence model behavior but do not provide deterministic operational enforcement.
Test Governance Architectures in Operational Scenarios
The response proposes experimental environments for evaluating how execution-layer governance performs under representative AI-agent workflows and adversarial conditions.
Candidate Scenarios
- automated infrastructure modification
- identity-administration actions
- incident-response automation
- cross-domain actions involving multiple systems
Candidate Evaluation Measures
- governance-enforcement coverage
- policy-validation effectiveness
- authorization reliability
- evidence-artifact completeness
- resilience to adversarial inputs
Five Areas for Further Guidance and Evaluation
The submission concludes with five areas it recommends for additional attention in guidance related to secure AI-agent ecosystems.
Recognize Execution-Layer Governance as a Distinct Security Domain
Treat governance of operational execution as an architectural security concern distinct from, but complementary to, model-layer AI safety.
Encourage Separation Between Reasoning and Execution Authority
Encourage architectures in which probabilistic reasoning does not by itself constitute operational authorization.
Promote Evidence-Centric Governance
Encourage structured evidence linking inputs, decisions, applicable policies, authorization, and resulting operational actions.
Develop Evaluation Methodologies for Governance Architectures
Extend evaluation of AI-agent systems beyond model performance to include the effectiveness of governance and execution-control mechanisms.
Encourage Interoperable Governance Artifacts
Explore standardized representations for governance artifacts and authorization records that can operate across multi-agent environments.
Areas Identified for Additional Technical Work
The submission offers continued technical participation in work related to secure AI-agent architectures and governance mechanisms.
- development of evaluation methodologies for governance architectures in AI-agent ecosystems
- experimental environments for testing execution-layer governance mechanisms
- standardization of structured decision artifacts for AI-enabled automation
- cross-domain policy-validation mechanisms for multi-agent operational environments
- participation in future workshops, working groups, or standards-development activities related to these topics
Contribution Status and Attribution
This page documents a formal technical response submitted on March 6, 2026 to the NIST Center for AI Standards and Innovation Request for Information on Security Considerations for Artificial Intelligence Agents, docket NIST-2025-0035. The submitting entity was Quantum Powered Security, Inc., a subsidiary of Sustainable Future Tech, Inc., and the response was submitted via Regulations.gov.
Inclusion within Sustainable Future Tech’s Standards, Policy & Institutional Contributions catalog reflects Quantum Powered Security’s relationship to the broader SFT research and technology ecosystem while preserving the original submitting-entity attribution.
The terminology and architectural framing on this page describe the contribution as submitted. Subsequent SFT research, architectures, specifications, or Bodies of Knowledge may develop or refine related concepts. The historical contribution record should therefore be distinguished from any later authoritative technical work.
Submission of a response to an RFI does not imply adoption, endorsement, approval, or incorporation of its proposals by NIST or the U.S. Government.