Avoid Embedding Governance in AI Agents

This article discusses the problems with embedding governance rules directly into AI agents, such as security vulnerabilities, operational challenges, and lack of independent auditability. It proposes a 'governance plane' as a better architectural approach.

Details

The article explains that embedding governance rules directly into AI agent system prompts or code creates several issues. First, it makes the governance rules vulnerable to being overridden by adversarial inputs, as the agent cannot reliably distinguish authorized rules from malicious instructions. Second, updating embedded governance requires coordinated code changes across all agents, making policy updates slow and operationally challenging. Third, with governance mixed into agent implementation, it becomes difficult to independently audit whether the intended policies were properly enforced. Finally, maintaining consistent governance across a fleet of agents is a manual process when each one has its own embedded rules. The article proposes an architectural 'governance plane' that sits above the agents and enforces policies independently, without relying on the agents' cooperation.