Understand

AI agent governance

Governing AI agents means answering three questions before handing them the keys: how far can they go alone, how much can they spend, and how can what they did be proven. An agent that acts commits the company. Without those answers, autonomy is not a capability, it is an exposure.

1. The autonomy boundary

Not all actions carry the same weight. Filing a document is not undone the way a message sent to a customer is, and a message is more easily undone than a payment. The useful rule is therefore to rank actions by how reversible they are, then place human approval where going back becomes impossible.

One guarantee matters more than the others: approval must be requested before the action, never noted after it. A notification announcing what has just gone out is not governance, it is a report. The complementary principle is least privilege: each agent receives only the tools its mission requires, so that any drift stays bounded by what it was never allowed to touch.

2. Budget control

An agent that reasons consumes, and it consumes more the longer it persists. That is the difference in kind from conventional software, whose cost does not depend on the difficulty of the task. A loop that never concludes can therefore cost more than a successful piece of work.

Effective control rests on three requirements. The budget must be allocated per agent and per period, otherwise a single agent absorbs everyone's resources. It must be checked before the call, not added up afterwards: noticing an overrun on the invoice does not prevent it. And it must be enforceable: reaching the ceiling stops the agent and raises an alert, instead of letting it run.

That prior reservation is how nullbot makes an overrun impossible rather than merely unlikely.

3. Traceability

When an action comes as a surprise, the question is not only "what happened", but "why did the agent judge this to be the right thing to do". A useful log therefore keeps the goal pursued, the information consulted, the action chosen, its result, and the identity of the person who approved when approval was required.

That record serves three purposes that are anything but theoretical: correcting a badly worded rule rather than blaming the agent; answering a customer or an auditor who asks on what basis a decision was made; and separating, after an incident, what stems from the instruction given from what stems from its execution.

4. Control over your data

An agent reads in order to decide. It therefore reads, potentially, the company's most sensitive material: messages, contracts, customer records, financial figures. The governance question then becomes geographical as much as legal: where is this content processed, and what leaves the company?

nullbot answers with architecture rather than with promises: the software installs and runs on your machines, data stays where it is produced, and access to artificial intelligence models goes through your own keys. Our security page details how this works, and the data processing agreement sets the contractual frame.

5. Frequently asked questions

How do you stop an agent from exceeding its budget?

By reserving the spend before the call to the model, rather than counting it afterwards. The expected amount is held against the agent's allowance; if the allowance is exhausted, the call does not happen and the agent stops, stating why. A counter consulted after the fact can prevent nothing.

Which actions should require human approval?

Those that cannot be undone, and those that commit the company towards a third party: sending to a customer, financial commitment, permanent deletion, changing a contract. The practical test is reversibility, not technical difficulty.

Who is responsible for what an agent does?

The company that deployed it, just as it is for the work of its employees. That is precisely why the autonomy boundary and the record of decisions are indispensable: they make it possible to demonstrate what was authorised, by whom, and on what basis.

Can autonomy be widened over time?

That is the recommended progression. You start by requiring broad approval, you observe where it is granted every time, and you relax the constraint on those precise cases. The reverse — allowing everything, then restricting after an incident — costs far more.