Defining the Category
Agent Runtime Governance (ARG)
Agent Runtime Governance is the discipline of governing what an AI agent does at runtime: authorizing, enforcing, and recording its actions before and during execution.
Watchlight AI introduced and defined Agent Runtime Governance as a distinct architectural discipline in February 2026. The industry is now converging on the same requirements. Watchlight goes deeper: we govern delegated authority across the entire execution lifecycle, from intent through propagation, enforcement, lineage, and containment.
The Category Creator
The Market Converged. Watchlight Goes Deeper.
Identity, PAM, cloud, MCP, and agent-security vendors are now adding agent identity, per-tool-call authorization, and runtime policy checks. We read that convergence as validation of the category we defined. A runtime authorization check is becoming table stakes. Governing delegated authority across an execution chain is the architecture.
Industry Convergence · September 2026
The Architecture Is Becoming Consensus.
In September 2026, the Blueprint Alliance, a coalition spanning identity, cloud, cybersecurity, infrastructure, data, and enterprise applications, published an open reference architecture for securing and governing AI agents.
Its principles include task-scoped authority, end-to-end delegation, runtime monitoring, instant and reversible containment, and coordinated governance across the agentic stack.
The terminology differs. The architectural direction does not.
These are many of the same runtime governance requirements Watchlight began defining publicly in February 2026. We see that convergence as validation of the problem Agent Runtime Governance was created to solve.
From Early Architecture to Industry Requirement
Watchlight’s February 2026 ARG framework and today’s emerging industry architectures increasingly point toward the same fundamental control requirements.
| Architectural requirement | Watchlight ARG · February 2026 | Industry convergence · September 2026 |
|---|---|---|
| Agent identity | Every agent carries a unique, cryptographically verifiable identity and is registered. No identity, no execution. | Every agent is treated as a distinct security identity. |
| Scoped authority | Authority is explicit, scoped to the task and its declared purpose, and time-bound. | Access is scoped to the task rather than standing. |
| Delegation | Verifiable trust chains from the human through every agent and sub-agent, with scope narrowing at each link. | Delegation is traceable end-to-end. |
| Runtime governance | Formal policy evaluated on every action, at the moment of execution. | Runtime behavior is monitored continuously, beyond what was provisioned. |
| Execution context | Intent, goal, plan, runtime state, and authority evaluated at action time. | Execution context and risk signals underpin the architecture. |
| Containment | Fail-closed semantics and kill switches at the agent, group, and system level. | Containment is instant and reversible. |
| Evidence | Every action recorded with its governance context: identity, intent, delegation chain, policy result, and outcome. | Runtime telemetry, logging, and observability. |
Agent identity
Watchlight ARG · Feb 2026
Every agent carries a unique, cryptographically verifiable identity and is registered. No identity, no execution.
Industry · Sep 2026
Every agent is treated as a distinct security identity.
Scoped authority
Watchlight ARG · Feb 2026
Authority is explicit, scoped to the task and its declared purpose, and time-bound.
Industry · Sep 2026
Access is scoped to the task rather than standing.
Delegation
Watchlight ARG · Feb 2026
Verifiable trust chains from the human through every agent and sub-agent, with scope narrowing at each link.
Industry · Sep 2026
Delegation is traceable end-to-end.
Runtime governance
Watchlight ARG · Feb 2026
Formal policy evaluated on every action, at the moment of execution.
Industry · Sep 2026
Runtime behavior is monitored continuously, beyond what was provisioned.
Execution context
Watchlight ARG · Feb 2026
Intent, goal, plan, runtime state, and authority evaluated at action time.
Industry · Sep 2026
Execution context and risk signals underpin the architecture.
Containment
Watchlight ARG · Feb 2026
Fail-closed semantics and kill switches at the agent, group, and system level.
Industry · Sep 2026
Containment is instant and reversible.
Evidence
Watchlight ARG · Feb 2026
Every action recorded with its governance context: identity, intent, delegation chain, policy result, and outcome.
Industry · Sep 2026
Runtime telemetry, logging, and observability.
This comparison maps shared architectural requirements. It does not compare products or imply that implementations are equivalent. The Watchlight column reflects the 12 Non-Negotiable Principles; the industry column summarizes the Blueprint Alliance’s published principles and architecture.
Where Watchlight Goes Further
Recognizing the requirement is the beginning. Implementing a runtime authority system across the entire execution chain is the harder problem.
Deterministic authority
Every action receives a deterministic authorization decision before it executes. No language model sits in the authorization trust path.
Strict-subset delegation
When an agent delegates to a sub-agent, downstream authority can narrow but can never expand beyond the authority of the delegator.
Execution lifecycle governance
Intent → authorization → execution → drift → containment → lineage, governed as one continuous execution lifecycle.
Dual enforcement
The same decision is enforced inside the agent framework and independently on the network path, without requiring one agent platform, cloud, or gateway.
Active containment
Beyond allow and deny: terminate a run, quarantine an agent, sever a delegation subtree, or revoke authority in flight.
Execution lineage
The causal chain from human authority through agent intent, delegation, policy decisions, actions, downstream agents, and effects, preserved and used by later decisions.
The question is no longer who can perform a runtime policy check. It is who has built the architecture to govern delegated authority across the complete execution lifecycle, and can prove and contain what follows.
We defined Agent Runtime Governance, published the 12 Non-Negotiable Principles, and submitted a 37-page technical architecture with 20 sequence diagrams to NIST’s National Cybersecurity Center of Excellence. The market is now converging on many of the same requirements. Watchlight AI Beacon was built around the complete architecture: deterministic, framework-independent, and sovereign.
The Origin of the Category
How Agent Runtime Governance Was Built
We defined the category in February 2026, when we published the 12 Non-Negotiable Principles for Agent Runtime Governance. These are the milestones since, including the point at which industry architectures began converging on the same requirements.
Agent Runtime Governance is defined
We define Agent Runtime Governance and publish the 12 Non-Negotiable Principles for Agent Runtime Governance, the foundational framework, alongside the position paper establishing ARG as the missing layer between IAM and agent execution.
Architectural principles submitted to NIST
We submit the architectural principles of Agent Runtime Governance to NIST, in response to the NCCoE Concept Paper on AI Agent Identity and Authorization.
Execution lineage
We introduce the Agent Execution Graph, making every agent action and its full lineage visible as it happens.
Watchlight AI Beacon
Watchlight AI Beacon is named publicly as the enterprise runtime control plane, and the Beacon Plugin Suite brings runtime governance across agent frameworks.
Governing the long-horizon loop
We publish Securing the Agentic Loop and ship the plugin for LangChain deep agents, extending governance to long-running autonomy across eight framework integrations.
Industry architectures converge on runtime governance
The Blueprint Alliance, whose founding members span identity, cloud, cybersecurity, infrastructure, data, and applications, publishes an open reference architecture centered on task-scoped access, traceable delegation, runtime monitoring, execution context, and instant, reversible containment. Seven months after Watchlight introduced Agent Runtime Governance, these requirements are becoming part of the industry’s shared architecture for governing autonomous agents.
A Public Record, Not a Retrospective Claim
Watchlight’s ARG framework was published as a series of dated public artifacts beginning in February 2026, followed by architectural submissions, technical papers, product implementations, and open-source software. Those artifacts remain available so the evolution of the architecture can be evaluated against the public record.
- February 10, 202612 Non-Negotiable Principles for Agent Runtime GovernanceFramework whitepaper
- February 19, 2026Why Agent Runtime Governance Is the Missing Layer in IAMPosition paper
- April 6, 2026Architectural Patterns for Agent Runtime Governance: A Technical Companion to NIST’s AI Agent Identity ProjectNIST NCCoE technical companion
- August 17, 2026The 12 Principles of Agent Runtime Governance, ImplementedImplementation mapping
- Open sourceWatchlight Developer EditionWorking implementation · GitHub
What Agent Runtime Governance Is
One control layer sits between an agent and the systems it acts on, and decides every action at the moment it happens.
Agent Runtime Governance decides, for every single action, whether the agent may proceed, at the moment it acts. If a control does not govern the action itself at runtime, it is not Agent Runtime Governance.
What Is Not Agent Runtime Governance
These layers matter, and Watchlight AI Beacon works alongside them. None of them governs the agent's action at runtime, so none of them is ARG.
AI Security & Detection
Inspects content and flags risk, often after the fact. It does not authorize the action itself.
IAM & PAM
Authenticates the agent once and grants standing access. It cannot decide each action at runtime.
SIEM & Logging
Records what already happened. That is evidence, not enforcement.
Agent Frameworks
Run agents and orchestrate tools. They carry no concept of governance.
MCP & AI Gateways
Route and standardize how agents reach models and tools. They manage connectivity and traffic, not whether a given action is authorized against policy at runtime.
The Six Structural Gaps
These are not feature requests for existing products. They represent a missing architectural layer.
No Intent Layer
IAM answers "can this entity access this resource?" It cannot answer "why is this entity accessing it right now, and does that reason align with an approved business objective?"
No Delegation Model
When agents delegate to sub-agents, IAM cannot track the trust chain from the authorizing human through every agent in the path, or verify that authority narrowed at each link.
No Runtime Context
RBAC assigns permissions at provisioning time. Neither RBAC nor ABAC evaluates the evolving runtime context of an autonomous agent: its current goal, action count, plan deviation, or TTL expiry.
No Secrets Governance for Agents
PAM vaults use human approval workflows. Agents need credentials injected into execution context, scoped to a specific action, with TTLs measured in minutes, not stored credentials with broad access.
No Behavioral Observability
SIEM logs "agent-47 READ customers." ARG requires: which agent, what intent, what goal, who authorized it, what policy was evaluated, and whether the action was consistent with declared purpose.
No Agentic Loop Runtime Governance
Existing controls govern one request at a time. Nothing governs the agent's loop as a whole: the plan, act, and observe cycle that runs on its own at machine speed, where each result steers the next action and a chain of individually-allowed steps can still cross a line.
The Seven Minimum Requirements
Any system that claims to provide Agent Runtime Governance must deliver these capabilities. This is the floor, not the ceiling.
Agent Identity & Registry
Every agent has unique, cryptographically verifiable identity. Unregistered agents are denied execution.
Intent Declaration & Validation
Agents declare purpose, goal, and intent. Inconsistent declarations result in denied execution.
Runtime Policy Enforcement
Policy evaluated on every action, at the moment of execution, using formal policy languages rather than prompt guidelines.
Delegation Chain Tracking
Cryptographically verifiable trust chains from human decisions through every agent in the path, with scope narrowing at each link.
Secrets Governance
Short-lived, purpose-bound capability tokens. No long-lived credentials in agent hands. Proxy-based injection without code changes.
Behavioral Observability
Every action logged with full governance context: identity, intent, goal, delegation chain, policy evaluation result, and outcome.
Safe Failure & Kill Switches
Fail-closed semantics. Emergency stops at individual agent, agent group, and system-wide levels, independent of the agents themselves.
These requirements come from the framework that defines the category.
Read the 12 Non-Negotiable PrinciplesFrequently Asked
Agent Runtime Governance, answered
What is Agent Runtime Governance (ARG)?
Agent Runtime Governance is the discipline of governing what an autonomous AI agent is allowed to do at runtime: authorizing, enforcing, and recording every action before and during execution, against current policy. It sits above identity and below the application, and it governs the exercise of delegated authority across an agent's entire execution, not just a single tool call. Watchlight AI introduced and defined it as a distinct architectural discipline in February 2026 and authored its 12 Non-Negotiable Principles.
Who created Agent Runtime Governance?
Watchlight AI introduced and defined Agent Runtime Governance as a distinct architectural discipline in February 2026, through the 12 Non-Negotiable Principles and accompanying architectural work. The framework was then expanded through a technical architecture submitted to NIST's National Cybersecurity Center of Excellence (NCCoE), execution-governance research, and working product implementations.
Is the industry adopting Agent Runtime Governance?
The terminology is still evolving, but the architectural requirements are converging. Industry initiatives such as the Blueprint Alliance's open reference architecture now emphasize task-scoped authority, traceable delegation, runtime monitoring, execution context, and active containment for AI agents. These are the core problems Agent Runtime Governance was created to address. Watchlight uses ARG to describe the complete discipline of governing delegated authority and execution, from intent through outcome.
How is Agent Runtime Governance different from IAM, PAM, and AI security?
Identity and access management authenticates an agent and grants standing access, but it cannot decide each action at runtime. Privileged access management vaults credentials for human approval workflows, not machine-speed agent execution. AI security inspects content and flags risk, often after the fact, without authorizing the action itself. Agent Runtime Governance is the enforcement and evidence layer above all of them: it makes a deterministic decision on each action, tracks delegated authority across agent-to-agent delegation, preserves execution lineage, and can contain a run in flight.
Does Agent Runtime Governance replace my identity provider like Okta, Ping, or Entra?
No. Your identity provider decides who the agent is and what token it carries, and Watchlight sits downstream of it, provider-neutral. Identity establishes who the agent is and what it can access. Agent Runtime Governance decides whether, how, and under whose delegated authority the agent may act, enforces it where actions execute, and preserves the lineage of what follows.
What is delegated authority, and why does a single per-tool-call check miss it?
An agent almost never acts for itself. It acts on authority delegated from a human, and the legitimacy of an action depends on that grant, not only on the token the agent holds. A per-tool-call check answers whether this agent may call this tool, but it does not ask under whose authority the agent is acting, how far that authority has narrowed as work passed to sub-agents, or where in the execution chain the action sits. Governing delegated authority across the whole chain, deterministically and with lineage, is a different architecture from a single check.
Is a language model in the authorization decision?
In Agent Runtime Governance as Watchlight defines it, no. The authorization decision is deterministic. If a language model is anywhere in the trust path, a persuasive justification can talk its way past the control and it is no longer enforcement. This is the sharpest question to ask any agent authorization vendor.
What are the 12 Non-Negotiable Principles for Agent Runtime Governance?
The 12 Non-Negotiable Principles are the architectural framework Watchlight AI authored to define Agent Runtime Governance. They cover agent identity and registry, intent declaration and validation, runtime policy enforcement on every action, delegation chain tracking with scope narrowing, secrets governance, behavioral observability with full governance context, the plan-act-observe lifecycle, and fail-closed kill switches, among others. They are published in the governance framework whitepaper.
Request a Demo to see Watchlight AI Beacon in action
Beacon is the enterprise runtime control plane that puts Agent Runtime Governance into practice, authorizing, enforcing, and recording every agent action at runtime. Join the Founding Design Partner program to deploy it and help shape the roadmap.
Request a Demo