Stop the prompt
A governed prompt is sent to an organisation-controlled policy service before the model sees it. A denied request never reaches inference at all.
Knowing what an agent did is not governing it.
After the fact is too late.
Most AI governance is retrospective by design. It captures the action, writes it to a log, and makes it available for review. That is a useful capability. It is not a control, because nothing about it changes what the agent does.
Logging an agent action is observability. Being able to prevent the action is governance.
The distinction did not matter much while AI produced drafts. It matters enormously once AI updates records, triggers workflows, interprets policy, moves money or acts on behalf of a user. A log entry describing a bad decision is a receipt for a failure that has already occurred.
The audit trail tells you what went wrong. It arrives in time to explain, not to stop.
The evidence
Four platforms reached this conclusion independently.
This is not a forecast. Over a single week in August 2026, four competitors shipped the same architectural idea at four different points in the execution path. When rivals converge like that, they are usually responding to the same customer conversation.
Stop the call
Policy sits outside agent code and evaluates agent-to-tool requests at the gateway, allowing or denying before the tool is reached.
Contain the execution
Proposed actions run inside an operating-system sandbox, so whatever the agent does cannot reach the host environment.
Own the runtime
The harness between business objective and model becomes an explicit architecture choice: what context is supplied, which tools are selected, how failures recover.
Two enterprises can run the identical model and carry completely different operating risk, because the enforcement around it behaves differently. That is the same argument essay 004 made about the operating system, now arriving as product.
The practical model
Four gates, not one checkbox.
"Human in the loop" is the phrase most organisations reach for, and it is too vague to build anything on. It names a participant, not a position. Consequential work needs the check placed somewhere specific, and there are four places it can go.
Gate 01 · Input
Should this enter the model?
The last point at which information can be withheld. Once context is supplied it has been disclosed, whatever happens next.
Gate 02 · Reasoning
On what authority?
Which model, which instructions, which context and which version of the policy. The answer changes more often than most registers record.
Gate 03 · Action
Is this permitted now?
Not whether the agent may act in general, but whether it may take this action, against this system, at this moment.
Gate 04 · Outcome
Does a human decide?
Set by consequence, confidence and reversibility. The calibration is in essay 003.
Every gate an organisation cannot name is a place where its AI acts unobserved and unstopped. That is a far more useful conversation than asking whether there is a human in the loop.
The distinction that gets missed
Deciding and containing are different jobs.
Should this action happen?
Permission decides in advance what an agent may attempt. Approval decides in the moment whether this particular attempt proceeds. Both are about authority.
If it happens, what is the blast radius?
Containment limits what an action can reach. Observation records what it did. Neither has any opinion on whether it should have happened.
Approval does not make an action safe. Containment does not make it authorised.
A human can approve something that then behaves unexpectedly. A perfectly sandboxed agent can still attempt something it should never have been permitted to try. Most organisations hold one of these four controls and believe they hold all four. For anything with filesystem, code, infrastructure or transactional access, you need every one.
Why this is urgent now
Two numbers from August 2026 sit uncomfortably together. In a survey of more than two thousand executives, seven per cent could demonstrate a return on their AI investment. In a single enterprise audit, more than four hundred agents were found where the CIO believed there were around forty.
Those are the same problem seen from two ends. Deployment is running ahead of the ability to govern it, and the tolerance for unproven value is collapsing at exactly the same time. An organisation that cannot say what its agents are permitted to do cannot say what they are worth either.
Where Praxis stands
A control plane that records is a starting point, not a destination. For consequential work the enforcement has to sit in the path: before inference, before the tool, before the transaction, before the consequence. Design those four gates for one workflow and you have something you can defend to a regulator, a board and a customer. Skip them and you have a very well documented incident.
By the time the audit log tells you the AI did the wrong thing, the operating failure has already happened.
Point of View
← All essays
Previous
Govern the change surface →
Begin
Where does your AI get stopped?
One conversation, no pitch deck. Pick a workflow where AI already acts, and we will find the four gates and the ones that are missing.