Governed Intelligencethe body of work
The architecture

The Knowledge Layer

A reference architecture for delegated AI action in regulated institutions: the layer that holds what an agent acts on, computes how far it can be trusted, checks it against the consequence of the act, and keeps the record.

An architectural section: the floors above ground and the strata beneath them
What a building stands on is drawn in the section. What an agent acts on is drawn here.

Capability and admissibility

Capability is whether the agent can produce the act: write the change, draft the decision, prepare the payment. The models settle that, and they are good enough. Admissibility is whether the basis the agent relied on, the patterns, the rules, and the interpretations, can be defended and relied upon at the moment the act commits. No model computes that. It is a property of the knowledge the agent was given and of the layer that governs it.

The agents are not yet acting at scale, and that is the opening. An institution that builds the layer before they do has every consequential act admissible from the first one. An institution that adds it afterwards inherits a backlog of acts nobody can defend.

Where the layer lies

The players
People and AI agents, whoever does the consequential work. They act on what the layer delivers.
The Knowledge Layer
The governed substrate that delivers the basis for each act, with the check before the act as its upper edge.
The systems of record
Payments, contracts, filings, the repository, the ledger. The layer reads from them and replaces none of them.

Above the layer are the players. Below it are the systems of record. The layer's job is the interpreted knowledge between the two: what the institution is currently prepared to let an agent rely on, with the authority behind it and the date it was last true.

Each layer an institution already runs can be asked the same question: does it hold the basis at the moment of action? The application layer governs the flow of work, and it is dissolving into agents. Data governance governs the record at rest, not the claim. The specification governs what the system shall do and ships at release, while the basis changes between releases. Model risk management governs the reasoner, not the claims it reasons from. Identity and policy govern whether the actor may act, not whether the basis is fit to be acted on. Each governs a different object at a different moment. Stacked, they still leave the basis with no owner.

The claim

Everything in the layer is a claim: a discrete assertion the institution has reason to believe, with the properties that let it be governed. Anything that cannot be stated as a claim with these properties stays outside the layer, and that limit is visible.

Provenance
Where it came from, who validated it, and by what method.
Epistemic tier
Earned through the lifecycle, never assigned by hand.
Temporal validity
When it was true in the world, and when the layer learned it.
Confidence
Computed on several dimensions, and recomputed as evidence arrives.
Decay class
How the claim ages: on a regulatory schedule, with business conditions, with an outside source, or almost never.
Dependencies
What breaks if this claim changes.
Scope
Where the claim applies, and where it does not.
Authority
Who may promote or revise it.

Contradictions are kept as typed information. Two conflicting claims coexist with their provenance until a person with the authority to resolve them does so. A system that resolves them quietly has destroyed the information a cross-border programme has to handle.

Standing

A claim's standing is computed on two axes: the evidential warrant behind it, and the authority behind it. Neither is assigned by hand. Warrant changes as evidence arrives and as outcomes come in; authority changes when the body that owns the claim changes its mind. Four tiers follow from the computation.

Provisional
Exists, untested. Can support no consequential act.
Emerging
Structurally checked, passing automated validation.
Validated
Reviewed by someone with the standing to review it. Eligible for operational use.
Foundational
Primary source, the highest tier. Eligible for autonomous action.

The standing function is itself a model. The first line owns it, the second line challenges it, the third line audits it.

The check before the act

At the moment an agent proposes an act, the layer assembles the claims the act relies on, with their standing, into a bounded package: filtered by authorisation, scoped to the task, with a manifest of what went in, what was left out, and why. The package is then held against the consequence of the act.

Every act has a consequence tier, and every tier a minimum standing. A production deploy to a critical service, a payment above a threshold, a decision a customer can challenge: these need the highest standing behind them. A draft, a search, an analysis not yet submitted: any standing will do. When the claims clear the bar, the act goes through. When they do not, the act is blocked or referred to a person. Nothing degrades quietly.

  1. Propose. The agent proposes an act with a declared class.
  2. Resolve. The layer finds the claims that govern this act.
  3. Score. The standing function computes admissibility per claim against current evidence and authority.
  4. Assemble. The manifest is built: the claims relied on, their standing, the authority chain.
  5. Gate. The manifest is held against the consequence tier. Admit, refer, or block.
  6. Commit. On admit, the act goes through with the signed manifest bound to it.
  7. Write back. The outcome returns as evidence, and standing is recomputed.

The record

The manifest goes with the act: a signed, tamper-evident record of the claims it relied on, at what standing, under whose authority, on what date, bound to the commit or the transaction. When an incident arrives weeks later, the basis as it stood at the moment of the act can be rebuilt from the log. A reviewer sees at once whether the agent acted on a bad basis, or on a sound one overtaken by events.

That record is what an institution puts in front of a supervisor after the fact. It is produced at the act, not reconstructed from logs, tickets, and chat afterwards. Two timelines make the rebuild exact: when something was true in the world, and when the layer learned it.

The loop

Every outcome writes back. A change that shipped clean, an incident, a rollback, a customer's successful challenge: each becomes evidence on the claims the act relied on, and standing is recomputed. Claims behind clean acts gain standing on the operational dimension; claims behind incidents lose currency. The agent's own output is kept out of the evidence for its own claims, so a model cannot corroborate itself.

Knowledge also ages on its own schedule. A regulatory interpretation expires when the regulation is reread, an operational assumption when conditions change, a market view when its source updates. When a claim passes its validity window its tier is downgraded, and if that drops it below the minimum for any act it currently supports, the check fires before the next act. Decay is caught before a decision, and the substrate is denser and better calibrated after every cycle.

The governing rule

No agent may take an action whose consequence class exceeds the epistemic quality of its supporting claims.

Everything else follows from this one rule: the tiers, the decay monitoring, the consequence gate, the referral path, the halt. Remove it and the layer is retrieval with metadata.

Epistemic governance and data governance

Data governance answers who may access what, where it is stored, how long it is kept, and which jurisdiction applies. Epistemic governance answers whether what they are accessing is still true, how sure the institution is, what contradicts it, and which acts it is supporting right now. An institution can have the first in perfect order and still let an agent act on a claim that expired last week.

The two need different machinery and different owners. The first belongs to the chief data officer. The second has, in most institutions, no owner yet. ISO 42001, the EU AI Act, and the NIST framework define obligations; agent frameworks provide execution. The layer between the obligation and the execution is the one described here.

Software delivery, the first instance

The first place to build the layer is the one where the outcome signal is fastest. AI coding agents open pull requests, bump dependencies, and ship deploys, with no person at the act. The repository is a system of record. Which of the two auth patterns in it is canonical is a claim, authored by the architecture board, dated, and decaying with the next platform migration; it is not in the code. The same holds for lifecycle and deprecation state, for who owns a service and may approve a change to it, for the connection-pool ceiling the documentation never mentions, and for the module that caused three incidents this year.

The gate fires at pull-request open and at deploy. The consequence tier is blast radius: a production deploy to a critical service or a change to security configuration at the top, a feature-branch merge or a documentation change at the bottom. The manifest is bound to the commit. And the outcome, a green build or an incident, arrives within hours. The compliance domain waits for an examination to learn whether a claim was sound. Software delivery learns from the next deploy.

A first instance is one platform, two claim types, about 150 claims, the architecture board as the authority, and six to eight weeks to a gate that first observes and then blocks. The scope shrinks as far as is useful. The gate and the write-back loop stay; without either, what remains is retrieval with extra steps.

Four stages

An institution does not have to commit to the whole of this to start. Each stage is worth having on its own, and each is built so that the next stage adds to it.

Operational visibility
Structured claims extracted from existing systems, code, documents, procedures, and operational records, into a governed graph read by people through dashboards and queries. No agents. The institution sees its own rules, dependencies, and undocumented constraints for the first time. Many stop here, with enough risk found to pay for the work.
Modernisation on the substrate
The graph guides a modernisation build. Architects and developers query it; new claims enter as the build uncovers business logic; the gap between the legacy state and the target state becomes a queryable object. Fewer late-discovered rules, better estimates.
Governed intelligence
Agents join the players and the full apparatus comes on: tiers, consequence classes, the check, override by accountable people, the trace pipeline, referral. Agents start at low consequence, where the check logs and does not halt, and earn higher classes as the domain passes its readiness gate.
Initiative
Agents begin to identify what to pursue: an exception anticipated before it occurs, a stale claim challenged, an opportunity raised. It needs a deep substrate, mature attention, and trust earned through governance quality over time.

The papers behind it