Agent Governance: The Research
The citable body of work behind Enterprise Agent Architecture — sixteen open-access records on the agent decision-authority layer, each traced to shipped open-core code. Authored by Michael K. Saleme, ORCID-credited.
The Preprint Program
What This Research Is
Enterprise Agent Architecture (EAA) treats the autonomous agent workforce as a fifth enterprise-architecture domain — one that existing frameworks (TOGAF, Zachman) were never designed to model. The research program documents how that domain should be governed: not at the level of who an agent is, but of what it is authorized to decide, and when that authorization should be revoked automatically.
Each preprint is published on Zenodo with a permanent DOI, authored personally by Michael K. Saleme (ORCID 0009-0003-6736-1900). The work is intended to be read, cited, and critiqued by the CIO, CISO, and enterprise-architect audience adopting agentic systems.
Published Research
Two lines ran through the early program — governance/decision-authority and security-testing/claim-level evidence. A third has since emerged: runtime detection.
16 open-access records on Zenodo, grouped by the line of argument each belongs to. Every link is a concept DOI, which always resolves to the newest version of that work.
Decision authority and governance
Where agent authority belongs, and what happens when authorized actions compose.
| Work | Contribution | Concept DOI |
|---|---|---|
| Constitutional Self-Governance for Autonomous AI Agents: A Framework Observed in 85 Days of Production A Framework Observed in Production 2026-09-05 · 2 versions | The constitutional-governance framework as observed over 85 days of production operation. | 10.5281/zenodo.19162103 |
| Authorized but Composed: Cross-Session Risk Composition as an Agent-Governance Control Cross-Session Risk Composition 2026-07-16 · 2 versions | How individually authorized actions compose across sessions to exceed an aggregate risk budget — and a control that catches it. | 10.5281/zenodo.21400261 |
| Authorized but Refused: Six Months of Runtime Governance Telemetry from an Autonomous Enterprise Runtime Governance Telemetry 2026-07-08 | Six months of runtime governance telemetry from an autonomous reference implementation of roughly 50 agents. | 10.5281/zenodo.21263262 |
| Enterprise Agent Architecture: The Case for a Fifth Architecture Domain for the Agentic Enterprise The Case for a Fifth Architecture Domain 2026-07-05 · 2 versions | The position paper: why the agent workforce is a distinct EA domain, and how to model delegated authority. | 10.5281/zenodo.21105314 |
| Decision Load Index: A Conceptual Framework for Measuring Cognitive Burden in Knowledge Work Measuring Cognitive Burden in Knowledge Work 2026-01-11 · 2 versions | A conceptual framework for measuring cognitive burden in knowledge work. | 10.5281/zenodo.18207847 |
Claim-level evidence and assurance
Whether a record substantiates the specific claim it is offered for.
| Work | Contribution | Concept DOI |
|---|---|---|
| From Approval to Execution: Assurance Boundaries in Three Agent Protocols Assurance Boundaries in Three Agent Protocols 2026-09-19 · 2 versions | Whether a record of approval establishes that what executed is what was approved. Three protocols, no common answer. | 10.5281/zenodo.22847474 |
| Selective Context Under a Claim-Scoped Evidence Contract: A Synthetic Runtime Characterization of Token-Bleed R5 A Claim-Scoped Evidence Contract 2026-08-25 | A synthetic runtime characterization of selective context under a claim-scoped evidence contract. | 10.5281/zenodo.22100919 |
| Signing Is Not Authorization: Claim-Level Negative Vectors for Agent-Payment Receipts Claim-Level Vectors for Agent-Payment Receipts 2026-07-24 | A signature proves a relationship to a key, not authorization — claim-level vectors for payment receipts. | 10.5281/zenodo.21535452 |
| Claim-Level Negative Testing for Agent-Governance Evidence Negative Testing for Governance Evidence 2026-07-17 | Why evidence must substantiate the specific claim it is offered for, tested by negative vectors. | 10.5281/zenodo.21418701 |
| Present vs. Provable: A Conformance-Testing Methodology for the Authority Layer of Agentic Payments Conformance-Testing the Authority Layer 2026-07-08 · 2 versions | A conformance-testing methodology for the authority layer of agentic payments. | 10.5281/zenodo.21208547 |
Protocol security and runtime detection
Testing what agents do on the wire, and observing compromise in live traffic.
| Work | Contribution | Concept DOI |
|---|---|---|
| Deception Primitives at an MCP-Aware Enforcement Point: A Bounded Reference Design for Honeytoken, Decoy-Tool, and Breadcrumb Controls Honeytoken, Decoy-Tool and Breadcrumb Controls 2026-09-20 · 2 versions | Runtime deception at an MCP-aware enforcement point, with explicit evidence and enforcement boundaries. | 10.5281/zenodo.22859851 |
| Agent Security Harness Open-source protocol adversarial test suite 2026-09-09 · 24 versions | The open-source protocol adversarial test suite the research is traced to. | 10.5281/zenodo.20366512 |
| Community-Driven Security for AI Agents: Evolution of an Adversarial Testing Framework Evolution of an Adversarial Testing Framework 2026-07-10 · 2 versions | How an adversarial testing framework for AI agents evolves through community contribution. | 10.5281/zenodo.19343107 |
| Beyond Identity Governance: A Protocol-Level Security Testing Framework for Multi-Agent AI Systems Protocol-Level Security Testing 2026-03-23 | A protocol-level security-testing framework for multi-agent systems — testing the HOW, not just the WHO. | 10.5281/zenodo.19343033 |
| Detecting Normalization of Deviance in Multi-Agent Systems: Empirical Evidence for Graph-Based Behavioral Drift Detection Graph-Based Behavioral Drift Detection 2026-03-23 | Detecting behavioral drift in multi-agent systems through graph-based stateful monitoring. | 10.5281/zenodo.19195515 |
Further work
Not yet placed in a thread.
| Work | Contribution | Concept DOI |
|---|---|---|
| AI News Evidence Pack: Sentiment-Conditioned Tests of News-Driven Drift in 10 AI Movers (2024–2026) Sentiment-Conditioned Tests of News-Driven Drift 2026-04-27 | Sentiment-conditioned tests of news-driven drift across ten AI movers. | 10.5281/zenodo.19826560 |
Generated from the Zenodo API. Counts and identifiers are derived, not hand-maintained — regenerate with scripts/gen_publications.py.
All records are open-access on Zenodo and aggregate to the author’s ORCID profile.
Research Traced to Shipped Code
This is a research program with a running proof, not research alone. Each governance claim is implemented and observable:
The path from paper to production:
- Open-core:
constitutional-agenton PyPI (v0.8.0) packages the decision-authority controls, including the cross-session risk-composition evaluator from "Authorized but Composed." - Reference implementation: HRAO-E runs those controls live as a characterization environment — the source of the telemetry in "Authorized but Refused."
- Security-testing line: an open adversarial-testing harness backs the protocol-level and community-driven security preprints.
These are a reference implementation and a characterization of governance behavior — not a certification, and not a production-hardened or independently validated security product.
The Research Thesis
The Decision-Authority Layer
Enterprise architecture has long modeled business, data, application, and technology domains. The autonomous agent workforce is a fifth: a class of non-human actors that act with delegated authority, across sessions, at machine speed. The research program argues that governing this domain requires a control layer that most current tooling does not address.
1. WHO an agent is vs. WHAT it may decide
Most AI-agent security work addresses identity — authentication, credentials, access control. That answers who the agent is. It does not answer what the agent is authorized to decide, nor when that authorization should be revoked. The EAA thesis places the governance boundary at the decision, not the identity.
2. Authorization is not static — it composes
"Authorized but Composed" formalizes a specific failure mode: a sequence of individually authorized actions can, in aggregate and across sessions, exceed the risk budget any single action would have been allowed. Static per-call authorization cannot see this; the control has to remember and compose risk over time.
3. Governance produces evidence, not assertions
"Authorized but Refused" grounds the thesis in observed behavior: six months of runtime telemetry from a live reference implementation, reporting what the governance layer actually refused rather than what a policy document claims it would.
| Common Framing | EAA Framing |
|---|---|
| Identity & access (who) | Decision authority (what an agent may decide) |
| Per-call authorization | Cross-session risk composition |
| Policy documents | Runtime governance telemetry (observed refusals) |
| A separate governance product | Governance as an EA domain, proven in a live reference implementation |
Key Distinction
Identity governance asks whether an agent is allowed to act at all. The decision-authority layer asks whether this specific decision, in the context of everything the agent has already done, should still be permitted — and revokes authorization automatically when it should not.
A Gap in AI Governance Research
Most AI security frameworks address who agents are — identity, authentication, access control. This research addresses what they are authorized to decide, and when that authorization should be revoked automatically. The records published through this initiative — the EAA position paper, cross-session risk composition, runtime telemetry, constitutional self-governance, and the two security-testing frameworks — each contribute to the decision-authority layer. Cognitive Thought Engine has additionally made three public-comment submissions concerning NIST AI 800-2, whose receipt CAISI has acknowledged.
From Research to Shipped Code
What Is Actually Running
Status: reference implementation, characterization (not certification)
The figures below characterize a live reference implementation and its open-core package. They are engineering observations, not a certification, and not an independent security validation.
Open-Core & Reference Implementation
| Artifact | What It Is | Current State |
|---|---|---|
| constitutional-agent | Open-core package of the decision-authority controls (PyPI) | v0.8.0 · ~330 downloads/month |
| Adversarial testing harness | Open framework behind the two security-testing preprints | 611 tests · 44 modules · ~25 GitHub stars |
| HRAO-E reference implementation | Live autonomous environment running the controls | Source of the runtime governance telemetry |
Install counts are an external demand signal (PyPI does not report installer identity); GitHub stars and test counts are point-in-time repository figures.
What the Telemetry Shows
The "Authorized but Refused" report characterizes six months of runtime governance behavior from the reference implementation:
- 30,496 refusals — actions the governance layer declined to permit
- ~451,163 events observed over the reporting window
- ~6 months of continuous production operation
These are the empirical spine of the decision-authority thesis: the governance layer is not a policy document, it is a running system whose refusals can be counted.
Why Traceability Matters
Every headline claim in the program maps to a DOI, an open-core control, or a countable telemetry figure. Nothing rests on assertion alone.
Governance Telemetry & Method
What the Reference Implementation Records
| Signal | Purpose | Where It's Reported |
|---|---|---|
| Refusal events | Count of decisions the governance layer declined | "Authorized but Refused" (DOI 10.5281/zenodo.21263262) |
| Composed-risk evaluations | Cross-session aggregate-risk checks | "Authorized but Composed" (DOI 10.5281/zenodo.21400261) |
| Gate-state transitions | System-level governance state over time | Constitutional Self-Governance (DOI 10.5281/zenodo.19162103) |
| Adversarial test results | Protocol-level security-testing outcomes | Beyond Identity Governance (DOI 10.5281/zenodo.19343033) |
Method Principles
- Observed, not asserted: figures come from a running system's logs, not projected estimates
- Point-in-time, versioned: counts are tied to a package version or reporting window and will move
- Characterization, not certification: the work describes behavior; it does not certify a security posture
- Open by default: preprints are open-access; the core controls are open-source
Reproducibility & Access
The open-core controls (constitutional-agent) and the adversarial-testing harness are publicly installable, so the mechanisms described in the preprints can be inspected and exercised directly.
- Open-core install:
pip install constitutional-agent - Permanent citations: each preprint carries a Zenodo concept DOI
- Correspondence: research@cognitivethoughtengine.com
For Architects & Researchers
Available Resources
- Six open-access preprints with permanent DOIs (listed above)
- Open-core controls —
constitutional-agenton PyPI - Adversarial testing harness — open framework behind the security-testing line
- Reference implementation — the live environment the telemetry is drawn from
How to Cite
| To cite… | Use DOI |
|---|---|
| The EAA position paper (fifth domain) | 10.5281/zenodo.21105314 |
| Cross-session risk composition | 10.5281/zenodo.21400261 |
| Runtime governance telemetry | 10.5281/zenodo.21263262 |
All records list Michael K. Saleme as author (ORCID 0009-0003-6736-1900) and Cognitive Thought Engine LLC as publisher.
For Enterprise Architecture & Security Teams
The program is written for practitioners standing up an agent workforce:
- Modeling the agent workforce as a fifth EA domain
- Placing governance at the decision-authority layer, not just identity
- Catching cross-session risk composition in runtime controls
- Instrumenting governance so it produces countable evidence
Collaboration Inquiry
We welcome critique, replication, and design-partner conversations:
- Independent review of the decision-authority controls
- Applying the open-core to a different agent estate
- Extending the adversarial-testing framework
- Referencing the work in standards and framework efforts
Contact Research Team
Email: research@cognitivethoughtengine.com
Include: role/organization, which preprint or control you're engaging, and whether you're citing, replicating, or exploring a design-partner conversation.
What We Don't Claim (Yet)
Honest Boundaries
- Not a certification. The reference implementation characterizes governance behavior; it is not an accredited or independently certified security control.
- Not independently validated. The telemetry is drawn from a single reference implementation operated by the author; external replication is invited, not yet completed.
- Preprints, not peer-reviewed journal articles. The work is open-access on Zenodo and open to critique; it has not been through formal journal peer review.
- Point-in-time figures. Install counts, test counts, and star counts move; treat them as signals, not fixed facts.
- NIST involvement is limited. Cognitive Thought Engine has made three public-comment submissions concerning NIST AI 800-2, and CAISI acknowledged receipt. Nothing here is NIST-endorsed or NIST-validated.
Open Questions
| Question | Status |
|---|---|
| How do the controls behave across a different agent estate? | Seeking design partners |
| Independent replication of the telemetry findings | Invited |
| Calibration of composed-risk thresholds across domains | In progress |
| Adoption of decision-authority framing in standards work | Ongoing (public comment) |
How to Engage
If you identify a flaw in the argument, the controls, or the telemetry method, we want to hear it:
Email: research@cognitivethoughtengine.com
We Value Critique
This is an open research program with a running proof — not a finished, certified product. Adversarial review makes it stronger.