Agent Governance: The Research

What This Research Is

Enterprise Agent Architecture (EAA) treats the autonomous agent workforce as a fifth enterprise-architecture domain — one that existing frameworks (TOGAF, Zachman) were never designed to model. The research program documents how that domain should be governed: not at the level of who an agent is, but of what it is authorized to decide, and when that authorization should be revoked automatically.

Each preprint is published on Zenodo with a permanent DOI, authored personally by Michael K. Saleme (ORCID 0009-0003-6736-1900). The work is intended to be read, cited, and critiqued by the CIO, CISO, and enterprise-architect audience adopting agentic systems.

The Six Published Preprints

Two lines run through the program: the governance/decision-authority line (the EAA position paper, composition, and telemetry) and the security-testing / claim-level-evidence line (the protocol-level and community-driven testing frameworks).

Preprint	Contribution	DOI
Enterprise Agent Architecture The Case for a Fifth Architecture Domain	The position paper: why the agent workforce is a distinct EA domain and how to model delegated authority.	10.5281/zenodo.21105314
Authorized but Composed Cross-Session Risk Composition	How individually authorized actions compose across sessions to exceed an aggregate risk budget — and a control that catches it.	10.5281/zenodo.21400261
Authorized but Refused Runtime Governance Telemetry	Six months of runtime governance telemetry from an autonomous reference implementation of roughly 50 agents.	10.5281/zenodo.21263262
Constitutional Self-Governance A Framework Observed in Production	The constitutional-governance framework as observed over 77 days of production operation.	10.5281/zenodo.19162104
Beyond Identity Governance Protocol-Level Security Testing	A protocol-level security-testing framework for multi-agent systems — testing the HOW, not just the WHO.	10.5281/zenodo.19343034
Community-Driven Security Evolution of an Adversarial Testing Framework	How an adversarial testing framework for AI agents evolves through community contribution.	10.5281/zenodo.19343108

All records are open-access on Zenodo and aggregate to the author's ORCID profile.

Research Traced to Shipped Code

This is a research program with a running proof, not research alone. Each governance claim is implemented and observable:

The path from paper to production:

• Open-core: constitutional-agent on PyPI (v0.8.0) packages the decision-authority controls, including the cross-session risk-composition evaluator from "Authorized but Composed."
• Reference implementation: HRAO-E runs those controls live as a characterization environment — the source of the telemetry in "Authorized but Refused."
• Security-testing line: an open adversarial-testing harness backs the protocol-level and community-driven security preprints.

These are a reference implementation and a characterization of governance behavior — not a certification, and not a production-hardened or independently validated security product.

The Decision-Authority Layer

Enterprise architecture has long modeled business, data, application, and technology domains. The autonomous agent workforce is a fifth: a class of non-human actors that act with delegated authority, across sessions, at machine speed. The research program argues that governing this domain requires a control layer that most current tooling does not address.

1. WHO an agent is vs. WHAT it may decide

Most AI-agent security work addresses identity — authentication, credentials, access control. That answers who the agent is. It does not answer what the agent is authorized to decide, nor when that authorization should be revoked. The EAA thesis places the governance boundary at the decision, not the identity.

2. Authorization is not static — it composes

"Authorized but Composed" formalizes a specific failure mode: a sequence of individually authorized actions can, in aggregate and across sessions, exceed the risk budget any single action would have been allowed. Static per-call authorization cannot see this; the control has to remember and compose risk over time.

3. Governance produces evidence, not assertions

"Authorized but Refused" grounds the thesis in observed behavior: six months of runtime telemetry from a live reference implementation, reporting what the governance layer actually refused rather than what a policy document claims it would.

Common Framing	EAA Framing
Identity & access (who)	Decision authority (what an agent may decide)
Per-call authorization	Cross-session risk composition
Policy documents	Runtime governance telemetry (observed refusals)
A separate governance product	Governance as an EA domain, proven in a live reference implementation

What Is Actually Running

Open-Core & Reference Implementation

Artifact	What It Is	Current State
constitutional-agent	Open-core package of the decision-authority controls (PyPI)	v0.8.0 · ~330 downloads/month
Adversarial testing harness	Open framework behind the two security-testing preprints	604 tests · 43 modules · ~25 GitHub stars
HRAO-E reference implementation	Live autonomous environment running the controls	Source of the runtime governance telemetry

Install counts are an external demand signal (PyPI does not report installer identity); GitHub stars and test counts are point-in-time repository figures.

What the Telemetry Shows

The "Authorized but Refused" report characterizes six months of runtime governance behavior from the reference implementation:

• 30,496 refusals — actions the governance layer declined to permit
• ~451,163 events observed over the reporting window
• ~6 months of continuous production operation

These are the empirical spine of the decision-authority thesis: the governance layer is not a policy document, it is a running system whose refusals can be counted.

What the Reference Implementation Records

Signal	Purpose	Where It's Reported
Refusal events	Count of decisions the governance layer declined	"Authorized but Refused" (DOI 10.5281/zenodo.21263262)
Composed-risk evaluations	Cross-session aggregate-risk checks	"Authorized but Composed" (DOI 10.5281/zenodo.21400261)
Gate-state transitions	System-level governance state over time	Constitutional Self-Governance (DOI 10.5281/zenodo.19162104)
Adversarial test results	Protocol-level security-testing outcomes	Beyond Identity Governance (DOI 10.5281/zenodo.19343034)

Method Principles

• Observed, not asserted: figures come from a running system's logs, not projected estimates
• Point-in-time, versioned: counts are tied to a package version or reporting window and will move
• Characterization, not certification: the work describes behavior; it does not certify a security posture
• Open by default: preprints are open-access; the core controls are open-source

Reproducibility & Access

The open-core controls (constitutional-agent) and the adversarial-testing harness are publicly installable, so the mechanisms described in the preprints can be inspected and exercised directly.

• Open-core install: pip install constitutional-agent
• Permanent citations: each preprint carries a Zenodo concept DOI
• Correspondence: research@cognitivethoughtengine.com

Available Resources

1. Six open-access preprints with permanent DOIs (listed above)
2. Open-core controls — constitutional-agent on PyPI
3. Adversarial testing harness — open framework behind the security-testing line
4. Reference implementation — the live environment the telemetry is drawn from

How to Cite

To cite…	Use DOI
The EAA position paper (fifth domain)	10.5281/zenodo.21105314
Cross-session risk composition	10.5281/zenodo.21400261
Runtime governance telemetry	10.5281/zenodo.21263262

All records list Michael K. Saleme as author (ORCID 0009-0003-6736-1900) and Cognitive Thought Engine LLC as publisher.

For Enterprise Architecture & Security Teams

The program is written for practitioners standing up an agent workforce:

• Modeling the agent workforce as a fifth EA domain
• Placing governance at the decision-authority layer, not just identity
• Catching cross-session risk composition in runtime controls
• Instrumenting governance so it produces countable evidence

Collaboration Inquiry

We welcome critique, replication, and design-partner conversations:

• Independent review of the decision-authority controls
• Applying the open-core to a different agent estate
• Extending the adversarial-testing framework
• Referencing the work in standards and framework efforts

Honest Boundaries

1. Not a certification. The reference implementation characterizes governance behavior; it is not an accredited or independently certified security control.
2. Not independently validated. The telemetry is drawn from a single reference implementation operated by the author; external replication is invited, not yet completed.
3. Preprints, not peer-reviewed journal articles. The work is open-access on Zenodo and open to critique; it has not been through formal journal peer review.
4. Point-in-time figures. Install counts, test counts, and star counts move; treat them as signals, not fixed facts.
5. NIST involvement is limited. Cognitive Thought Engine has made three public-comment submissions concerning NIST AI 800-2, and CAISI acknowledged receipt. Nothing here is NIST-endorsed or NIST-validated.

Open Questions

Question	Status
How do the controls behave across a different agent estate?	Seeking design partners
Independent replication of the telemetry findings	Invited
Calibration of composed-risk thresholds across domains	In progress
Adoption of decision-authority framing in standards work	Ongoing (public comment)

How to Engage

If you identify a flaw in the argument, the controls, or the telemetry method, we want to hear it:

Email: research@cognitivethoughtengine.com