Why Are We Still Governing AI Agents Like Software? - Tim Tyler, Gravitee
Tim Tyler of Gravitee introduces the Agent Accountability framework, which treats AI agents as a digital workforce governed through three stages: Assignment (identity, team, and a named sponsor), Alignment (role, mission, and least-privilege authority), and Administration (oversight scorecards, guardian agents, and graduated recourse when agents drift off course).
Agents as a Digital Workforce
Tim Tyler opens with a deliberately absurd job posting: no ID, no manager, shared passwords, round-the-clock availability, and no consequences for mistakes. Almost no one would hire against that description, yet organizations are already deploying AI agents under exactly these conditions. His core argument is that agents are still governed like software when they should be governed the way enterprises have long governed human employees, as a digital workforce. Software protocols and standards remain necessary, but they are not sufficient. The Agent Accountability framework he presents rests on three stages: Assignment, Alignment, and Administration.
Assignment: Identity, Team, and Sponsor
Every agent needs a unique identity recorded in a shared registry that serves as a single source of truth. Everything else in the framework points back to that identity. Tim compares it to the ID badge every new employee receives, which he jokes is usually the worst photo of their life.
An agent is never truly solitary. Even a personal agent working for one user forms a team of two, and agents operating within departments or organizations need context about the team’s goals, decisions, and history. They should also feed context back so humans and other agents can see what they are doing and what they have learned. This makes the agent a teammate rather than a digital clone. The common belief that an agent acting on your behalf is effectively you is, in his view, dangerous.
Every agent also needs a named human sponsor who answers for it. Using the example of agent 409, a sponsor named Sven defines the agent’s purpose, owns its costs and spending, and receives the call when something goes wrong. Tim illustrates the principle with a childhood pool rule: whoever is responsible for the kids must make eye contact with another trusted adult and hear ‘I have the kids.’ Sven’s acknowledgment of agent 409 works the same way, establishing a clear line of accountability that already exists in the org chart but must be explicitly attached to the agent.
Alignment: Role, Mission, and Authority
Agents perform better with a clear role than with the vague, obscure job descriptions humans often inherit. A role contains a purpose, the responsibilities needed to achieve it, a budget, and a definition of success. The sponsor sets the role during onboarding, and it changes rarely unless recourse requires it.
Mission is different. It is the agent’s runtime activity, what it is doing at any given moment, such as a particular call to an MCP tool. The agent defines its own mission, while the sponsor always defines the role.
Authority determines what data, tools, and systems the agent can reach. The sponsor controls access to these resources, even when another team actually runs the MCP server or database. Tim stresses the principle of lowest scope. In his example, agent 203 has access to C and D, while agent 409 has D, E, and F. When 203 delegates a task to 409, 409 can use E and F to complete the work, but it can only return D to the chain because D is the only resource all of them share. Authority never grows beyond what the agent was granted, and it is always constrained by its lineage.
Tim argues that alignment should never be assumed. An underlying model arrives with its own alignment, shaped by providers whose rules the enterprise cannot easily change. Team context may come from elsewhere and can shift without the sponsor’s control. Outside agents accessing an agent behave like contractors entering a building, requiring their own identity and authorization. The sponsor can only control what is defined for the agent itself. Defined alignment therefore becomes a contract, with deterministic rules forming the floor, similar to fine-grained authorization policies, and probabilistic intents describing what should be achieved and how success is measured.
Administration: Oversight, Enforcement, and Recourse
Administration is where the contract is enforced. Human employees are monitored through device management, supervisors, and check-ins, and agents need comparable mechanisms. Tim distinguishes between behaving and succeeding. An agent that stays within its scope is behaving, but that does not guarantee it is succeeding at its role. Oversight therefore needs to measure both.
The result is a scorecard rather than a single metric. Rules are checked deterministically. For example, an agent may approve invoices only up to $40,000, or it may never approve payments and may write only to the ledger. Intents are judged probabilistically, using measures such as invoice match accuracy, reconciliation cycle time, or whether the correct purchase order was matched to the proper vendor and project. Judgments of intent should carry a confidence level, and the weights in the scorecard come from the definitions of role and authority.
People dislike micromanagers, but agents need them. Guardian agents, AI gateways, and guardrails provide this oversight by monitoring the model, the incoming context, and the work product continuously at machine speed. Tim notes that waiting for a quarterly review, as organizations do with humans, would leave agents thousands or millions of decisions ahead of any meaningful correction.
When agents go wrong, recourse should be graduated, much like human discipline. The first response is correction. Repeated problems, especially those involving work outside authority, lead to restricted authority, and persistent failure leads to escalation. Probabilistic judgments can drive specific actions based on confidence thresholds. For example, at 90% confidence an agent might simply have content redacted. Below 50%, a human must be brought into the loop, and below 20%, the action is blocked. Clear violations can trigger deterministic responses such as suspending a specific authorization after repeated attempts, or suspending the whole agent after days of consistent misbehavior. Following a zero-trust approach, controls start strict and loosen gradually with repeated success.
In this model, the sponsor acts as a coach. Rather than policing every action, Sven uses human judgment to refine roles, authorities, and alignment definitions so the agent produces better results and behaves more reliably. Tim’s summary of the framework is concise: Assignment names every agent, Alignment bounds every action, and Administration traces every outcome. He invites organizations to audit against the framework’s published controls and to begin by giving their agents an identity.