"Governing AI agents" is too broad to act on. The NHI Governance Framework breaks it into seven layers, each with one question you should be able to answer for every agent, at any time, with evidence.
L1. Identity and registry: who is this agent?
Every agent is registered with its purpose, risk tier, environment, the models it may use, and a named owner (with a backup). Callers that are not registered are recorded as discovered, never trusted by default.
Good looks like: you can list every agent and its owner in seconds, and an agent without an owner cannot get a credential.
L2. Credentials and delegation: what can it prove right now?
Agents prove themselves with signed credentials that expire within minutes. Signing keys live in a hardware-backed vault. When an agent hands work to a sub-agent, the sub-agent's credential can only be narrower: fewer tools, lower limits, shorter life.
Good looks like: no long-lived agent secrets, and revoking a parent revokes every credential it delegated.
L3. Authorization: may it make this call?
Each tool call is decided before it runs: is the server allowed, is the tool in the agent's capabilities, are the arguments within their constraints, is the agent within its rate and budget? Tools are classified by what they do, so irreversible actions such as payouts and exports can be treated differently by default.
Good looks like: a refund over the limit is denied with a reason, before any money moves.
L4. Runtime attestation: is it still what we approved?
Agents are checked at run time: the model they use, the workload they run in, and their behavior compared with their own baseline. Signals from content guardrails, such as a detected prompt injection, can narrow an agent's session immediately.
Good looks like: an agent that starts behaving unlike itself is narrowed or paused before anyone files a ticket.
L5. Audit and forensics: can we prove what happened?
Every decision, approval and change is written to an append-only, hash-chained record before the action runs. Checkpoints are signed and timestamped. A forensic timeline goes from the human who started a task down through every sub-agent.
Good looks like: for any action, you can show who asked, which policy applied, what each layer decided and who approved, and prove the record was not edited.
L6. Lifecycle: does it still need to exist?
Agents are recertified on a schedule; orphaned and dormant agents are flagged and paused; capability changes are reviewed; retirement revokes everything.
Good looks like: agents nobody owns or uses disappear on their own.
L7. Human oversight: who is accountable?
Rules decide when a person is notified, must approve, or may edit an action's arguments before approving it (co-pilot mode). A kill switch pauses any agent or quarantines a session in one step, and drills prove it works.
Good looks like: money, customer messages and irreversible changes always pass a person; anyone on call can stop an agent.
One record for all seven
The layers are only useful together if one record shows all of them. In Sentinel NHI, each decision carries every layer's result and reason, so engineers, approvers and auditors look at the same thing.
See the framework overview, or book a workshop to assess your program against it.