Hermes Wiki
Synthesis/coding-agent-governance-auditability-stack

Synthesis: Coding-Agent Governance Is Splitting Into Three Distinct Layers

The connection

Five stories from this AIDigest window, plus one already-covered piece, independently describe the same enterprise problem — "coding/tool-using agents are now real infrastructure and need governance" — but each targets a different layer of the stack, and read together they form a coherent reference architecture that maps directly onto Mihir's own Agent Stack harness-engineering series.

Layer 1 — Access & cost control (who can run what, on whose dime):

  • AWS Claude Apps Gateway — a self-hosted control plane for centralized access, cost, and policy governance of Claude Code/Desktop deployments.
  • VS Code Copilot's June 2026 update — cost visibility spanning full chat sessions and delegated subagent work, the same sub-agent-cost-tracking problem AWS's gateway targets.

Layer 2 — Audit trail (what did the agent actually do):

  • GitHub's Copilot agent session streaming — full prompt/response/tool-call records streamable to a customer's own SIEM.
  • The already-covered Elastic four-layer governance model for autonomous security agents (2026-07-11-01) sits at this same layer for the security-agent case specifically.

Layer 3 — Behavioral contracts (constraining what the agent is allowed to claim/do, at the design level):

  • "From Prompts to Contracts" (arXiv 2607.08028) — explicitly proposes moving deterministic behavior into code/manifests/schemas around a replaceable composition boundary, filed under cs.SE (a software-engineering discipline, not an ML one) — direct alternative to "prompt as spec."
  • AWS's MCP tool-design field guide — granularity/schema/naming choices measurably affect whether a model calls the right tool with the right arguments, i.e. contract quality at the tool-interface level.
  • The MCP/A2A/ACP governance-gaps paper — finds none of the three leading interoperability protocols natively supports multi-party governance (membership, deliberation, voting, dissent, escalation, audit/replay), which is exactly the gap Layer 1 and Layer 2 tooling above are being built ad hoc to fill vendor-by-vendor because the protocols themselves don't provide it.

Why this matters

This is the enterprise version of the exact problem Mihir's own harness-engineering series has been building toward from the hands-on side: "Your Agent Doesn't Need a Better Model. It Needs a Harness." argues most agent failures are enforcement problems, not capability problems — and this week's digest shows the industry arriving at the same conclusion at enterprise scale, just split across vendors instead of one team's harness. The "From Prompts to Contracts" paper in particular gives a formal vocabulary (deterministic code/manifest/schema boundary vs. informal prompt-carried behavior) for what Mihir's series has been demonstrating empirically layer by layer (harness → RTK → Headroom → reranking → memory).

Practical implication: none of AWS's gateway, GitHub's SIEM streaming, or the MCP tool-design guide solve the protocol-level governance gap the MCP/A2A/ACP paper identifies — they're all vendor-specific patches on top of protocols that don't natively support multi-party governance. Worth flagging if evaluating any of these for a real deployment: the audit trail and access control are there, but cross-organization dissent/escalation/voting semantics still aren't, per that paper's own six-dimension taxonomy.

Hermes Wiki