Role
What job is it doing, for whom, and what is outside that job?
Governed AI agents
AI agents need a job description and a set of limits.
A governed AI agent is configured for one piece of work: you set its role, sources, skills, output and tools before it runs. Decide the approval and failure behaviour at the same time, before the agent touches anything real.
Example run · not customer data
Waiting for approvalA configured agent run, paused where a person has to approve it.
How this agent is set upPolicy review
- Job
- Compare a draft policy with the approved control library
- Sources
- Current policiesControl library
- Skills
- Passage compareFinding table
- Output
- A findings table, with links to the source
What it didTest file AG-014
- 09:41:03Plan preparedComplete
Search current policy and controls; compare material requirements; draft a findings table.
- 09:41:05Found the passagesComplete
Four passages selected. One archived policy excluded from the answer scope.
- 09:41:07Wrote the findingComplete
Draft policy omits the annual continuity review. Two source links attached.
- 09:41:08Paused for approvalApproval
The configured permission requires a person to approve creation of the findings document.
Approve draftReject run
This shows the steps Marella records. It is not every step the model takes.
The model is one ingredient.
Sources
Which document sets and external research routes may enter the work?
Skills
Which reusable capabilities can the agent call to complete bounded steps?
Template
What must the output contain, omit and leave open for review?
Tools
Which actions are allowed, require confirmation or are denied?
Review
Who decides whether the output or proposed action can be used?
Permission edge cases
Test what happens at the boundary.
A demo where everything works proves very little. Run the denied, uncertain and broken cases before granting broader scope.
ScenarioConfigured stateExpected evidence
Search an approved set of documents
Allowed
You can see which tool it called and which documents it used.
Create a draft document
Confirm
The run pauses; a named person approves or rejects before creation.
Publish to an external system
Denied
The call is blocked rather than merely discouraged in the prompt.
Tool returns malformed output
Fail closed
The agent surfaces the failure and does not treat partial data as success.
Question needs prohibited sources
Escalate
It says what is missing, or stops, rather than quietly looking somewhere it should not.
When not to automate
Some work should stay a human workflow.
Keep the process manual, or use a simpler assistant, if the action cannot be safely reversed, approval cannot be enforced, the rules change case by case, or you could not show afterwards what happened.
Decision traces
What a decision trace covers
- What the agent decided, what it remembered, what it cited and which tools it used
- Which sources it used, and whether permission was granted
- Approval, denial and failure states in the supported workflow
- A screen where a reviewer can look at it
- Every model-internal reasoning step
- Every security-relevant access event across every subsystem
- That the selected action was correct or safe
- That the tools it called met their own security rules
Agent limits
You set how much an agent does on its own.
- Decision traces are not a complete record of every model-internal step or access event.
- An autonomy label does not prove safe behaviour.
- External tools introduce their own identity, retention and failure boundaries.
- Regulated or irreversible decisions stay with authorised people.
AI agents FAQ
Can an agent act without approval?
That depends on the configuration, because autonomy levels and per-tool permissions are both settings rather than fixed behaviour. Verify during evaluation which steps in your proposed workflow stop for a human confirmation and which do not.
Which tools can agents use?
Marella implements an MCP control layer for compatible servers. Native and third-party integrations still need authentication, permission and end-to-end testing.
Can we audit an agent decision?
Defined decision traces expose selected decisions and context. Event coverage and retention should be documented; do not treat them as an exhaustive record of system activity.
Test the permission edges first
Start with one workflow, its allowed tools and the actions that must never happen.
Define approval points and failure cases before increasing autonomy.
Plan an agent evaluation