SSSamarth Sinha

Note

Governed Agent Operations

Let LLM agents act, but only through contracts, a write-ahead journal, risk tiers and a human gate, watched by a supervisor that can only read.

Oct 2026 · 1 min read

  • LLM APIs
  • MCP
  • Postgres
  • Secret Manager
Agent actions flow through a journal, risk tiers and human approval Scheduled task to LLM worker agent. LLM worker agent to Action journal. Action journal to Risk tier check. Risk tier check to Execute action. Risk tier check to Human approval (high risk). Human approval to Execute action (approved). Action journal to Read-only supervisor (reads). Read-only supervisor to Anomaly rules. Anomaly rules to LLM summary. LLM summary to Operator. high risk approved reads Scheduled task or operator request LLM worker agent declared contract Action journal intent written first Risk tier check low or high Execute action auto if low risk Human approval for high-risk actions Read-only supervisor collectors, telemetry Anomaly rules deterministic first LLM summary for the operator Operator reviews and decides
IllustrativeAgent actions flow through a journal, risk tiers and human approvalScroll →

Context

Agents are useful when they act, and dangerous for the same reason. The question is not whether to trust the model but how to bound what it can do and see what it did.

The problem

  • Agents act on instructions found in the content they read (prompt injection).
  • Actions are hard to audit after the fact if nothing recorded the intent.
  • A supervisor that can also act becomes a second, unguarded agent.

How it works

  1. Give every worker a contract: declared inputs, tools, limits and an owner.
  2. Write intent to an action journal before anything executes, so every action is auditable and replayable.
  3. Classify actions into risk tiers: low-risk actions run automatically, high-risk actions wait for a human.
  4. Run a read-only supervisor: collectors and deterministic anomaly rules first, then an LLM summary for the operator. It can raise alarms but cannot act.
  5. Harden the edges: treat tool output and web content as data, never as instructions; least-privilege secrets per worker.

Trade-offs

  • Approvals add latency; tier boundaries decide how much.
  • Journals add overhead, repaid the first time something goes wrong.
  • Alert fatigue is real: deterministic rules should filter before the LLM summarises.

When to use it

Use it for any agent with side effects. Read-only assistants need lighter controls.