ANSWER

What is a governed AI agent?

Reviewed October 27, 2026 · Reviewed by Paulo Pierrondi, founder.

A governed AI agent is an agent that works inside a defined scope, asks for human approval when an action leaves that scope, and keeps an audit trail of every step. It is not a loose chat. It is not a robot that repeats clicks without a limit. It is not a rewrite of the legacy system. The scope, written before execution, separates what may proceed alone from what must stop. Reversible backstage work includes reading, triage, enrichment, reconciliation, classification, routing, reversible execution and logging. Production changes, privileged access, money, deletion and any irreversible step wait for a person. AgenticosCore calls that boundary the House Rules: they state what runs alone and who approves what. The trail is the record written at the moment of the action, not a report assembled at the end of the day. It identifies who ran the action, what ran, when, and under which rule, and it separates what the agent did alone from what passed through human approval. Without that record, an audit becomes a reconstruction. The trail belongs to the people who operate the process. When the decision is larger — shutting down a process that still lives in the legacy system — the proof goes into the Evidence Pack. The pack gathers what was compared, where a variance appeared, who accepted an exception, how rollback was rehearsed and why the final decision holds. An approved exception enters only with an owner, a rationale and an expiry. Without an owner, the difference stays a blocker. Aggregate numbers without a period, an unclassified variance and an approval without a name are not evidence. Until the agent has taken the place of the current system, the path is a dual-run. Both sides receive the same inputs, produce comparable outputs, and the replacement has no production effect. Writes stay off. The legacy system stays in command, as the live operation, and the candidate runs beside it, in shadow. The Equivalence Contract, closed before measurement, states what must match, which differences are blockers and which exceptions a person may approve. It is not a generic accuracy percentage. A small difference can be material. A large formatting difference may be irrelevant. Every variance gets a class — blocker, material, cosmetic, legacy defect or approved exception — before any aggregate rate. Cutover comes later, with human approval, a tested rollback and an Evidence Pack that records diffs, owners and the way back. If equivalence is not proven, the valid outcome is not to cut over. Learning that before shutdown is control, not failure. The failure is cutting over while ignoring the evidence. Brake and rollback are not the same exit. Brake stops the new execution immediately, without a ticket and without depending on the provider. Rollback restores the previous operation and reconciles state, and it is ready only when the return was rehearsed, access works and the decision has an owner. A governed agent has both exits written down before it takes the work. Where personal data is processed, governance continues. When the company defines the purposes and the essential elements of the processing the agent performs, it tends to act as controller. The provider may act as processor when it processes data under documented instructions. The real role of each party depends on the case and belongs in the agreement. In practice the project needs a legal basis, a record per action, least-privilege access, an immediate stop, retention, subprocessors and contractual responsibilities. A model guardrail protects the conversation. It does not replace the record of what was executed, with which credential and under which rule. Legacy Exit uses this design to retire one process at a time, on proof, not on faith. The first slice is a recurring process, with stable rules and comparable inputs and outputs. A whole application comes in only when the critical processes can already be compared and reversed. The agent does not pretend to replace a system of record for critical state. It can retire the work around that core after proof. The Diagnostic qualifies access, equivalence, approval and rollback before a proposal. Without those controls, the size drops or the case is declined. The control exists so that a decision not to cut over can be verified.

Step by step

• Write the scope: what the agent does alone backstage and what waits for human approval.
• Turn on the per-action trail before the first run and name an owner for every exception.
• If the work still lives in the legacy system, close the Equivalence Contract before dual-run.
• Run the replacement in parallel, with no production effect, and classify every variance.
• Cut over only with human approval, tested rollback and an Evidence Pack; otherwise do not cut over.

How an agent does this

At AgenticosCore, House Rules separate reversible backstage work from an irreversible exception. Trail records every action, Parallel runs the dual-run against the current system, and Brake stops execution. An approved exception enters the Evidence Pack with an owner, a rationale and an expiry. What LGPD requires of the company is at /en/answers/ai-agent-in-production-lgpd-requirements/.