Governing Agent Workflows
Why prompt-level instructions are not controls, and what enforcement looks like when it is implemented in the engine.
The question that stops most agent deployments is not “will it work?” It is “what happens when it doesn’t?” — and for most implementations the honest answer is that nobody knows.
Instructions are not controls
Telling a model not to exceed a budget, or not to modify certain files, is a request. It usually works. It is not a control, because nothing enforces it if the model does something unexpected, and the failure is discovered afterwards from a bill or a corrupted record.
A control is a constraint the system enforces regardless of what the model produces. Two are worth implementing before anything else.
Write-ownership
Each step in a workflow declares the artifacts it may write. Anything outside that declaration is rejected by the engine — both when the step executes directly and when filtering the output of a live model.
The practical effect: a step that processes one customer’s records cannot write into another’s, and a step that drafts a document cannot modify the audit log. These become structural properties rather than expectations.
Cost ceilings
Each workflow carries a spending limit evaluated against a live usage ledger during execution, not reconciled afterwards. When the ceiling is reached, the run stops.
This matters disproportionately for smaller organisations. A single runaway loop that produces an unexpected bill does not just cost money — it usually ends the organisation’s willingness to try agentic automation at all.
Declaring rather than coding
Both constraints are declared per workflow rather than written into the engine. A new workflow is authoring work: the roles involved, the graph connecting them, the tools they may call, and the governance envelope they operate inside. The engine does not change, which means the guarantees do not have to be re-established each time.
What this does not solve
Governance bounds behaviour; it does not confer judgment. An agent operating inside a correct envelope can still produce poor work, and workflows involving regulated advice or clinical decisions need a human accountable for the output. We scope those boundaries into the workflow definition rather than leaving them to convention.