Agents do not have judgment. They have permissions. Designing the difference is the work.
A system that reasons, acts, checks its own work and answers in a single unbroken breath cannot be held accountable for any of it.
The industry picture of the autonomous agent is one model doing everything at once. It is seductive, it demos beautifully, and it does not survive contact with an institution that has to answer for outcomes. When the workflow is one opaque step, every failure is the same failure: the agent got it wrong. There is nothing to attribute, nothing to fix, and nothing to show a regulator.
The move that fixes this is unglamorous. Split the work, and put a contract on each seam. Interfaces are where controls can attach: a declared capability at the boundary, a verification before a result is believed, a permission scoped to one component rather than to the whole system. The cost is orchestration complexity. The return is that failure becomes attributable, which is the precondition for both fixing it and defending it.
PEVG splits agent work into four roles, each with its own contract. It is specified in Prompt Systems and Agent Orchestration, Book 2 of the series.
Decomposes the task into steps. Of the four, the module most worth constraining, because a bad plan is executed faithfully.
Calls tools, under contract. Least privilege applies here or nowhere: this is the module that changes the world.
Checks the result before it is believed. An agent earns the right to be believed; it does not start with it.
Writes the response. Separated so that what is said is not also what decided, which is what makes review possible.
Separation is not bureaucracy. It is the architecture of accountability.
Prompt Systems & Agent Orchestration · Chapter 3What turns the pattern into a control is that the flow itself is declared: an inspectable object naming the four modules, binding each to a contract, and stating the boundaries the flow may not cross. A pattern you cannot inspect is a preference. A pattern you can inspect is a control. The capability contract declares what a single agent may do; the flow object declares how four of them compose into one accountable workflow and which module owns which decision.
Human-in-the-loop fails when it is a courtesy rather than a layer. The tier should be a property of the risk, declared per node with a default and a confidence threshold, so escalation is a system behaviour rather than a judgement made under time pressure.
An oversight protocol with a hundred percent approval rate is not oversight. It is a signature step, and it will read as one under examination.
Agentic work usually arrives as a Regulated AI Architecture Sprint, four to six weeks, producing a target architecture for agents, orchestration, retrieval and the controls inside them, with an implementation backlog an engineering team can pick up. Where agents are already in production and the question is whether they can be defended, the AI Governance Teardown is the right instrument, scored against the MESA Framework with agent authority examined at Layer 3 and the substrate at Layer 4.
Honest scoping: this suits teams whose constraint is architecture and accountability. If the constraint is that the agents do not work yet, that is a capability problem and a different engagement.
It is the design of systems where a model does not merely answer but acts: plans work, calls tools, changes state, and produces consequences. The architectural question is not how capable the agent is but what it is permitted to do, who authorised that, and what record survives the action. In practice that means a declared set of capabilities per agent, a separation of the roles inside a workflow so no single component both decides and executes unchecked, and an evidence trail an auditor can read afterwards.
PEVG stands for planner, executor, verifier, generator. It splits agent work into four modules with four contracts: a planner that decomposes the task, an executor that calls tools, a verifier that checks the result, and a generator that writes the response. The industry picture of one model that reasons, acts, checks its own work and answers in a single unbroken breath is seductive and does not survive production, because a system that does everything in one step cannot be held accountable for any of it. Separation is not bureaucracy; it is the architecture of accountability. PEVG is specified in Prompt Systems and Agent Orchestration, Book 2 of the Full-Stack AI Engineering Series.
By making authority explicit rather than emergent. Each agent declares a capability contract stating what it may do, and the workflow itself is declared as an inspectable object binding each module to its contract and naming the boundaries the flow may not cross. A pattern you cannot inspect is a preference; a pattern you can inspect is a control. Beyond that sits tiered human review, where the tier is a property of the risk rather than of the reviewer availability: auto-approve, lightweight review, or full supervisory review, with the tier chosen by payment size, regulatory impact and confidence.
It means the loop is an orchestration layer, not a courtesy. Oversight is real when the reviewer has the information required to disagree, the authority to stop the workflow, and a record showing both were available. An approval step that approves everything is not oversight, it is a signature, and it reads as one under examination. Tiers should be declared per node with a default and a confidence threshold, so escalation is a system property rather than a judgement call made under time pressure.
They make it different rather than uniformly harder. A single large agent is simpler to draw and far harder to govern, because every decision happens inside one opaque step. Decomposing into roles adds interfaces, and interfaces are where controls can be attached: a contract at the boundary, a verification before a result is believed, a permission scoped to one executor rather than to the whole system. The cost is orchestration complexity. The return is that failure becomes attributable, which is the precondition for fixing it and for defending it.
The Model Context Protocol is how agents reach tools and data, which makes it a governance surface rather than plumbing: it is the membrane through which an institution decides what its agents are allowed to perceive. Authorisation, authentication, scoping and audit at that boundary determine what an agent can actually do, regardless of what its prompt says. That is covered on the MCP governance page.
Both, and the distinction is stated rather than blurred. The patterns are specified in the published series and set in a deliberately fictional institution, so AgentMesh is a reference architecture and not a deployed client product. The production proof is elsewhere: Maxim, iSystematic behavioural-intelligence layer for Claude, is built on this discipline, and ARIA at Simplification applies the same governed-AI thesis to conversational systems. Client engagements that apply these patterns are confidential.
The cheapest time to decide what an agent may do is before it can do it. The Fit Call is thirty minutes and free.