Technical White Paper · March 2026

Actions Speak Louder Than Words

Model safety governs what agents say. Execution-level governance controls what agents do.

Enterprise AI programs have focused on hallucinations, bias, alignment, and output guardrails. Those controls matter, but they do not govern the API calls, credentials, data access, and autonomous decisions agents execute at runtime. This page reframes the problem: the material risk surface for AI agents lives at the execution boundary.

Read the executive abstract View key takeaways

Executive Abstract

Why execution governance is the missing infrastructure category for production AI.

The enterprise AI conversation has been dominated by model-level concerns. Yet the truly consequential risks emerge from what agents do: the credentials they use, the data they access, the tools they invoke, and the autonomous decisions they execute across organizational boundaries.

Model-level safety and execution-level governance are complementary layers. Most enterprise architectures address the first while leaving the second largely ungoverned. The result is a structural gap between an agent that produces acceptable outputs and an agent that operates safely in production.

This paper introduces the architectural principles behind AgentVisor, Manetu’s Controlled Autonomous Runtime Execution platform. The objective is straightforward: govern every agent action at the runtime boundary through policy authorization, credential separation, and durable observability without requiring changes to agent code.

1. The execution layer is where AI risk actually lives

Risk enters when agents interact with systems, not when they draft prose.

An agent can pass prompt safety tests, produce polished responses, and still create unacceptable risk the moment it makes an unauthorized API call, accesses restricted data, or forwards sensitive information through an unapproved tool chain.

These execution-layer failures are not edge cases. They are predictable outcomes in systems where autonomous software makes runtime decisions that no static analysis or output filter can fully anticipate. Prompt injection, lateral movement across services, credential misuse, uncontrolled resource consumption, and missing audit trails all originate in execution.

Model safety

Shapes what an agent is likely to generate and filters harmful or inaccurate content before an action is taken.

Execution governance

Controls what an agent is permitted to do at the runtime boundary, at the precise moment an action is attempted.

Output guardrails evaluate what an agent says. Execution governance determines what an agent can do.

These are complementary controls, but only one governs the downstream consequences of autonomous action across data, APIs, and systems.

2. Why existing infrastructure falls short

Adjacent controls exist, but none were built for autonomous runtime authorization.

Traditional access control, container security, API gateways, identity providers, and model guardrail platforms each solve a neighboring problem. None of them were designed to authorize dozens or hundreds of agent-initiated decisions flowing from a single user prompt.

Traditional access control

Built for one user, one request, one decision. Agents create a chain of context-dependent runtime decisions instead.

Container security

Provides process isolation, but does not govern how an application uses the network access and credentials it already has.

API gateways

Govern the front door. They do not observe or authorize the downstream actions an agent takes after the first response arrives.

Identity providers

Authenticate users, but do not answer whether a specific delegated action is authorized in the current execution context.

Enterprises need a purpose-built execution runtime that enforces policy at the boundary where an action occurs, rather than depending on controls that were designed for users, services, or static application flows.

3. Controlled Autonomous Runtime Execution

CARE embeds policy authorization directly at the execution boundary.

Controlled Autonomous Runtime Execution, or CARE, describes infrastructure where every agent action flows through policy evaluation before it reaches the outside world. Agents operate in an isolated guest environment with no direct network access, no real credentials, and no path to external systems except through a controlled channel to a trusted host.

The trusted host manages policy evaluation, credential management, protocol translation, and upstream communication. This establishes a zero-trust operating model for autonomous software: the agent begins with zero access, and every action must be explicitly granted.

CARE host-guest architecture

Agent Guest

Sandboxed runtime with no direct network connectivity and no access to real credentials.

Policy Evaluation

Every HTTP request, tool invocation, or protocol interaction is checked against policy before execution.

Credential Brokering

Symbolic tokens are resolved to real credentials only after the request is approved.

Authorized External Call

Only approved actions reach external APIs, with durable audit logging attached to each decision.

4. Governance architecture in depth

Policy-based decisioning must be real-time, composable, and structurally default-deny.

AgentVisor decomposes each action through the PORC model: Principal, Operation, Resource, and Context. This creates a repeatable structure for making fine-grained, execution-time decisions that align with enterprise governance requirements.

Principal

The entity on whose behalf the action is taken, including the user, the agent, or a full delegation chain.

Operation

The specific action the agent is attempting to perform at that moment in runtime.

Resource

The target of the action, identified precisely so policy can be scoped and enforced with clarity.

Context

Time, environment, session state, and the other runtime attributes that determine whether an action should proceed.

✓

Independent policy phases. Decisions are evaluated across operation, identity, resource, and scope. All mandatory phases must grant access.

✓

Credential separation. Secrets never enter untrusted code. Agents operate on symbolic tokens with no secret material.

✓

Human-in-the-loop controls. Sensitive workflows can pause at a decision point and resume with full state preservation after review.

5. Observability, compliance, and audit

Governance without evidence does not satisfy production requirements.

In regulated environments, enforcement must be provable. Every policy decision should generate a structured record that captures principal, operation, resource, context, applied policies, phase-level outcomes, and the final determination.

Distributed tracing extends that evidence trail across the full call stack so teams can follow a single user request through the agent sandbox, policy decision points, and upstream APIs. This creates a durable basis for compliance review, incident investigation, replay, and debugging.

Structured AccessRecords

Every decision leaves a durable, replayable record of what was requested, why it was permitted or denied, and how policy was applied.

Trace correlation

Compliance and platform teams can follow end-to-end execution paths across agent actions, policy checks, and external dependencies.

Multi-layer enforcement

Runtime, tool server, and data or API enforcement points can each operate with minimum necessary scope.

Durable retention

Audit records persist with the completeness and reliability required for regulated review and internal governance programs.

6. From lab to production

Execution governance must deploy without forcing framework changes or code rewrites.

Governance architecture loses value if it introduces friction that slows adoption. AgentVisor is designed around transparent compatibility so agents built with standard Python libraries and common development tools can operate without modification.

The runtime intercepts agent communications through standard proxy configuration that widely used HTTP libraries already honor natively. Policy enforcement then applies consistently across REST, MCP, and agent-to-agent protocols.

The architecture is also stateless by design, with workflow state managed in a durable execution layer that supports checkpointing, crash recovery, and resumption on a separate runtime instance.

7. The strategic imperative

The long-term winners will govern autonomous action from the start.

The organizations that capture durable value from AI agents will not simply be the ones deploying the most capable models. They will be the ones that treat execution-layer controls as foundational infrastructure rather than a cleanup project after an incident.

Model safety governs what agents are inclined to generate. Execution governance controls what agents are permitted to do. Both are required. Only one governs the consequences.

Govern the agent, not just the model.