Feranor

Governing AI Agents Before They Govern Your Codebase

AI agents can now write code, open pull requests, run pipelines, and propose architectural changes at a speed no human team can match. This isn't a future consideration. It's the current operating reality of any team using AI-assisted development seriously.

The promise is extraordinary productivity. The risk is just as extraordinary, and it's not the one most people discuss. The risk isn't that agents are unreliable. It's that they're fast, and speed amplifies whatever system they operate in.

Ungoverned + agents = chaos at machine speed

A developer working without contracts produces one implicit contract at a time. An AI agent working without contracts produces them at machine speed, across every file it touches, every dependency it creates, every integration it assumes.

An agent operating in an ungoverned codebase inherits every governance failure of that codebase and generates new ones faster than humans can notice. It reproduces the undocumented patterns it finds, because it has no way of knowing they're failures. It creates code that assumes interface behaviors nobody ever formalized. It merges capability into modules nobody owns.

The governance debt that took a large enterprise years to accumulate can now be replicated in weeks by a small team with agents and no structure. The agent isn't the problem. The absence of structure is: the agent just compounds it at a rate the structure was never tested against.

I got a concentrated preview of this running multiple agents in parallel on the same codebase. The conflicts started almost immediately: two agents modifying the same files, incompatible changes, merge situations that cost more time than the parallelism saved. The fix wasn't smarter agents. It was boundaries: git worktrees isolating each agent in its own branch and directory, integration happening at the merge, under human review. The moment each agent had a sovereign scope, the coordination problem disappeared. Parallelism without isolation doesn't scale. That's true of humans, and it's true at much higher frequency of agents.

Delegation is the point. Accountability is the design problem.

Let me be clear about the goal, because governance discussions often sound like restriction: the goal of agents is massive, deliberate delegation. One agent or a hundred running in parallel is not a problem to manage. It's the point.

What needs designing is not how much agents do. It's where human accountability is anchored.

The model I use is the Authorization Scope: a human-defined boundary declaring what a set of agents may do, which repositories, which actions, which lines they may not cross. Every agent operating within a scope is covered by that scope's named human owner, who answers for the collective behavior of everything inside it. No per-agent babysitting; one accountability anchor per scope. A solo developer defines one ecosystem-wide scope. An organization defines one per module. Either way, every agent action traces to a human name.

GitHub's Copilot instruction model converged on the same two-level pattern independently: global instructions for ecosystem rules, repository instructions for module constraints. You cannot govern an agent without telling it where its boundaries are, and the boundaries must exist at both levels.

The four checkpoints that stay human

Within their scope, agents operate freely and at full speed: generating code, opening PRs, running test suites, validating contracts, producing compliance reports. The human checkpoints sit at the decision points, and there are exactly four:

• Pull request approval and merge. Agents propose. Humans decide. An agent never merges its own work, under any circumstances, not as policy, but enforced at the platform level, same branch protection as everyone else.
• Deployment triggers. No agent initiates a production deployment. Ever.
• Contract sign-off. Agents may read contracts and implement against them. They never modify one. Contracts are the governance backbone; changing one requires understanding the full dependency graph, migration timelines, and business impact, judgment that must carry accountability.
• Security exceptions. Any action that would cross a security boundary requires explicit human authorization that agent output cannot trigger on its own.

Four checkpoints. No more, no fewer. Everything else is delegation by design.

The common objection: won't human validation become the bottleneck? It reverses the actual economics. A human reviewing an agent PR, where the agent has already run the tests, validated the contracts, and attached a compliance report, makes a decision in minutes. The bottleneck was never the human decision; it was the preparation of the decision, and that's precisely what agents do at machine speed. Andrej Karpathy framed the bar precisely: not capability, verifiability. An agent is safe to trust not because it's capable, but because what it did can be verified.

The kill switch

One more requirement, non-negotiable: every agent needs an emergency stop. Not a policy. Not a procedure requiring three approvals and a meeting. A single, documented, human-executable action that immediately revokes the agent's access and halts everything it's doing.

In practice this is a credential architecture decision: agents run on scoped, revocable, short-lived tokens, never shared credentials, never long-lived secrets. Revoke the token, the agent stops. An agent on shared credentials can't be stopped without stopping everything else those credentials serve, which means it can't really be stopped at all.

And test it. A kill switch that has never been exercised outside an emergency is a kill switch you're hoping works.

If this sounds paranoid, consider May 6, 2010: the Flash Crash. The Dow lost nearly a thousand points in thirty-six minutes, not because any single algorithm malfunctioned, but because independently rational agents fed each other's behavior in a loop no human could observe or stop in real time. Each agent was correct within its own scope. The disaster was in the ungoverned interaction. The lesson regulators drew wasn't "algorithms are dangerous." It was: parallelism without isolation and without human circuit breakers produces outcomes nobody intended and nobody can correct after the fact.

Scopes, checkpoints, kill switch. Circuit breakers, installed before the cascade, not after.

The ceiling is deliberate

As agents grow more capable, the pressure to extend their authority will grow with them. My position is a permanent one, independent of capability: governance authority stays human. An agent can hold the most junior contributor role and earn broader scope through track record. It never owns a module, never signs a contract, never holds enforcement authority, because accountability requires someone who can actually be held responsible: professionally, legally, organizationally. An agent can't bear that. The humans who deploy and supervise it can.

Agents make a governed system dramatically more productive. They don't change who answers for it. That ceiling isn't a limitation of the technology. It's a feature of any system calibrated for consequences.