FIG. 03 One call, and everything it has to pass

Governance is where AI programmes actually stop, and it is usually answered with a picture of a shield. Here is the trace instead: one agent asking to touch a real system, and every gate between it and the record.

the request

agentrenewal-outreach
wantscrm.accounts.update · notify(sms)
onACC-8841 · tier T1 · 4 days past due
01 Identity Acts as priya@, delegated, not a shared key.
Credentials stay server side. Token expires in 9 minutes. pass
02 Scope Tool crm.update may write status, next_action.
Requested status. Everything else on the record is out of reach. pass
03 Policy notify(sms) refused on tier T1.
The rule came from Priya, run #4182, and every agent inherits it. denied
04 Approval Rewritten to email finance, which the policy allows above a threshold.
Sent to the process owner for sign-off. held
05 Execution Runs in a sandbox cut from the real system, then against it.
No egress path beyond the declared hosts. Kill switch live throughout. pass
06 Audit Who, what, when, which scope, which policy, which approver.
Written before the response returns. recorded

Step 03 is the whole argument. The gate that stopped this call was written by one of your own people, doing their job, and it now applies to every agent, on every model, for as long as you run the layer.

Engineering declares the rails once. Nothing above them can reach past what was declared. Six gates, one call, fully traced.

Illustrative. The workflow, the rule and the person are invented to show the shape of the thing, not drawn from a customer.