agentic-engineering / agent-governance-framework
AI Agent Governance Framework
An agent governance framework needs exactly three artifacts: a constitution of non-negotiable rules, a permissions matrix that maps every capability to grant, deny, or human-required, and merge authority that stays with humans.
The template below is distilled from the governance that runs a real production coding rig. Fill in the brackets, delete what you do not need, and put it in version control.
Three artifacts, no more
Governance frameworks fail by ambition: forty-page policy documents nobody re-reads after the offsite. The working version is small on purpose. A constitution — short laws an engineer or an agent can apply without judgment calls. A permissions matrix — every capability mapped to grant, deny, or human-required, enforced in config rather than convention. Merge authority rules — where the human sits, and what happens when the gate cannot decide.
Small enough to remember is a feature: a law your team cannot recall is not a law.
What a law looks like
Constitution laws are phrased as enforceable statements, not aspirations. Real examples from the rig this template is distilled from: agents never merge their own work — merge authority is human-only; secrets never enter prompts, repos, logs, or agent memory; when the review gate cannot run or cannot decide, the change does not ship — a missing verdict is a rejection.
The test for each law: can you name the mechanism that enforces it — branch protection, IAM scope, CI rule, budget cap? If not, it is a hope, and hopes do not hold at 3 a.m.
The matrix and its one rule
The permissions matrix is one row per actor (builder agent, AI reviewer, human engineer, automation), one column per capability (branch, approve, merge, deploy, secrets, spend, delete). The fill rule is single: any "grant" cell must name its enforcement mechanism, and any cell you cannot name is "human-required" until you can.
The AI reviewer gets verdict authority, never merge authority — its review is an input to a human decision, not the decision.
Where this runs for real
This is not a theoretical framework. The same three artifacts govern the Turbo Rig coding rig, where agents build, a cross-model gate reviews, and humans merge — one audited week ran 180 merged PRs through 967 gate reviews with zero agent merges. The methodology page walks the reasoning: agent governance.
Figures below come from one audited production week (September 21–28, 2026) across my own GitHub account — merged-PR counts, gate logs, and token accounting, published weekly on the Turbo Rig stats page. They are measurements of my own workflow, not industry averages. The evidence page on turbo-rig.com publishes the prior week (September 14–21: 141 merges, 868 gate verdicts, 4.21B tokens) under its own window — different weeks, different counts, same measurement method.
Get the template
Markdown download — constitution skeleton, fill-in permissions matrix, merge-authority rules, and a monthly drift-review cadence. Version 1.0, dated, free to use.
Talk it through with someone who runs this stack on his own systems every day.