The six-layer framework for governing AI agents
A six-layer framework for governing AI agents in the enterprise: identity, delegated authority, policy at each tool call, audit evidence and security.
Last reviewed: .
Enterprise AI consultancy · London
Put AI into production. Keep it accountable.
AI governance, agent harnesses and an AI-enabled SDLC for large organisations whose systems cannot go down. One practice, so the controls your risk team signs off are the ones your engineers run.
Cloud KB
Alex Vakhitov, co-founder and CTO, 2015 to 2022. Acquired by PE, 2022.
Frameworks
Controls mapped to the EU AI Act, ISO/IEC 42001 and NIST AI RMF.
Written scope
What is in, what is out and how it is checked, agreed first.
Comonad Limited is a London consultancy that helps large, established UK enterprises govern AI, put AI agents into production safely and set up an AI-enabled software development lifecycle.
Start with our AI governance consultancy. For the scope test, read Does the EU AI Act apply to UK companies?.
Written for
- CTOs and CIOs
- Heads of engineering and platform
- Risk, security and compliance leads
Services
AI consulting services for established enterprises
Three services, each scoped in writing. Take one, or combine them where the controls and the build have to agree.
AI agents · EU AI Act
AI governance
Written controls for your AI agents and AI systems that your risk team can evidence.
- Agent identity, delegated authority
- Accountability, audit and security
- EU AI Act, UK regulatory guidance
For risk, security and compliance leads governing AI agents and systems.
AI agents · Production
AI agent harnesses
Agents built into the systems and release process you run, with a tested way to stop them.
- Orchestration and tool permissions
- Evaluation, guardrails and logging
- Tested switch-off and rollback
For platform and engineering leads putting agents into an existing estate.
Engineering · Quality gates
AI-enabled SDLC
How your engineering organisation builds software with AI, with a gate at every step.
- Policy for AI-assisted development
- Quality gates from spec to release
- Record of every AI-assisted change
For CTOs and engineering leaders bringing AI into delivery across many teams.
How an engagement runs
Change to a critical system is slow, checked work: know the boundary, prove the new path, keep a way back.
Diagnose
We start from the system you run: its interfaces, data, release process and the cost of a wrong answer.
Design
We write the scope and the controls down first, including what is out of bounds and how it will be tested.
Embed
The work goes through your own release process, with your teams, and is checked against what was agreed.
Hand over
Your teams take ownership of what was built and agreed, and can run it without us.
Boundaries
Legal sign-off stays with your counsel. We do not issue ISO/IEC 42001 certification; accredited bodies do.
What you keep
At handover, these sit with your teams.
AI system inventory
The AI systems and agents in scope, and what each one does.
Risk classification
How each system is classified under the EU AI Act and UK guidance.
Control set
Written controls, each with an owner, a test and a framework mapping.
Evaluation plan
How each system is tested before and after release.
Runbook and switch-off
A tested way to stop the AI feature and fall back.
Quality gates
Gates on AI-assisted changes, from specification to release.
Frameworks we map to
- EU AI ActRegulation (EU) 2024/1689 (opens in new tab)
- ISO/IEC 42001:2023AI management systems (opens in new tab)
- NIST AI RMF 1.0NIST AI 100-1 (opens in new tab)
- NIST Generative AI ProfileNIST AI 600-1 (opens in new tab)
- ICO guidance on AI and data protectionUK Information Commissioner's Office (opens in new tab)
We map controls to these frameworks. Mapping is not certification.
Founder
Products we build and operate
Three products of our own, in production: the same key handling, request verification, structured outputs and change monitoring we advise on.
Proxed.AI
Secure AI API access for iOS apps, without building a backend.
- Split-key proxy for AI provider keys
- Requests verified by Apple DeviceCheck
- Self-hosted from public source, AGPL-3.0; hosted for existing customers
Plop
Stores and normalises inbound email and makes it available through a UI and an API.
- For operations, workflows and tests
- Open source under AGPL-3.0
Notiterms
Monitors the published terms of the services you rely on, so the check runs continuously.
- Alerts compliance and commercial teams
- Feeds a continuous compliance process
Guides from our practice
Practical guides on governing and engineering AI in production, written by Alex Vakhitov and reviewed against primary sources.
How to govern AI agents in production
Tool permissions, evaluation, audit trails, human oversight and a tested way to stop: a practical guide to running AI agents safely in production.
Last reviewed: .
Does the EU AI Act apply to UK companies?
Yes, if you place AI on the EU market or its output is used in the EU. Who is caught, what applies now, the 2027 and 2028 dates and what UK firms do next.
Last reviewed: .
AI regulation in the UK: what applies in 2026
There is no single UK AI Act. How UK GDPR, the ICO and sector regulators govern AI today, how the EU AI Act reaches UK firms, and what to do next.
Last reviewed: .
EU AI Act timeline: every date that matters to UK firms
Every EU AI Act date after the Digital Omnibus: 2025 bans, 2 Dec 2026 marking, 2 Dec 2027 and 2 Aug 2028 high-risk rules, and what to do first.
Last reviewed: .
How to set up an AI-enabled SDLC in a large organisation
How to adopt AI coding assistants in a large engineering organisation: policy, tool approval, quality gates, provenance, security and rollout.
Last reviewed: .
Plan first, then route: orchestrating an AI SDLC across agent harnesses
Why planning, not another agent, decides whether a multi-harness AI SDLC works: routing coding and review to different tools, review gates and governance.
Published
Questions about Comonad
What does Comonad do?
Three things, for large UK organisations. AI governance: an inventory and classification of your AI systems and agents, and controls mapped to the EU AI Act, UK regulatory guidance, ISO/IEC 42001 and the NIST AI RMF. AI agent harnesses: the engineering that lets an agent run safely in a live system. An AI-enabled SDLC: the policy and quality gates that let your teams build software with AI.
Who is Comonad for?
Enterprises and regulated organisations that run AI in production, or are about to, and need it engineered and governed to the same standard as any other release. Technology and risk leaders commission the work; the records it produces are written for your legal and audit teams as well.
Do you do governance or engineering?
Both, from one practice. A control your risk team signs off is only useful if your engineers can build it into the pipeline and show it working. We scope governance and engineering separately, so that each can be reviewed on its own terms.
How is AI regulated in the UK?
There is no single UK AI law. AI is regulated where it is used: through existing law such as UK GDPR, and by regulators such as the ICO, FCA, CMA and Ofcom applying the government's AI principles within their own powers. Our guide AI regulation in the UK sets out what applies.
Who is behind Comonad?
Alex Vakhitov founded Comonad in 2024. From August 2015 to March 2022 he was co-founder and CTO of Cloud KB, which built software for UK energy-market participants and supported SMETS2 installations from the early stages of the roll-out. Cloud KB was acquired by private equity in 2022.
Do you replace our existing suppliers or platform teams?
No. We work with the team that owns the system and alongside your existing suppliers. The aim is that your own people can release, observe and switch off the AI feature after we leave.
Where are you based?
Comonad Limited is based in London, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. It is registered with Companies House under company number 15713725.
Tell us about the system
What it does, who depends on it and where AI could fit.