The six-layer framework for governing AI agents
A six-layer framework for governing AI agents in the enterprise: identity, delegated authority, policy at each tool call, audit evidence and security.
Last reviewed: .
Guides on AI governance and AI agents
Guides for the people who sign AI off. What the law asks, how to govern agents, and how engineers build with AI. Each guide names its author and the date it was last reviewed.
Published writing
Practical guides from our consulting practice on engineering and governing AI in production, written by Alex Vakhitov and reviewed against primary sources. Each shows when it was last reviewed.
How to govern AI agents in production
Tool permissions, evaluation, audit trails, human oversight and a tested way to stop: a practical guide to running AI agents safely in production.
Last reviewed: .
Does the EU AI Act apply to UK businesses?
Yes, if a UK business places AI on the EU market, puts it into service there, or its output is used in the EU (Article 2). Take legal advice.
Last reviewed: .
AI regulation in the UK: what applies in 2026
There is no single UK AI Act. How UK GDPR, the ICO and sector regulators govern AI today, how the EU AI Act reaches UK firms, and what to do next.
Last reviewed: .
EU AI Act timeline: every date that matters to UK firms
Every EU AI Act date after the Digital Omnibus: 2025 bans, 2 Dec 2026 marking, 2 Dec 2027 and 2 Aug 2028 high-risk rules, and what to do first.
Last reviewed: .
How to set up an AI-enabled SDLC in a large organisation
How a large engineering organisation governs AI in delivery: the Comonad AI SDLC control model, quality gates, records and a team-by-team rollout.
Last reviewed: .
Writing an AI coding assistant policy for a large engineering organisation
What an enterprise AI coding assistant policy should name: approved tools, data they may see, review, records and who can grant an exception.
Published
Plan first, then route: orchestrating an AI SDLC across agent harnesses
Why planning, not another agent, decides whether a multi-harness AI SDLC works: routing coding and review to different tools, review gates and governance.
Published
AI operating model for the enterprise: moving a function from people-run to agent-run
How a large organisation moves one function from people-run to agent-run: decision rights, controls, rollback and a pilot beside the current team.
Published
How to price and govern agent-run services
Fixed fees, outcome bonuses and a capped monthly share: how to price an agent-run service, where the risk sits, and what audit and exit require.
Published
Service as software: what it means for large organisations
What 'service as software' means for a buyer: an outcome instead of a seat, a contract that says who checks it, and one function at a time.
Published
Areas of work
AI operations
One business function at a time, from the team that runs it to an agent that runs defined work inside written decision rights, with a way back to the previous way of working.
Agent harnesses
Everything around the model that makes an agent operable: orchestration, tool permissions, evaluation, guardrails, logging and a way to stop it. We work on boundaries, structured outputs, rollback and observability.
AI across the SDLC
AI across specification, code generation, review, testing, CI/CD and release, with a quality gate at each step. A record of AI-assisted changes keeps audit and incident review working.
Automation
Engineering and business workflows where the output has to be structured and the failure mode defined in advance. Each step has an output schema, a check that rejects bad output, and a route to a person.
AI governance in production
A six-layer framework for governing AI agents, from identity and delegated authority to audit evidence and runtime security. For any agent action: who acted, for whom, under which policy, with what result.
Open source
Proxed.AI
AGPL-3.0
Split-key proxy that keeps full AI provider keys off iOS devices.
Source on GitHub (opens in new tab)Plop
AGPL-3.0
Stores and normalises inbound email, with access through a UI and an API.
Source on GitHub (opens in new tab)
Method
Bounded contexts set clear limits on what an agent may call. Composition decides how tools, evaluation and guardrails stack on top of each other. The same pattern runs through the SDLC, with a quality gate at each step. We write the boundary down first, evaluate before and after release, and keep a way back.
Questions about the writing, or about an engagement, go through the contact form.