Govern AI agents, not just models.
Each agent is a first-class registry record — purpose, owner, foundation model, the tools it can use and the actions it must not take. Risk is classified against the same frameworks as your systems, and behaviour is reviewed against the audit trail.
Agents act. Static governance does not.
An agent is not a model. It takes actions, calls tools, reads and writes systems of record, and produces outcomes that affect customers — often under the impression that the underlying model risk assessment 'covers' it. It does not.
Governing agents starts with treating each one as a registered entity in its own right: purpose, owner, allowed scope, and a behaviour record that owners and auditors can review.
Register, scope, classify, review.
Hael registers agents alongside systems, captures the allowed-behaviour scope explicitly, classifies them against the frameworks they touch, and gives owners the audit trail needed to attest to behaviour.
Agents are registry records. Everything else derives from there.
The registry is the source. Agents sit in it alongside systems — and the classifications, documents, questionnaire answers and trust-page entries that describe them all derive from the same record.
Scope is declared. Behaviour is reviewed against the trail.
Hael governs agents the way it governs systems — by making them registered, scoped and accountable. Owners attest to the declared scope; behaviour is reviewed against the audit trail; deviations are investigated. Agentic AI becomes governable because it is, on the record.
Bring an agent. Register it, scope it, classify it.
Bring one of your live agents to the call. We'll register it, capture its allowed-behaviour scope, classify it against the frameworks it touches, and show how its behaviour record is reviewed.