Guardrails stop bad actions in the moment; governance is the systematic, auditable framework that defines what is allowed, proves it was enforced, and satisfies the regulators who now take a direct interest in autonomous systems. For any platform touching regulated data or consequential decisions, this is not optional polish — it is a precondition for being allowed to operate.

17.1 Policy as code

Authorization rules scattered through application logic are impossible to audit, test, or change with confidence. The discipline is to externalize them into a dedicated policy engine and express them as code. The Open Policy Agent (OPA) is the de-facto standard: policies are written in a declarative language (Rego), versioned in git, tested in CI, and evaluated at runtime by asking the engine a yes/no question — "may this agent, acting for this user, call this tool on this resource?" Decoupling policy from code means rules become a reviewable, centrally governed asset that every component — gateway, tool layer, orchestrator — can consult uniformly. This is the enforcement substrate for least privilege (Ch. 15) and action-gating (Ch. 16).

17.2 The audit trail

Governance requires that every consequential decision be reconstructable after the fact: who (which user, which agent identity), did what (which action, with what arguments), when, under which policy decision, and with what result. The durable execution history (Ch. 4) and observability traces (Ch. 18) already capture much of this; governance demands it be complete, tamper-evident, and retained per policy. An immutable audit log is what lets you answer an incident, satisfy an auditor, and honor a data-subject request.

17.3 The regulatory surface

Agentic systems intersect several regimes at once. They process personal data (privacy law), they make automated decisions about people (AI-specific law), and they are deployed by organizations that must demonstrate controls (assurance standards). The platform must be built so these obligations can be met by construction.

The throughline is that compliance is an architectural property, not a document written at the end. Right-to-erasure means your memory and retrieval layers (Ch. 10, 11) must support targeted, provable deletion — including embeddings and graph nodes derived from the deleted data. Automated-decision limits mean high-stakes actions route through human approval (Ch. 5). Data residency means region-aware placement of stores and logs. Auditability means the trail of §17.2 exists. Build these in from the start; bolting them on later is, in practice, a rewrite.