Agents for Humans: Building Governor Agent — Keeping Human Authority Outside the Model
Governor Agent explores how AI agents can remain useful without becoming the final authority over software decisions. Built for the Agents for Humans Hackathon with Strands Agents SDK, it combines explicit governance sources, deterministic gates, validators, sanitized evidence, and ALLOW / DENY / ESCALATE decisions to keep human authority outside the model.
AI agents are becoming increasingly capable of inspecting repositories, generating code, proposing architectural changes, and executing complex workflows.
But capability creates a governance problem.
A software agent can produce a technically valid change while still violating the rules that govern a system: ownership boundaries, architectural constraints, authorization limits, policies, scope, or evidence requirements.
That observation became the starting point for Governor Agent, my project for the Agents for Humans Hackathon.
Governor Agent explores a simple architectural principle:
Human authority must remain outside the model.
The goal is not to make the language model better at deciding what it is allowed to do. The goal is to design a system where the model is structurally incapable of granting itself authority.
The problem: correctness is not authorization
Consider an AI coding agent that proposes a change.
The code may compile.
The tests may pass.
The implementation may even be technically elegant.
But those facts do not answer several other important questions:
- Was the agent authorized to modify that component?
- Does another team or owner control it?
- Does the change violate an architectural boundary?
- Is there sufficient evidence to justify the action?
- Does an explicit policy prohibit it?
- Is the available information incomplete or ambiguous?
These are governance questions rather than generation questions.
That distinction shaped the architecture of Governor Agent.
Instead of asking the model to make an unconstrained judgment, the system evaluates a structured change request against explicit governance sources, deterministic gates, validators, and evidence.
The result is one of three decisions:
ALLOW — the action is within the demonstrated authority and policy boundaries.
DENY — the action conflicts with an explicit policy or constraint.
ESCALATE — the available evidence or authority is insufficient, so the decision returns to a human.
ESCALATE is especially important.
In an agentic system, uncertainty should not silently become permission.
Separating reasoning from authority
Governor Agent uses the Strands Agents SDK as the agent framework.
Strands provides the agentic orchestration layer, while governance authority remains in explicit system components outside the model.
Conceptually, the workflow looks like this:
Human intent or builder change
→ Structured Change Request
→ Governor Agent / Strands
→ Limited Inspection Tools
→ Governance Sources
→ Deterministic Governance Gates
→ Validators and Evidence
→ ALLOW / DENY / ESCALATE
→ Append-only Audit Trail
The model can participate in interpreting information and coordinating the workflow, but it is not the source of policy.
This means the model cannot legitimately:
- invent a policy,
- grant additional authority,
- expand its own permissions,
- override a failed validator,
- or transform missing evidence into a verified fact.
This separation became one of the most important lessons from building the project.
An intelligent component can assist governance without becoming the governance authority.
Designing explicit governance sources
A common temptation when building agent systems is to encode too much institutional knowledge inside prompts.
That approach is convenient, but it can make authority difficult to inspect.
Governor Agent instead treats governance information as explicit inputs to the decision process.
The system can inspect sources representing things such as:
- permitted scope,
- ownership boundaries,
- architectural rules,
- explicit policies,
- authorization constraints,
- and required evidence.
The decision therefore depends on evidence that can be examined rather than solely on the model's internal interpretation.
This also improves auditability.
If Governor Agent returns DENY or ESCALATE, the decision can be associated with the governance evidence and validation results that produced it.
Evidence needs its own boundary
While developing Governor Agent, another problem became clear: giving an agent access to evidence does not mean every piece of evidence should be exposed to the model.
The project therefore includes an evidence boundary.
The conceptual flow is:
RawEvidence
→ classification
→ secret detection
→ minimization
→ sanitization
→ SanitizedEvidence
Only sanitized evidence crosses the model-facing boundary.
This matters because governance systems may inspect repositories, configuration, metadata, documentation, or other operational information.
A useful agent should receive enough information to reason about a decision without unnecessarily receiving secrets or unrelated sensitive data.
Evidence minimization therefore became part of the governance architecture rather than an afterthought.
Deterministic gates around probabilistic intelligence
Language models are probabilistic.
Policies frequently are not.
If a rule says an operation is prohibited, the model should not be able to reinterpret that prohibition into permission.
Governor Agent therefore combines agentic reasoning with deterministic governance gates and validators.
This creates an important division of responsibility:
The model can help understand a situation.
The deterministic layer determines whether mandatory constraints have been satisfied.
That architecture also means an optional model integration can enhance interpretation without becoming the ultimate decision authority.
Amazon Bedrock is represented in Governor Agent as an optional model composition, while the public demonstration is intentionally reproducible offline using synthetic fixtures.
This separation allowed me to demonstrate the governance mechanism without making remote inference a requirement for reproducing the project.
Three scenarios
The public demo uses three deliberately simple scenarios to make the decision semantics visible.
1. Safe change → ALLOW
The requested operation remains inside the demonstrated scope and satisfies the relevant governance constraints.
Governor returns:
ALLOW
2. Objective violation → DENY
The requested operation conflicts with an explicit objective or policy boundary.
Governor returns:
DENY
The important point is that the model cannot reinterpret the explicit violation into approval.
3. Authority ambiguity → ESCALATE
The system cannot establish sufficient authority for the requested operation.
Instead of guessing, Governor returns:
ESCALATE
The decision goes back to a person.
This third case captures much of the philosophy behind the project.
A trustworthy agent should know when the system has not demonstrated enough authority to proceed.
Why Strands Agents
The Strands Agents SDK provides the agentic foundation of Governor Agent.
Rather than using the agent as an unrestricted autonomous executor, I use it as one component inside a larger governed workflow.
Inspection tools are deliberately bounded.
Governance sources are explicit.
Validators operate outside model discretion.
Evidence is typed and sanitized.
Decisions are recorded.
The resulting architecture is less about maximizing autonomy and more about making autonomy inspectable and controllable.
For me, that is an important direction for human-centered agents.
The question is not simply:
How capable can the agent become?
It is also:
Where does its authority come from, how is that authority demonstrated, and what happens when the evidence is insufficient?
Auditability as a product requirement
Another design goal was making decisions traceable.
Governor Agent maintains an append-only audit trail and produces a human decision package.
This allows the system to preserve the distinction between:
- what was requested,
- what evidence existed,
- what validators reported,
- what governance rules applied,
- and what decision was ultimately produced.
This is particularly valuable for ESCALATE decisions.
Instead of returning only “I don't know,” the system can provide the human reviewer with a structured package describing why the automated process could not safely resolve the request.
Human involvement therefore becomes part of the architecture rather than an emergency fallback.
What I learned
Building Governor Agent changed how I think about AI-agent architecture.
My main lessons were:
1. Intelligence and authority are different things
A model can be highly capable without being authorized to act.
Architectures should represent that distinction explicitly.
2. Uncertainty should have a first-class outcome
Binary allow/deny decisions are not sufficient for many real systems.
ESCALATE provides a safe outcome when evidence, policy, or authority is ambiguous.
3. Policies should not depend entirely on prompting
Important restrictions deserve deterministic enforcement outside the model.
4. Evidence should be minimized
Giving an agent access to a system does not justify exposing every available piece of information to the model.
5. Human control works best when it is architectural
“Keep a human in the loop” is easy to say.
It becomes much stronger when the workflow contains explicit boundaries where human authority is required.
Reproducing the public demo
Governor Agent is available as an open-source project under the Apache 2.0 license.
Repository:
The public offline demonstration can be reproduced from the repository using the documented setup.
The main demo command executes the three scenarios:
- SAFE → ALLOW
- objective violation → DENY
- authority ambiguity → ESCALATE
The repository also contains architecture documentation, validation scripts, tests, and the evidence model used by the project.
Demo video:
Devpost submission:
Closing thought
Agentic systems will continue becoming more capable.
That makes governance more important, not less.
For systems operating around valuable software, data, infrastructure, or organizational decisions, the critical architectural question may eventually be less about whether an agent can perform an action and more about whether the system can demonstrate that it should.
Governor Agent is an experiment in making that distinction explicit.
Human authority must remain outside the model.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article