A governed agent is
a chain of decisions.

The architecture in one line

Intent → Decision contract → Central orchestration → Parallel cognition → Shared evidence → Synthesis and judge → Policy or human gate → Bounded execution → Observed effect → Outcome qualification → Continuous assurance.

This is the practical meaning of centralized decision authority with distributed cognition. Specialist agents can broaden evidence and throughput. They do not inherit unlimited authority because they can reason or call a tool.

1. Authority is now composed across the full action path

The effective grant is not a single role or token. It is the intersection of principal, workflow, agent, tool, resource, data, environment, budget and time constraints. No component may widen another component's grant.

The governed AI-SDLC makes the same boundary concrete for development. Decisions are front-loaded into declarative contracts, execution updates observed status, and progressive autonomy is earned through evidence rather than declared by an agent. The AI-SDLC reference implementation is useful implementation evidence, not a mandatory framework.

2. Context and memory became governed control surfaces

Long-running agents depend on what they remember, what they compress and what they retrieve. This release separates memory availability from memory validity and applicability. Consolidation, packing and reuse now need provenance, admission, conflict handling, expiry and regression evidence.

Compact-Memory LLM Agents reports that merge policy and context assembly materially change the quality-token trade-off. Its results are strongest in a 2K to 5K prompt-token regime and do not establish one universal memory design. The architecture therefore preserves alternative memory branches and requires operating-envelope tests.

3. Evaluation follows the trajectory, not only the answer

A successful final answer can hide a weak planner, wrong tool selection, unsafe invocation, missing evidence or an external effect that differs from the agent report. Harness now treats the execution trajectory and independently observed effect as qualification inputs.

This direction is reinforced by AgentAudit, which evaluates planning, memory, tool use, grounding, security and execution integrity from recorded traces. Its current evidence is limited to five models and nine tasks, with a single judge model. The useful control delta is failure attribution, not the composite score.

4. Runtime trust is continuous

Startup checks are not enough for a long-lived agent. Identity, policy, dependency, model, tool, state and effect evidence can change during execution. A provider failover, model takeover, credential rotation or policy reload is a governed transition that can invalidate the original approval.

The architecture now combines continuous runtime trust with sensitive-inference isolation. Workloads handling restricted data or privileged context need qualified placement, dedicated isolation where required, explicit egress control and evidence that survives runtime changes.

5. Generated code remains a build candidate

Specification-first regeneration is now an explicit architecture branch. SMART shows a narrow but important case: a dependency graph of worked-example design documents can regenerate a symbolic ML performance library and reproduce hand-audited reference models.

The transfer beyond that domain is not proven. Harness keeps a strict boundary: generated artifact ≠ validated artifact ≠ committed artifact. Reconciliation, dependency checks, tests, provenance and commit authority remain mandatory.

6. Human oversight is treated as a finite control

A human step does not prove meaningful oversight. Review quality depends on attention, competence, independence, evidence access and response time. High approval volume can reduce control quality instead of increasing it.

The release adds cognitive-capacity-aware routing: automate low-risk evidence work, reserve scarce human attention for material exceptions, and preserve independent challenge where assurance requires it.

7. Risk and regulation now connect to executable workflows

Contextual vulnerability priority binds exposure, known exploitation, automation, technical impact and business consequence before action. CRA reporting binds event classification, evidence, decision ownership, deadlines, notification and follow-up. Remediation is not closed until the changed state is verified.

This follows the broader lifecycle direction in the NIST AI RMF Core and the continuous risk-management obligations applicable to high-risk systems under the EU AI Act. Those sources do not mandate this exact architecture. They support continuous governance, traceability and assigned responsibility.

Reading shortlist: 5 primary sources

1. PARSER: Read in Parallel, Reason in Depth, 6 September 2026. Parallel chunk readers plus a central iterative lead agent. It reports +5.7 points over the strongest sequential-memory baseline on average, +12.0 at 896K tokens and up to 11x lower latency. A documented failure shows why worker findings need source-local evidence and conflict checks. Classification: substantive support for centralized authority with distributed cognition.
2. AgentAudit, 9 September 2026. Full-trace failure attribution across planning, memory, tools, grounding and execution. Limited by a small evaluation set and one fixed judge that was also evaluated. Classification: support with a judge-independence concern.
3. MemForest, 8 September 2026. Event and temporal memory partitioning with progressive merging. It retains 97.1% of textual-memory performance at 50% compression, but low-redundancy memory degrades at higher compression and poisoning controls remain future work. Classification: new implementation pattern for governed consolidation.
4. Compact-Memory LLM Agents, 4 September 2026. Strong evidence that merge and packing choices matter under tight budgets. One embedding stack, no selective forgetting and weaker results outside its compact-memory envelope limit generalisation. Classification: substantive support for an existing pattern.
5. Design Docs Are All You Need, 4 September 2026. A serious specification-first regeneration example, but only in symbolic ML performance modelling. Classification: new pattern with a narrow evidence boundary.

What did not change

• No framework, model, cloud stack or agent gateway became a mandatory dependency.
• Candidate research on agent viability remains research-only.
• A benchmark score is not production assurance.
• A human approval is not independent verification.
• Distributed cognition is not distributed decision authority.

Next qualification step

The architecture now needs reference implementation tests that replay the complete chain: decision contract, delegated authority, tool execution, observed effect, outcome verification and evidence retention. The next release should increment MINOR only when another Main capability is added. Evidence or wording corrections should remain PATCH changes.