Governance Frameworks for Real-World Agentic Systems

Develop comprehensive governance frameworks for agentic reasoning systems that integrate model-level alignment, agent-level policy controls, and ecosystem-level interaction oversight, and demonstrate their effectiveness under realistic deployment conditions.

Background

Governance of agentic systems is challenging due to long-horizon planning, persistent memory, and real-world action execution. Failures may arise from interactions across time and components, complicating attribution and auditing.

Existing guardrails and benchmarks primarily address short-horizon behaviors; planning-time failures and multi-agent dynamics remain underexplored. A holistic governance framework must address alignment, policies, and ecosystem interactions in realistic settings.

References

A central open problem is to develop governance frameworks that jointly address model-level alignment, agent-level policies, and ecosystem-level interactions under realistic deployment conditions.

— Agentic Reasoning for Large Language Models  (2601.12538 - Wei et al., 18 Jan 2026) in Section 7.6

Four open problems bound what the framework can currently guarantee. Sensor-manipulation adversaries who target both V2X messages and the physical observations used to validate them can evade Tier 1 cross-modal reasoning - closing this gap requires hardware-rooted sensor attestation that current automotive standards do not yet specify. Certificate propagation latency creates a revocation window that behavioral flagging only partially closes, and resolving it requires changes at the SCMS standards level rather than the detection layer. The autonomous execution of Drop and Quarantine responses operates without regulatory authorization frameworks that do not yet exist, and near-term deployment may require constraining autonomous action to Escalation-only pending future standardization.

— Autonomous Cyber Defense in Connected Vehicles: A Multi-Agent Approach to V2X Security  (2608.19135 - Medam, 19 Aug 2026) in Section VI.C, “Regulatory Frameworks for Autonomous Security Response”; Section VII conclusion

Whether and how current architectural approaches satisfy them is an open question we return to in \Cref{sec:implications}; \citet{jahn2026grace}'s neuro-symbolic architecture instantiates one direction for internal containment, and the engineering literature on runtime guardrails another for external containment.

— Anticipatory Human Oversight of Agentic AI: A Philosophical Account  (2609.24242 - Baum et al., 21 Sep 2026) in Section 3.5, subsection “Three Architectural Desiderata”

Which family, or which combination, will turn out the more tractable route for any given deployment is an open question; what the framework contributes is a specification of what such routes must deliver to count as anticipatory oversight at all.

— Anticipatory Human Oversight of Agentic AI: A Philosophical Account  (2609.24242 - Baum et al., 21 Sep 2026) in Section 6, subsection “Architectural research”

Designing institutional safeguards that enable agent collectives to detect, escalate, and self-correct such failures autonomously is therefore an important open problem.

— A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research Swarms  (2609.04170 - Paglieri et al., 3 Sep 2026) in Section 5, “Discussion and Broader Implications”

we read this as evidence that the institutional design problem for inference governance is genuinely open. The mechanisms in Section 3 and the scenarios in Section 6 give the technical and political substrate; the institutional question is unresolved.

— Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance  (2609.10105 - Ansari, 9 Sep 2026) in Section 6.3, Lessons from existing inference-monitoring regimes

The episode echoes the July incident at small scale: institutional controls reach only the resources the institutions model, and extending them to shared infrastructure remains open.

— A Society of Researchers: Designing Institutions for Populations of Autonomous Research Agents  (2610.10468 - Asaria et al., 7 Oct 2026) in C5, Section 5, “Open Problems”

Our deployment has not run such a call, and we do not claim it would succeed.

— A Society of Researchers: Designing Institutions for Populations of Autonomous Research Agents  (2610.10468 - Asaria et al., 7 Oct 2026) in C6, Section 5, “Open Problems”

These results support evaluating admission and presentation separately: selection quality provides task-specific safety gains, while preserving beneficial memory use remains unresolved.

— What to Admit and How to Present: Governing Persistent Memory in LLM Agents  (2610.11188 - Liu et al., 8 Oct 2026) in Abstract; Section VII, Conclusion