Epic: Agent Governance & Decision Assurance #181

Goal

Establish end-to-end decision assurance for governed agent execution by composing MCTL's canonical identity, policy, approval and execution primitives so we can prove:

intent -> policy -> authority -> exact approval -> exact execution -> result

Human approval MUST NOT be treated as sufficient evidence of governance.

Priority: P1. Technical coordination: mctl-api, with mctl-agents and mctl-gitops runtime ownership.

Status — implementation active

The discovery spike #182 is complete. Its D1–D5 audit is merged in #200 and the owner disposition is CREATE NEW EPIC / retain this epic as the coherent implementation boundary.

Canonical roadmap activation and implementation graph: #201, merged 2026-10-18. roadmap/epics/agent-governance-decision-assurance.yaml is now active.

The audit found that MCTL already has most required primitives. The implementation problem is consistency across execution paths, lifecycle boundaries and durable evidence — not creation of another governance framework.

Required implementation work

Approval binding and lifecycle

• fix(devloop): reinvestigate must supersede the pending approval grant mctl-agents#701 — proposal rewrite must supersede/refuse the stale pending approval grant.
• fix(devloop): a failed approval must not project success or completed mctl-agents#702 — refused/failed approval must have typed non-success terminal and retry semantics.
• governance: require reviewed-content binding for direct proposal approval mctl-gitops#1979 — direct governed approval must bind the exact content reviewed before the human decision; no silent execution-time self-binding.

Execution authorization and policy enforcement

• governance: unify execution authorization across manual and autonomous paths mctl-agents#703 — one execution-authorization contract across manual, Temporal and autonomous/no-human-gate paths.
• governance: productionize policy approval checkpoint coverage mctl-gitops#1980 — productionize the canonical policy approval checkpoint for governed paths and close/classify normal transport gaps.

Decision context and durable trace

• governance: define authority and decision-context contract with execution-time revalidation mctl-api#700 — explicit authority/decision-context contract with expiry/freshness and execution-time authority/policy revalidation.
• governance: persist durable decision and execution-attempt records mctl-api#701 — durable typed decision and execution-attempt records linking intent, policy, authority/approval, exact action, attempts and result.

Existing owners / dependencies

• Unified Identity/AuthZ: Epic: MCTL Unified Identity on ZITADEL and Agent Identity #91 — completed; reuse canonical principals, tenant and delegation semantics.
• Agent Platform / governed execution: roadmap(agent-platform): agent definitions, execution profiles and governed agent creation #18 — reuse existing policy, approval and operation contracts.
• Observability: roadmap(observability): vendor-neutral execution tracing for agents and DevLoop #55 — owns governance metrics/telemetry integration; sampled traces are not the durable audit record.
• Agent Runtime Assurance: roadmap(agent-runtime-assurance): adaptive adversarial assurance for governed agents #151 — owns adversarial scenarios, deterministic replay and regression promotion for the resulting invariants.
• Agent Commerce: Agent Commerce #173 — exact-action paid invocation remains a concrete cross-component audit case.

These are capability inputs/owners, not a reason to create parallel frameworks here.

Completion criteria

• Proposal mutation cannot leave a stale human-decidable approval, and refusal/failure cannot project success.
• Every governed human approval, including direct GitOps approval, binds the exact reviewed operation/content before the decision is recorded.
• Manual, Temporal and autonomous execution entry points cannot disagree about whether the same action is authorized.
• Governed paths use the canonical policy checkpoint or are explicitly/enforceably classified outside that boundary; normal supported transports cannot bypass it.
• Decision-time authority/context plus execution-time expiry, permission and policy drift semantics are explicit and tested.
• A durable record reconstructs intent -> policy -> authority/approval -> exact action -> every execution attempt -> terminal result without relying on sampled telemetry.
• Required invariants are promoted into the existing Runtime Assurance harness where appropriate.
• No second authorization, policy, approval, audit, telemetry or workflow framework is introduced.

Deliberate non-blocking follow-ups

Break-glass implementation is not required for the first completion boundary; if needed it must be an explicit attributable override design, not an implicit bypass. Cryptographic/tamper-evident audit integrity is also separated from the required durable decision-record model and can be evaluated after the complete append-only/reconstructable chain exists.

Evidence

• Spike: Evaluate MCTL governance beyond human-in-the-loop approvals #182 — completed decision-assurance spike and owner disposition.
• feat(agents): issue-199-retry-spike-execute-182-governance-audit #200 — merged current-state audit report.
• roadmap: activate Agent Governance & Decision Assurance implementation #201 — merged roadmap transition from proposed discovery-only graph to active implementation graph.
• feat(approval): bind proposal content digest at mctl-api human decision time mctl-agents#681 — production-proven exact proposal-content binding for canonical DevLoop P1; this remains a baseline control, not proof for every governed path.