Concept dictionary
Runtime Governance
Runtime governance is the use of controls while an AI system is operating to observe, authorize, constrain, interrupt, and record its actions as context changes.
- Review state
- Reviewed in POC
- Freshness
- Current
- Version
- 1
Also called
- Runtime Governance
- AI Runtime Governance
Remember it this wayGovern the action at the moment it can happen.
In plain language
Runtime governance turns policy into decisions at the moment an AI tries to act. It can check identity, permission, data sensitivity, destination, budget, and prior actions before a tool call proceeds, then record the decision and escalate when a person must decide.
Why it matters
Pre-deployment tests cannot predict every path an agent will take through changing data and tools. Live controls can contain unexpected behavior, preserve evidence, and keep authority boundaries active after the system leaves the test environment.
Example
An agent reading a support ticket encounters an instruction to send customer records to an outside address. A runtime control checks the destination and data classification, blocks the tool call, records the reason, and requests human approval instead of relying on the model to police itself.
Common misconception
Runtime governance is not just monitoring and not a replacement for design-time review. Monitoring can observe an action without changing it. Runtime governance connects policy to allow, deny, restrict, or escalate decisions while preserving accountability for those controls.
Related terms
Sources
- NIST AI RMF Playbook, “Manage”calls for post-deployment monitoring, appeal and override, incident response, recovery, and decommissioning as operating conditions change.
- Microsoft, Agent Governance Toolkita primary implementation reference for runtime policy enforcement, identity, audit, and action controls around AI agents.
Learn more
- Connect the lifecycle-wide responsibilities in [[ai-governance|AI Governance]] to execution-time controls.
- Design consequential uncertainty to [[fail-closed|Fail-closed]] or escalate through [[human-oversight|Human Oversight]].