Beyond the Autonomous Sandbox: The Contextual Agentic Enterprise (CAE) and the Future of Corporate AI Governance
An autonomous agent demo has a token trace. A production security review needs evidence. This article sets out how CAE separates thinking from committing, using a fictional gas-turbine incident, and what an executive roadmap for governed agency could look like.
Written as at 24 August 2026.
ai-governanceagentic-aicontext-engineeringsystems-of-recordpolicy-as-codeevidenceenterprise-architecture
About this article. The Contextual Agentic Enterprise (CAE) is a vendor- and platform-agnostic architecture framework from Contextual Agentic. Every organisation’s systems, regulatory obligations and risk appetite differ, so any adoption or use of CAE should be undertaken in consultation with Contextual Agentic or an authorised advisory partner, who will tailor the framework to that organisation. The industrial incident used throughout is a fictional, illustrative scenario; its figures do not describe any real plant, vendor or organisation.
Every large enterprise now has at least one autonomous agent demo it is proud of. An agent reads an alarm, searches the maintenance manuals, reasons about a fault, and raises a purchase order, all in under a minute, all in front of an executive committee that leaves the room impressed.
Then the demo goes to the production security review, and it stops.
It stops because the review board asks questions the demo was never designed to answer. Which credentials did the agent use to raise that order? Who delegated the authority? What data was it looking at, and can we prove that data was current? If the order turns out to be wrong, what will we show the auditor, the insurer, or the regulator? The demo has a token trace. The board needs evidence.
This article argues that the gap between those two things, a trace and evidence, is the central problem of corporate AI governance, and that closing it is an architectural decision, not a policy memo. The architecture this article describes is the Contextual Agentic Enterprise (CAE).
Part I: The Enterprise AI Paradox
The paradox is simple to state. The capabilities that make foundation models valuable (open-ended reasoning, multi-step planning, the ability to find a path nobody scripted) are exactly the capabilities that make them unacceptable as direct writers to a system of record.
A system of record is the enterprise’s legal memory. The ERP ledger, the maintenance management system (CMMS), the manufacturing execution system (MES) and the control layer (SCADA) are where the organisation records what it owns, what it owes, what it has done and what it has authorised. They are built on determinism: the same transaction, presented twice, produces the same result, and every change can be traced to an accountable identity.
A language model is probabilistic. The same prompt can produce different plans. A plausible-sounding but unfounded inference, a hallucination, is not a bug to be patched out; it is a property of how these models generate text. When that probabilistic output is allowed to write directly into a deterministic system, the enterprise inherits the model’s uncertainty as operational, financial and legal exposure.
Most autonomous agent pilots that stall at the production review stall for one of four reasons:
| Review question | What the typical demo offers | What the review board needs |
|---|---|---|
| Whose authority? | A static API key with broad write scope | Delegated, bounded authority tied to a role and a limit |
| What did it know? | Conversation history and retrieved document chunks | A verifiable snapshot of authoritative system state |
| Why this action? | A reasoning trace in natural language | Evidence that a reviewer can check against records |
| What stops a bad action? | A prompt instruction (“never exceed budget”) | An enforced control that the model cannot talk its way past |
Core principle 1: Instructions are not controls. A rule written into a prompt is a request to a probabilistic system. A rule enforced outside the model is a control. Auditors, insurers and regulators recognise only the second.
The review board is not being obstructive. It is applying the standards it applies to any system that can move money or change a safety setting. The executive question is how to design AI systems that meet them without losing the reasoning that justified the investment.
Part II: Deconstructing the Vocabulary
Much of the confusion in board conversations comes from three terms being used interchangeably. They describe different things, and the differences matter for risk.
An AI agent is a worker unit: a software component built around a language model, a set of instructions and a fixed set of tools. It is triggered, performs a bounded task (summarise this alarm, classify this ticket) and returns a result.
Agentic AI is a reasoning pattern. The model decomposes a goal into steps, chooses tools, inspects intermediate results, revises its plan and continues until it decides it is done. This is where the step-change in capability lies, and also where the new categories of failure appear: cascading errors, goal drift, unplanned spend and unauthorised changes to records.
The Contextual Agentic Enterprise is an operating architecture and a governance doctrine. Agentic reasoning is retained in full, but it operates over a verified snapshot of enterprise context, and every proposed change to a system of record must pass through a deterministic, non-AI control layer before it is committed.
| Dimension | AI Agent | Agentic AI | Contextual Agentic Enterprise |
|---|---|---|---|
| What it is | A task-executing component | A planning-and-tool-use pattern | A governed operating architecture |
| How context is held | Short-lived session memory | Conversation history, scratchpads, retrieved documents | Signed, time-bound snapshots of authoritative system state (Context Contracts) |
| How authority is held | Static credentials | Tool permissions inside the agent’s configuration | Agents hold no write credentials; authority sits at a commit boundary |
| Typical failure | Wrong answer, broken tool call | Runaway loops, overspend, unauthorised change | Unsafe proposals stopped before commit and routed to a human |
| What is left for the auditor | Application logs | Model traces | A Minimum Action-Evidence Bundle per action, anchored in a tamper-evident ledger |
The practical consequence for executives is this: buying better agents, or more capable agentic frameworks, does not by itself move an organisation from the second column to the third. The third column is a design choice about where authority and evidence live.
Part III: The Nature of Multi-Dimensional Context
In most AI conversations, “context” has been reduced to two numbers: the size of the model’s context window and the number of documents retrieved for each query. Both are useful. Neither captures what context means in an operating enterprise.
CAE treats context as having three layers, each of which carries its own business risk.
Layer one: the order of questions changes the answer
Researchers in cognitive science and in a branch of mathematics borrowed from quantum theory have long observed that, for people and for some formal systems, the order in which questions are asked changes the answers given. The technical term is non-commutativity: asking A then B is not the same as asking B then A.
Executives do not need the mathematics to recognise the business pattern. Consider two questions about a turbine:
- A: Can we run above nominal pressure to meet tonight’s demand?
- B: Has the safety relief valve passed its annual inspection?
A team that answers A first, under commercial pressure, is in a different decision posture from a team that answers B first. Physical operations behave the same way: throttling a machine and then inspecting it yields different readings from the reverse. Order is part of the context.
The business risk: a retrieval system that simply gathers the “most relevant” documents has no notion of order, precondition or dependency. It can hand an agent the commercial question and the safety question as equal peers. CAE makes sequencing and preconditions explicit, so that safety-relevant facts are established before commercially attractive options are evaluated.
Core principle 2: Context is not a pile of relevant documents. It is a structured, ordered, time-bound account of state, obligations and authority. Relevance without order is how sound reasoning reaches unsafe conclusions.
Layer two: unstructured knowledge must be anchored to records
Enterprises hold three kinds of knowledge: unstructured (incident chat, technician voice notes, PDF manuals), structured (ledgers, sensor time-series, inventory balances) and relational (knowledge graphs linking assets, parts, warranties and suppliers). Agents are good at reading the first kind. The risk arises when an agent acts on a technician’s chat message (“we’ve got a spare bearing somewhere”) without checking it against the inventory ledger that says otherwise.
The business risk: decisions grounded in narrative rather than records. CAE requires that any fact an action depends on is drawn from, or reconciled with, an authoritative system.
Layer three: people, processes and authority
The most underestimated layer is socio-technical. An action that is entirely appropriate on a weekday day shift, with a lead reliability engineer on site, may be inappropriate at 2 a.m. on a skeleton weekend crew. Delegation limits, certifications, shift handovers, lockout/tagout procedures and statutory obligations are all context. They are rarely in the documents an agent retrieves, and they are exactly what the review board will ask about.
The business risk: an agent that is technically correct and organisationally unauthorised. In governance terms, that is still a control failure.
Part IV: The Architecture of Governed Action
CAE separates thinking from committing. Agents are free to reason. They are not free to write. Three components make that separation enforceable.
1. Context Contracts: what the agent is allowed to know
When an event occurs (an alarm, a request, an exception), CAE assembles a Context Contract: a read-only snapshot of the relevant state, drawn live from the systems of record. For a maintenance event, that means asset history from the CMMS, inventory balances from the ERP, live telemetry from SCADA, the current shift roster and the delegation limits of the people on duty.
The contract is time-stamped, fingerprinted and signed. Agents reason over it; they do not reach past it. If the snapshot is older than a defined freshness window (fifteen minutes in the reference design), any action derived from it is refused.
Governance guarantee: every action can be traced to the exact state of the enterprise the agent was shown, and that state cannot be altered after the fact.
2. The Minimum Action-Evidence Bundle: what the agent must prove
Agents do not submit actions. They submit Minimum Action-Evidence Bundles (MAEBs). A MAEB packages the proposed change (for example, a work order and a part reservation) together with the evidence for it: the telemetry readings that justify it, the procedures that apply, the estimated cost, the loss it is expected to avoid, and a reference to the Context Contract it was derived from.
The word minimum matters: the smallest set of evidence a competent reviewer would need. No more, so it can be checked automatically; no less, so it can be defended.
Governance guarantee: every proposed change arrives with its justification attached, in a form a machine can check and a person can review.
3. The Deterministic Shell: where authority actually lives
The Deterministic Shell is the commit boundary. It is a conventional, rules-based policy engine (the reference design uses Open Policy Agent, a widely adopted open-source policy engine) and it contains no language model. It holds the write credentials the agents lack. For every MAEB, it checks a set of invariants: Is the Context Contract fresh and correctly referenced? Does the evidence meet the defined threshold? Is the cost within the delegated limit? Does the cost case hold? Will the reservation leave safety stock intact? Is the proposed operating change within safe bounds?
If every check passes, the Shell commits the change to the systems of record and records the bundle in a tamper-evident audit ledger. If any check fails, the action is not committed; where the failure is a matter of authority rather than error (the cost is above the agent’s limit, for example), the bundle is routed to the accountable human with its evidence attached.
Core principle 3: The model proposes; the Shell disposes. Language models never hold write credentials to systems of record. Authority is exercised by a deterministic control that behaves the same way every time and can be tested like any other financial or safety control.
What the Shell does and does not guarantee
Boards should be clear about the limits. The Shell guarantees that no action outside the encoded policy reaches a system of record, and that every committed action is evidenced. It does not guarantee that the agent’s diagnosis is correct. A well-evidenced, within-limits action can still be the wrong call, just as a well-documented, properly approved human decision can be. What changes is that the error is bounded, explainable and attributable.
In testing the reference policy for this article, one gap illustrates the point. When an agent-reported telemetry value was inflated far beyond the real reading, the policy still approved the action, because it trusted the number the agent supplied. The remedy is architectural: the Shell must check evidence against the signed Context Contract, not against the agent’s account of it. The principle generalises: a control is only as strong as the provenance of the facts it checks.
Part V: The Acid Test: A Gas Turbine at 7.2 mm/s
Fictional, illustrative scenario. Figures are constructed for illustration.
At 01:40 on a weekday night, vibration on the drive-end bearing of a primary gas turbine crosses its alarm threshold of 7.2 mm/s. Three architectures respond.
Response A: the point agent
A single AI agent reads the alarm, writes a clear natural-language summary and emails it to the plant manager’s general inbox. Nothing is assigned. Nobody on shift is paged. The summary is accurate; the outcome depends entirely on who reads email at 2 a.m.
Risk profile: low exposure, low value. The agent cannot cause harm, and it cannot prevent it either.
Response B: unbounded agentic AI
A capable agentic system searches the manuals, correctly suspects bearing wear, and then keeps going. It finds an ERP purchasing API it has credentials for and raises a $45,000 order for a complete replacement assembly from a non-contracted supplier with a faster lead time. The order breaches the procurement delegation limit and bypasses the approved supplier agreement. Security monitoring flags the anomalous write and locks the service account. The morning shift inherits an unexplained purchase order, a locked integration and a turbine that is still vibrating.
Risk profile: high exposure. The reasoning was impressive; the governance outcome was a control breach. Note that the agent’s “creativity” (finding a faster supplier) is indistinguishable, from the audit committee’s perspective, from a policy violation.
Response C: the Contextual Agentic Enterprise
- Context. A Context Contract is compiled: rolling vibration baselines, the asset’s maintenance history, on-hand inventory (three bearings of the required part, with a safety stock of two), the shift roster and the delegation limits of the on-duty supervisor.
- Reasoning. A small mesh of specialist agents analyses the vibration spectrum, identifies a likely inner-race defect at 94% diagnostic confidence, and proposes a balanced plan: reduce turbine speed to 85% to slow damage progression, reserve one bearing from site stock, and schedule replacement for the 06:00 low-demand window.
- Evidence. The plan is packaged as a MAEB: telemetry excursion, applicable procedures, a $12,400 estimated repair cost against a projected $180,000 cost of an unplanned outage.
- Control. The Deterministic Shell checks the bundle. The contract is six minutes old (within the 15-minute window). Cost is within the $25,000 autonomous limit and below the avoided loss. Reserving one bearing leaves two, so safety stock is intact. An 85% operating point is inside the permitted 80–100% band.
- Commit. The work order and part reservation are written to the maintenance and ERP systems in one transaction. The bundle is anchored in the audit ledger.
Had the agents proposed Response B’s $45,000 order, the Shell would not have refused it silently. It would have routed the bundle to the plant lead, with the evidence, the cost and the reasons it exceeded autonomous authority. The human makes the decision the organisation has reserved for a human.
| Point agent | Unbounded agentic AI | CAE | |
|---|---|---|---|
| Diagnosis | None | Correct | Correct, with stated confidence |
| Action | $45k unauthorised order | $12.4k in-policy plan, committed | |
| Time to safe state | Depends on inbox | Delayed by lockout | Minutes |
| Authority | N/A | Breached | Within delegation; above-limit routed to human |
| Audit position | Weak | Indefensible | Evidence bundle per action |
Part VI: Addressing the Critics
The strongest objection to CAE comes from practitioners who have watched agentic systems solve problems no one anticipated. Their case deserves a direct answer.
Objection 1: “This is the enterprise service bus all over again.” Pre-defined schemas and policy layers, the argument goes, recreate the rigid integration architectures that slowed enterprises for two decades, and strangle the emergent problem-solving that makes foundation models valuable.
Response: the comparison misreads where the rigidity sits. A service bus scripted the process. A Context Contract scripts the ground truth and the liability limits, and leaves the reasoning free. Agents can still explore hypotheses, compare options and propose actions nobody anticipated. What they cannot do is commit those actions outside delegated authority. In a system of record, an unanticipated path to a write is not emergence; from the audit committee’s chair, it looks the same as a breach.
Objection 2: “Governance slows time-to-value.” Building contracts, evidence bundles and policy rules adds weeks to every use case.
Response: it does, and executives should budget for it honestly. But the real comparison is with an ungoverned system that never clears the security review, or is rolled back after its first unauthorised write. Much of the cost is also reusable: a second use case on the same asset class inherits most of the first one’s contracts and invariants.
Objection 3: “Human dynamics cannot be codified.” Trust, fatigue and informal authority do not reduce to rules, and trying to make them do so creates bureaucracy.
Response: this is the critics’ strongest point, and CAE partly concedes it. Not every workflow should be automated. CAE’s discovery practice, Agentic Flow Mining, measures how far a workflow’s decisions can be explained by what is recorded in enterprise systems. Where decisions depend heavily on unrecorded judgement, the framework’s answer is not to codify the judgement but to withhold autonomy until the workflow is better instrumented. Codifying what is already recorded (delegation limits, certifications, shift coverage) is not bureaucracy. It is the minimum standard any human would be held to.
Core principle 4: Autonomy is earned per workflow, not granted per platform. A workflow qualifies for autonomous execution when its decisions can be explained by recorded state. Where they cannot, the right investment is instrumentation, not a more capable model.
Part VII: The Executive Roadmap
The transition to governed agency is a sequence, not a switch. The four phases below assign primary ownership to the executive roles that typically hold the relevant accountabilities. The phases, timings and owners are a reference pattern; each organisation should tailor them with Contextual Agentic or an authorised advisory partner before committing to a programme.
Phase 1: Separate thinking from committing (0–3 months)
Lead: CISO, with the CIO. - Inventory every AI agent and pilot with write access to a system of record. Remove standing write credentials from agents. - Stand up a commit boundary for one high-value, well-understood workflow. Begin with a small number of invariants: freshness, delegated cost limit, schema validity. - Define the escalation path: who receives above-limit actions, and how fast must they respond.
Exit criterion: no agent can write to a system of record except through the commit boundary.
Phase 2: Make context a governed asset (3–9 months)
Lead: CIO, with data and enterprise architecture. - Define Context Contracts for the first two or three workflows: which systems, which fields, what freshness window. - Treat contracts as versioned, owned artefacts with a named business owner, not as integration plumbing. - Reconcile unstructured knowledge to records: where agents rely on documents, tie the facts that drive actions back to an authoritative source.
Exit criterion: every committed action references a signed, time-bound snapshot of state.
Phase 3: Earn autonomy with evidence (6–15 months)
Lead: COO, with operations and risk. - Use process discovery on transaction and maintenance histories to score candidate workflows on how far recorded state explains decisions. - Run qualifying workflows in shadow mode: the system proposes, humans decide, and the Shell’s verdicts are compared with human decisions. - Grant autonomy in tiers (by asset class, cost band and shift coverage) and expand only on observed performance.
Exit criterion: each autonomous workflow has a documented qualification record and a shadow-run history.
Phase 4: Operate governed agency at scale (12 months onwards)
Lead: jointly, reporting to the audit and risk committee. - Put policy rules under the same change control as financial delegations. Test them against known-bad cases before every release. - Report on governed agency as a control: actions committed, actions escalated, escalation turnaround, policy exceptions and post-incident findings. - Re-qualify workflows periodically. Processes drift; the evidence that justified autonomy last year may not hold this year.
Exit criterion: the board receives regular assurance on AI-originated actions in the same form as other material controls.
| Role | First question to ask on Monday |
|---|---|
| CIO | Which of our agents hold write credentials to a system of record today? |
| CISO | Could any of our AI controls be bypassed by a sufficiently persuasive prompt? |
| COO | Which of our workflows are decided by what is recorded, and which by what is remembered? |
| CFO | What delegated limit would we accept for an AI-originated action, and what evidence would we require at that limit? |
Beyond the plant floor
The turbine is a convenient test case, not the boundary of the pattern. Any domain where an AI-originated action would change a record of entitlement, money or care has the same three layers of context and needs the same commit boundary. In the most sensitive of these, such as clinical orders or benefit decisions, the right policy outcome for most actions will be Escalate: the Shell assembles the evidence, and a clinician or caseworker decides.
Conclusion: from uninsurable to accountable
Enterprises do not need less capable AI. They need AI whose capability is exercised inside the same structures of authority and evidence that govern every other actor permitted to change the organisation’s records.
The Contextual Agentic Enterprise is one way to build that structure: let models reason freely over verified context, and let a deterministic control decide what is committed. When the turbine fails, or the ledger is questioned, the organisation does not produce a prompt history. It produces the evidence, the authority and the decision, what it would be expected to produce for a human.
That is the standard the production security review has been applying all along. The task now is to build systems that can meet it.
CAE is an agnostic architecture framework; it is not a product and does not by itself fit any specific organisation. Adoption, adaptation and use of CAE should be undertaken with advice from Contextual Agentic or an authorised advisory partner, so that it is tailored to the organisation’s systems, obligations and risk appetite. This article does not constitute engineering, safety, legal or financial advice. The gas turbine scenario is fictional. Reference policy behaviour described in Part IV was observed by running the published reference policy in Open Policy Agent against constructed test inputs; it is illustrative, not a certification of any product.
Further reading: The Contextual Agentic Enterprise: From Systems of Record to Governed AI Agents and Enterprise Outcomes (Polymath Signal Press, 2026) develops the architecture, reference policies and schemas in full.
References
- Open Policy Agent, Policy Language documentation (the policy engine named in Part IV as the reference design's choice). https://www.openpolicyagent.org/docs/policy-language
Related
The Contextualised Enterprise: Connecting Agentic Reasoning to Governed Execution
A dual-lens architecture: contextual reasoning proposes, deterministic systems of record decide and commit, and evidence links the two. Includes a fictional procurement walkthrough, a policy gate tested in OPA, and a truthful treatment of evidence and transparency logs.
Why Enterprise AI Needs a Deterministic Shell
Don't try to make the model deterministic or simply trust it. Let it propose, and put identity, authority, schema, state and commitment in a shell that decides at the Commit Boundary.
Context Is Not a Prompt: Introducing the Context Contract
Most context failures are not retrieval misses. They are correct material given to the wrong purpose. A Context Contract declares, versions and tests what an agent may know.