Governance is not a review step bolted onto the workforce — it is the control, enforcement, audit, and isolation plane that every governed call passes through, deny-by-default, before any work touches data.
ACME's real directory carries 120,120 humans and 205,034 non-human / service identities across 28 departments and 10 regions. An AI workforce inherits that surface. Without a governance plane in front of it, every agent is an ungoverned pathway to production data.
The governed fleet is 7 showcase agents on a 14-edge topological hand-off DAG plus 360 fleet agents mapped like-for-like to the real ACME org — every department, by headcount. All 367 are tenants in the control-plane registry.
Governance is a department made of machinery. Each control is a postgres-backed, durable store — it survives restart, and it is the same seam for all 367 agents.
No agent talks to data directly. The capability token is minted per-agent, the PEP is the only door, and the write lands RLS-isolated. The same path produces the audit record and the usage record as a side effect.
The stack is live on GCP — control, enforcement, runner, and observability planes on one VM, a real Samba-AD directory on another, and a dedicated data tier on Cloud Run + Cloud SQL. Every store is postgres-backed and reboot-durable.
The CP holds the 367-tenant registry, the enrollment ledger, the audit home, and the quarantine store. Admins provision, list PEPs, and pull reports through /cp/admin/* behind X-Admin-Key. It is in-network only — never published.
The PEP enrolls to the CP, pulls the 367-agent tenant slice via ETag-cached HttpRegistryProvider, and evaluates every call. Policy is deny-by-default; on allow it forwards verbatim to that tenant's backend. Nothing else gets through.
Isolation is not enforced in application code — it is forced at the database. Every agent is its own soul-svc tenant, and Cloud SQL runs FORCE RLS on the memory and key tables. The postgres superuser itself is subject to it.
Governance's product is evidence. Every governed call is signed into an Ed25519 audit chain with a SoulKey, written to a durable WAL, and shipped to the CP. Behavioral drift trips SoulWatch into automatic quarantine, and everything streams to SIEM.
Ed25519 SoulKey signatures make the chain tamper-evident. Durable WAL at /data/audit-wal survives restart. Review and verify through the PEP /admin/* analyst console (pdp.tiresias.watch).
SoulWatch detects behavioral drift and auto-quarantines to the shared postgres store. Events flow RFC5424 syslog → Promtail:1514 → Loki, with trajectory / model-baseline / campaign / drift analytics.
Every governed call reports usage into tzt_usage, so the ROI board answers the self-host-vs-API question per model. Governance routing favors free / Ollama tiers — and the audit trail shows where the money actually goes.
| Model | Observed $/call | Relative cost |
|---|---|---|
| opus-4.8 (paid) | $0.19 | |
| sonnet-4.5 (paid) | $0.03 | |
| deepseek-v4-pro (Ollama) | $0.002 | |
| gpt-oss:120b (Ollama) | $0.0015 | |
| Llama-70B (HuggingFace) | $0.0012 | |
| gemma-4-31b:free | $0 |
Deny-by-default enforcement, two credentials per call, a signed and durable audit chain, database-forced isolation, and automatic drift quarantine — one seam, 367 agents, every department. That is the function this department performs, live, today.