Source-linked AI summary
MI9: An Integrated Runtime Governance Framework for Agentic AI
Charles L. Wang, Trisha Singhal, Ameya Kelkar, Jason Tuo
TL;DR
Agentic systems exhibit runtime behaviors and governance risks that conventional pre-deployment controls and infrastructure telemetry may miss. MI9 integrates agent-semantic telemetry, authorization monitoring, conformance checking, drift detection, and graduated containment into a framework for runtime oversight. In evaluation, it achieved a 99.81% detection rate and outperformed OpenTelemetry + Open Policy Agent by +5.55%, while authors note that synthetic traces and opaque APIs limit validation and visibility.
Problem
Agentic systems generate emergent runtime behaviors that conventional governance and infrastructure telemetry may not capture.
Method
MI9 integrates agent-semantic telemetry, continuous authorization, conformance rules, drift detection, and graduated containment as a model- and infrastructure-agnostic governance layer.
Results
MI9 achieved a 99.81% detection rate and exceeded OpenTelemetry + Open Policy Agent by +5.55%, with the highest scores across causal chain clarity, predictive alerting, and proactive intervention.
Takeaways & Limitations
MI9 provides an integrated runtime oversight framework intended to extend governance from static pre-deployment assessment to in-session intervention for agentic systems.
Takeaways & Limitations
The evaluation uses synthetic traces, while opaque APIs can obscure monitored cognitive steps and real-time monitoring adds computational overhead.
Abstract
from arXiv · showhide
Agentic AI systems capable of reasoning, planning, and executing actions present fundamentally distinct governance challenges compared to traditional AI models. Unlike conventional AI, these systems exhibit emergent and unexpected behaviors during runtime, introducing novel agent-related risks that cannot be fully anticipated through pre-deployment governance alone. To address this critical gap, we introduce MI9, the first fully integrated runtime governance framework designed specifically for safety and alignment of agentic AI systems. MI9 introduces real-time controls through six integrated components: agency-risk index, agent-semantic telemetry capture, continuous authorization monitoring, Finite-State-Machine (FSM)-based conformance engines, goal-conditioned drift detection, and graduated containment strategies. Operating transparently across heterogeneous agent architectures, MI9 enables the systematic, safe, and responsible deployment of agentic systems in production environments where conventional governance approaches fall short, providing the foundational infrastructure for safe agentic AI deployment at scale. Detailed analysis through a diverse set of scenarios demonstrates MI9's systematic coverage of governance challenges that existing approaches fail to address, establishing the technical foundation for comprehensive agentic AI oversight.
1 Introduction
Agentic systems create runtime governance challenges because planning, goal revision, memory, and tool coordination produce risks that pre-deployment controls may miss. MI9 addresses this gap with real-time oversight and intervention supporting corrigibility, safe delegation, and behavioral oversight.
- Runtime behaviors such as recursive planning loops, goal drift, and cascading tool chains create alignment risks that can elude pre-deployment controls.
- MI9 provides real-time oversight and intervention at key decision boundaries in deployed agentic systems.
- The framework supplies runtime infrastructure for corrigibility, safe delegation, and behavioral oversight.
2 Related Work
Existing alignment, governance, monitoring, and observability approaches leave important gaps in runtime intervention, agent-semantic visibility, adaptive safeguards, and multi-agent oversight. Current benchmarks and enterprise or security frameworks likewise emphasize task completion, observation, or static assessment over emergent runtime behavior.
- Training-time alignment methods such as RLHF [6] [28] and Constitutional AI [1] establish initial value alignment but do not address runtime governance gaps.
- Existing approaches cannot reliably address failures that emerge during autonomous operation or multi-system coordination [16].
- Leading benchmarks prioritize task completion over governance dimensions such as behavioral consistency [14] [21] [37] [13] [32].
- Monitoring and observability solutions provide reactive observation, while enterprise and security frameworks rely on static risk assessment inadequate for emergent runtime behaviors [36].
- Current governance gaps include limited runtime intervention, absent agent-semantic telemetry, static guardrails, and insufficient multi-agent oversight.
3 MI9 Framework
MI9 is a framework layer that instruments existing agent stacks with vendor-agnostic telemetry, temporal conformance rules, and graduated containment. Its integrated architecture supports enforceable runtime controls rather than prompt coordination alone.
- MI9 combines policies, telemetry schema, temporal conformance rules, and graduated containment without introducing a new agent or planning algorithm.
- MI9 is designed to instrument heterogeneous agent stacks while preserving enforceable runtime governance across existing infrastructure.
- The framework provides vendor-agnostic telemetry, temporal conformance rules over agent traces, and graduated, auditable containment that interposes on actions in real time.
4 Threat Model & Scope
MI9 scopes governance to runtime behavioral sequences, coordination, and agent adaptation, using integrated telemetry, authorization, conformance, drift, and containment mechanisms. Its controls are intended to operate across heterogeneous systems while preserving continuity through graduated intervention.
- Threat Model & Scope: MI9 targets runtime risks including goal drift, policy-skipping tool chains, delegated privilege escalation, and multi-agent coordination failures.
- Threat Model & Scope: The framework excludes pretraining and data harms, upstream supply-chain compromise, and non-sequential issues absent from event traces.
- Threat Model & Scope: MI9 assumes action-level telemetry coverage, bounded event reordering, and the ability to pause or contain agents.
- 4.2 Agency-Risk Index: The Agency-Risk Index scores autonomy, adaptability, and continuity, with higher tiers activating more governance components and more frequent monitoring.
- 4.3 Agentic Telemetry Schema: Agentic Telemetry Schema captures governance-relevant cognitive events such as goal revision, memory retrieval, and tool-chaining decisions that conventional telemetry misses.
- 4.4 Continuous Authorization Monitoring: Continuous Authorization Monitoring adapts permissions to objectives, delegation context, and behavioral anomalies, helping prevent privilege drift while preserving operational flexibility.
- 4.6 Behavioral Drift Detection: Goal-conditioned drift detection distinguishes intentional adaptation from suspicious behavioral change through goal-aware baseline comparison.
- 4.7 Graduated Containment: Graduated containment addresses mid-execution risks by avoiding abrupt termination that can corrupt state, leave tasks incomplete, or disable multi-agent oversight.
5 Framework Analysis
MI9 is evaluated as a runtime governance layer using synthetic, structured agent traces and governance-focused metrics. Across 1,033 scenarios, it achieves high detection and actionable-intelligence performance compared with OpenTelemetry and LangSmith baselines.
- Evaluation Setup: MI9 evaluates governance qualities—including detection, false-positive rate, coverage, causal clarity, early warning, and intervention—rather than task success.This separates runtime safety behavior from agent capability.
- Evaluation Setup: Synthetic traces are generated through a deterministic, three-stage LLM-driven pipeline, with held-out rubrics marking violations and evaluating all frameworks consistently.The setup supports systematic simulation, but the evaluation remains synthetic.
- Evaluation Setup: The evaluation covers 1,033 synthetic agent scenarios designed to represent diverse failure modes and stress-test rare misalignment behaviors.Structured simulation provides a reproducible testbed for behaviors unlikely to surface reliably in limited real-world traces.
- Evaluation Results: LangSmith’s lower detection performance reflects its infrastructure focus: it captures tool calls but misses cognitive events where many violations originate.Its perfect false-positive rate is qualified by detecting so few violations that false positives were effectively unlikely to accumulate.
- Evaluation Results: MI9 achieves the highest scores for causal-chain clarity, predictive alerting, and proactive intervention across actionable-intelligence metrics.Predictive alerting uses goal-conditioned behavioral baselines, while FSM conformance checking identifies multi-step violations in progress.
6 Conclusion
MI9 provides an integrated runtime-governance framework for agentic systems, moving beyond static pre-deployment assessment toward dynamic, in-session oversight. Its synthetic evaluation supports systematic failure-mode analysis, but production validation, instrumentation coverage, computational efficiency, and adversarial testing remain necessary.
- Synthetic evaluation enables systematic failure-mode analysis, but MI9 requires validation in live production environments with greater behavioral complexity and unpredictability.
- Comprehensive instrumentation is required because opaque APIs can obscure agents’ internal cognitive steps, limiting governance visibility and creating blind spots.
- Real-time monitoring introduces computational overhead that requires optimization for high-throughput deployments.
- MI9’s governance mechanisms may create an attack surface, making dedicated adversarial evaluation a critical area for future work.
- MI9 provides the first integrated, comprehensive runtime-governance framework for agentic systems, introducing agent-semantic telemetry and real-time intervention.The framework moves beyond static, pre-deployment assessments to dynamic, in-session oversight.
- The framework provides runtime capabilities intended to support safe and responsible agentic-AI deployment at scale.
8 Appendix
The appendix defines the Agency-Risk Index as a capability-based classification across autonomy, adaptability, and continuity. It scores four criteria per dimension on a standardized 0–3 scale, averages dimensions equally, and maps the normalized result to governance risk tiers.
- 8.1 Agency-Risk Index Scoring Criteria: Each agency dimension is assessed using multiple criteria with a standardized 0–3 scoring scale.The appendix presents separate scoring criteria for autonomy, adaptability, and continuity.
- 8.1 Agency-Risk Index Scoring Criteria: The Agency-Risk Index quantifies governance requirements from an agent’s capabilities across autonomy, adaptability, and continuity, driving containment thresholds and governance intensity.
- 8.2.2 Dimensional Scoring and Aggregation: Each dimension contributes equally to the final ARI, reflecting distinct governance challenges that require different oversight mechanisms.
- 8.2.1 Mathematical Formulation: The index uses four criteria within each dimension, with criterion scores represented as s_d,c ∈ {0, 1, 2, 3}.The dimension index d spans autonomy, adaptability, and continuity, while c spans the four criteria within each dimension.
- 8.2.2 Dimensional Scoring and Aggregation: The dimensional score is computed for each agency dimension before aggregating autonomy, adaptability, and continuity into the overall risk calculation.
- 8.2.3 Risk Tier Classification: Agents with ARI > 0.75 are classified as fully agentic systems and receive the highest risk tier.
8.3 Risk-Tier-Weighted Containment Model Development
MI9 develops context-sensitive containment policies that select escalation levels using risk tier, operational context, and organizational policy. The model supports graduated responses ranging from monitoring to isolation.
- 8.3 Risk-Tier-Weighted Containment Model Development: MI9 requires organizations to construct context-sensitive escalation models that balance operational continuity with risk mitigation.The framework provides guidance for organization-specific containment policies.
- 8.3 Risk-Tier-Weighted Containment Model Development: Containment level is selected from Monitor, Planning, Restriction, and Isolation according to risk tier, context, and policy.The selection is defined as an argmax over candidate containment levels conditioned on these factors.
- 8.3 Risk-Tier-Weighted Containment Model Development: The containment framework is illustrated through a context-factor scoring framework and an investment-banking containment decision matrix.These materials provide examples for translating contextual factors into containment decisions.
8.4 Framework Integration
MI9 integrates with existing agent frameworks through adapters that translate native events into standardized ATS telemetry. The adapters preserve framework functionality while adding governance oversight at key decision boundaries.
- 8.4 Framework Integration: Framework-specific adapters translate native framework events into standardized ATS telemetry for MI9 governance.This integration approach allows MI9 to operate across existing framework implementations.
- 8.4 Framework Integration: The adapters preserve existing framework functionality while capturing events strategically at key decision boundaries.Governance is added without replacing the native framework's operational behavior.
This evaluation dataset is designed exclusively for validating the theoretical MI9 governance
The evaluation uses governance logs and scenario-based analysis to validate MI9's runtime controls across diverse agent behaviors. The reported analysis covers multiple governance metrics and illustrates how MI9 detects, blocks, alerts on, and contains risky actions.
- Evaluation Dataset and Results: MI9 integrates proactive intervention and behavioral alerting through graduated containment, authorization monitoring, conformance enforcement, and drift detection.Restrictions escalate from monitoring through planning and restriction to tool restriction and isolation, while authorization mismatches can trigger dynamic permission revocation.
- Evaluation Dataset and Results: Based on 1,033 valid evaluation samples, the analysis reports MI9's performance across critical metrics using Wilcoxon signed-rank testing.Metric values were derived by a Large Language Model executing a deterministic, rule-based analysis script over governance logs.
- Evaluation Dataset and Results: The evaluation covers industry distributions, attack types, and performance measures including detection, risk coverage, governance maturity, causal-chain clarity, predictive alerting, and proactive intervention.These dimensions are represented in the reported evaluation tables.
- Evaluation Dataset and Results: In the agency-risk scenario, a goal-context mismatch causes CAM to revoke admin privileges and enforce a read-only policy.The scenario demonstrates dynamic authorization adjustment in response to agent behavior.
- Evaluation Dataset and Results: The FSM conformance engine detects an approval-sequencing violation and blocks trade execution pending approval.This scenario illustrates detection of a multi-step violation sequence before completion.
- Evaluation Dataset and Results: Goal-conditioned drift detection flags reduced alert frequency despite a retained monitoring goal, issuing an alert for human review and potential containment.A separate high-rate subagent-spawning scenario triggers tool restriction, revoking write access and enabling simulation mode for observation.