PaperlayerView exact revision on arXiv

Source-linked AI summary

Governing at Machine Speed: An Adaptive Intelligence Architecture for Real-Time AI Policy Enforcement

Sandeep Bokkasam, B. Durgalakshmi

arXiv:2609.13466v1cs.AI

TL;DR

Enterprise AI governance policies often lack infrastructure to produce proof of enforcement, a gap the paper calls the attestation deficit. It characterizes this deficit and proposes AGIL, a conceptual five-layer architecture; its design remains unvalidated empirically.

  • Problem

    Governance documentation has outpaced enforcement infrastructure, leaving organizations unable to produce proof that governance is enforced under regulatory scrutiny.

    Source: §1 · p. 1

  • Method

    The paper characterizes governance failures across four dimensions and proposes AGIL, a conceptual five-layer architecture using machine learning to bridge policy and enforcement.

    Source: §1 · p. 2

  • Results

    The cited evidence includes 362 AI-related incidents in 2025, up 56.4% from 233, and 92% of organizations suffering AI-related breaches lacked proper access controls.

    Source: §1 · p. 1

  • Takeaways & Limitations

    AGIL’s five layers are designed to convert governance policies into operational controls and documentation requirements into continuous evidence generation.

    Source: §8 · p. 8

    AGIL has no prototype, controlled deployment, or empirical performance data; operational effectiveness remains untested.

    Source: §7.1 · p. 7

Abstract

from arXiv · show

Enterprise AI adoption has reached 78% of organizations globally, yet the infrastructure to govern that adoption has not kept pace. This paper identifies and characterizes the attestation deficit, a structural condition in which organizations maintain governance policies but cannot produce auditable, tamper-evident evidence of enforcement within regulatory timelines. Drawing on empirical data from the Stanford 2026 AI Index Report (362 documented incidents), the IBM/Ponemon 2026 Cost of a Data Breach study (USD 4.99M average cost, 92% lacking access controls), and the EY/AIUC-1 Consortium survey (38% end-to-end monitoring, 17% agent-to-agent coverage), this paper demonstrates that the governance failure is organizational and architectural rather than technical. To address this deficit, we propose AGIL (Adaptive Governance Intelligence Layer), a conceptual five-layer architecture designed to use machine learning for real-time AI governance enforcement. The proposed layers include: (1) Autonomous Discovery for shadow AI detection via behavioral fingerprinting, (2) Behavioral Risk Classification unifying security, hallucination, privacy, and accountability scoring, (3) a Policy Enforcement Gateway for inline permit/deny/modify decisions at sub-100ms latency, (4) a Continuous Attestation Engine generating tamper-evident audit trails as a byproduct of enforcement, and (5) Adaptive Policy Intelligence for ML-driven policy evolution across jurisdictions. AGIL is presented as a theoretical framework and architectural proposal; empirical validation through controlled deployment remains a direction for future work.

1 Introduction

Enterprise AI governance has developed a structural attestation deficit: policies exist, but organizations lack infrastructure to prove enforcement under scrutiny. The paper characterizes this gap and proposes AGIL, a conceptual machine-learning architecture for enforcement.

1 Introduction

  • The attestation deficit describes governance that exists on paper but cannot produce proof under regulatory scrutiny.The paper attributes the widening gap to investment in governance documentation alongside almost no enforcement infrastructure.Source: §1 · p. 1
  • 362 AI-related incidents were documented in 2025, up 56.4% from 233; breached organizations averaged USD 4.99 million in global breach costs, and 92% lacked proper access controls.AI-related breaches averaged USD 5.33 million; 68% of breached organizations had no AI governance policy, and five of six measured controls lost adoption.Source: §1 · p. 1
  • Existing frameworks including NIST AI RMF, ISO/IEC 42001, and the EU AI Act define governance but provide no runtime enforcement machinery.CrowdStrike documented AI-enabled lateral movement in 27 seconds and Mandiant recorded 22-second handoffs, which the paper says human-dependent governance cannot match.Source: §1 · p. 2
  • The paper characterizes the deficit across security, hallucination, privacy, and accountability, then proposes AGIL, a conceptual five-layer machine-learning architecture bridging policy and enforcement.Practical deployment and empirical validation remain future work.Source: §1 · p. 2

2 The Governance Gap: Empirical Evidence

The section documents governance gaps across security, hallucination, privacy, accountability, and agent oversight, using breach reports, surveys, and incident examples. Together, the evidence describes risks and monitoring or ownership gaps across these dimensions.

2.1 The Security Dimension

  • AI-driven cyberattacks rose 56% year over year, while security incidents involving organizations’ own AI models rose from 13% to 21% of breaches.Organizations requiring IT approval before AI deployment fell from 45% to 38%; the LiteLLM compromise affected a tool present in approximately 36% of cloud environments.Source: §2.1 · p. 2

2.2 The Hallucination Dimension

  • Hallucination rates across 26 frontier models ranged from 22% to 94%, and GPT-4o accuracy varied from 98.2% to 64.4% across evaluation conditions.ISACA’s 2025 retrospective called hallucinations safety risks and described major AI failures as organizational failures involving weak controls, unclear ownership, and misplaced trust.Source: §2.2 · p. 2

2.3 The Privacy Dimension

  • User prompts can contain personal data subject to GDPR protections, while 27% of organizations had not verified whether AI vendors use submitted data for model training.The section also describes differing requirements in India, China, and Singapore.Source: §2.3 · pp. 2–3

2.4 The Accountability Dimension

  • Mobley v. Workday exposed a dispute over whether a vendor or employers owned compliance, while only 5 of 20 federal agencies produced comprehensive AI inventory data.Source: §2.4 · p. 3

2.5 The Agent Governance Blindspot

  • Only 38% of organizations monitored AI traffic end-to-end and 17% monitored agent-to-agent interactions; 80% documented risky agent behaviors.A Meta agent’s unsolicited internal-forum post triggered access to systems engineers were not authorized to see.Source: §2.5 · p. 3

3 Why Existing Approaches Fall Short

The paper attributes persistent governance gaps to a mismatch between machine-speed AI activity and human-speed oversight, limited visibility, and fragmented ownership. These are presented as structural deficiencies rather than isolated tuning problems.

3 Why Existing Approaches Fall Short

  • AI agents operate at machine speed while governance operates at human speed; 27-second lateral movement and 22-second handoffs leave human-dependent processes unable to intervene in time.The paper calls this an architectural impossibility rather than a tuning problem.Source: §3 · p. 3
  • Organizations report 82% confidence in governing AI agents, but only 47.1% of deployed agents are actively monitored.The paper describes this gap as confidence untethered from operational evidence and notes that infrastructure leaves roughly half of deployed AI invisible.Source: §3 · p. 3
  • Governance ownership is fragmented across functions, and 42% of organizations assign authority to one role that may lack power to halt a risky deployment.Committees can recommend actions but, as described here, do not themselves enforce them.Source: §3 · p. 3

4 Proposed Solution: The AGIL Architecture

AGIL is proposed as a conceptual architecture that unifies governance techniques into a machine-speed enforcement pipeline. Its design principles emphasize temporal parity, evidence generated during enforcement, and complementarity with existing frameworks.

4 Proposed Solution: The AGIL Architecture

  • AGIL combines established network-security, data-loss-prevention, and machine-learning-operations techniques in a conceptual architecture bridging governance policy and enforcement.Table 1 is described as comparing governance approaches; its caption cautions that AGIL capabilities are proposed and not empirically validated.Source: §4 · p. 3, Table 1 · p. 4
  • The proposed novelty is a unified machine-speed governance architecture integrating shadow AI discovery, hallucination detection, privacy enforcement, agent-scope monitoring, and continuous audit-trail generation.Source: §4 · p. 4

4.1 Design Principles

  • Temporal parity requires enforcement decisions to match the time resolution of the AI systems being governed.The paper gives millisecond autonomous actions as an example.Source: §4.1 · p. 4
  • Audit evidence should be generated automatically as a byproduct of enforcement rather than assembled manually before audits.Source: §4.1 · p. 4
  • AGIL is designed to complement existing frameworks: NIST AI RMF defines what to govern, ISO 42001 certifies maturity, and the EU AI Act sets legal obligations.AGIL is proposed as the enforcement layer that would turn these frameworks into operational controls.Source: §4.1 · p. 4

4.2 Five-Layer Architecture

AGIL proposes five interdependent layers that connect AI discovery, risk assessment, enforcement, audit evidence, and policy adaptation. Each layer addresses a distinct part of the attestation deficit.

4.2.1 Layer 1: Autonomous Discovery Engine (ADE)

  • ADE would discover unauthorized AI use through behavioral fingerprinting and register unknown interactions, targeting a gap affecting 47.1% of deployed agents lacking active monitoring and 66% of employees using unauthorized tools.It is designed to seek unknown deployments rather than only monitor known ones.Source: §4.2.1 · p. 4

4.2.2 Layer 2: Behavioral Risk Classifier (BRC)

  • BRC would continuously score data sensitivity, hallucination, behavioral anomalies, and agent-scope compliance in one pipeline rather than separate risk domains.Its classifiers use named-entity recognition, verified knowledge bases, behavioral baselines, and policy-as-code specifications.Source: §4.2.2 · pp. 4–5

4.2.3 Layer 3: Policy Enforcement Gateway (PEG)

  • PEG would intercept AI interactions and redact data, gate agent actions, filter outputs, or limit rates, with a proposed decision latency below 100 ms.It adapts proxy and API-gateway architectures to AI-specific enforcement logic.Source: §4.2.3 · p. 5

4.2.4 Layer 4: Continuous Attestation Engine (CAE)

  • CAE would create signed, tamper-evident records of discoveries, risk classifications, enforcement decisions, and policy changes for sub-minute regulatory-query retrieval.Its append-only, hash-chained log makes governance evidence a byproduct of enforcement rather than a separate documentation task.Source: §4.2.4 · p. 5

4.2.5 Layer 5: Adaptive Policy Intelligence (API)

  • API would use machine learning to recommend policy updates by analyzing enforcement effectiveness, detecting emerging threats, and mapping regulatory changes across jurisdictions.It is proposed to replace manual updates to static governance policies with continuous adaptation.Source: §4.2.5 · pp. 5–6

4.3 Proposed Decision Pipeline

AGIL proposes a four-stage path for each AI interaction, from interception through risk classification and enforcement to a tamper-evident record. The pipeline targets sub-100ms end-to-end latency for standard interactions.

4.3 Proposed Decision Pipeline

  • The pipeline intercepts interactions, classifies risk across four parallel classifiers, applies permit, modify, deny, or escalate decisions, then records the decision chain.Records are described as immediately queryable for audit or investigation.Source: §4.3 · p. 6
  • At interception, ADE or PEG captures source, destination, payload classification, and interaction type; BRC computes sensitivity, anomaly, hallucination, and agent-scope assessments.The four classifier assessments are computed in parallel.Source: §4.3 · p. 6
  • The proposed pipeline targets sub-100ms end-to-end latency for standard interactions, informed by inline proxy and API-gateway performance characteristics.Source: §4.3 · p. 6

4.4 Proposed Deployment Modes

AGIL proposes inline, sidecar, and hybrid deployment configurations to accommodate different organizational readiness. Hybrid mode is recommended as a starting point.

4.4 Proposed Deployment Modes

  • Inline mode places PEG as a proxy intercepting all AI traffic, offering the strongest governance guarantees but requiring network architecture changes.Source: §4.4 · p. 6
  • Sidecar mode monitors interactions without inline interception and is designed for initial rollout when minimal infrastructure change is preferred.Source: §4.4 · p. 6
  • Hybrid mode combines inline enforcement for high-risk systems with sidecar monitoring for lower-risk systems, balancing governance coverage against deployment friction.The paper recommends this configuration as a starting point.Source: §4.4 · p. 6

5 Design-Level Validation

The paper uses design-level analysis of three documented incidents to assess whether AGIL mechanisms could address observed failure modes. This is a theoretical assessment of structural capability, not a test of a deployed system.

5 Design-Level Validation

  • The validation evaluates whether proposed mechanisms could structurally detect and prevent documented failure modes; it does not establish performance in a deployed system.Source: §5 · p. 6
  • For the LiteLLM supply-chain attack, ADE fingerprinting could detect anomalous outbound connections and PEG could block credential exfiltration, with estimated detection in minutes rather than hours.The estimate is based on established behavioral anomaly detection performance.Source: §5 · p. 6
  • For the Meta agent cascade, BRC could flag an out-of-scope action and PEG could intercept it before execution, preventing the cascade at its first link.The proposed feature is pre-execution interception rather than post-incident detection.Source: §5 · p. 6
  • For shadow-AI data exposure, ADE could detect unauthorized tool use and PEG could redact sensitive data in interactions with unauthorized tools.The analysis frames this as addressing the root visibility gap.Source: §5 · p. 6

6 Proposed Deployment Roadmap

The roadmap stages AGIL from visibility to risk classification and audit logging, then to graduated enforcement. Proposed success metrics are intended to support future empirical validation.

6.1 Phased Rollout

  • Table 2 frames validation as a theoretical design-level analysis against documented incidents.Its assessments are not presented as operational results.Source: Table 2 · p. 7
  • The three-phase deployment builds confidence incrementally: passive monitoring inventories AI assets and establishes behavioral baselines without enforcement, followed by months 3–6 classification and advisory logging and months 6–12 graduated enforcement for high-risk systems.Source: §6.1 · pp. 6–7

6.2 Proposed Success Metrics

  • Table 3 proposes success metrics against industry baselines as criteria for future empirical validation.Source: §6.2 · p. 7

7 Limitations, Ethics, and Future Work

AGIL remains an architectural proposal without prototype or controlled-deployment evidence, and its operation raises risks involving decision errors, latency, adoption, and privacy. The paper identifies adversarial robustness and empirical deployment among the work still needed.

7.1 Limitations

  • No prototype, controlled deployment, or empirical performance data exists; design-level validation does not establish operational effectiveness.Controlled enterprise deployment is identified as the most critical future direction.Source: §7.1 · p. 7
  • AGIL can produce false positives that block legitimate AI use and false negatives that miss threats, requiring continuous calibration and human oversight.Authorized humans set policy definitions, enforcement thresholds, and exception rules.Source: §7.1 · p. 7
  • Inline enforcement adds latency; the sub-100ms target is unvalidated for AGIL workloads, and high-volume deployments may experience measurable degradation.Hybrid deployment limits inline enforcement to high-risk interactions.Source: §7.1 · p. 7
  • Business units may resist enforcement when they view governance as impeding AI innovation; phased deployment is designed to mitigate that resistance.Source: §7.1 · p. 7
  • AGIL’s detection and classification models could be targeted by adversarial evasion, making dedicated threat modeling necessary.Source: §7.1 · p. 7

7.2 Ethical Considerations

  • Monitoring raises privacy and employee-autonomy concerns, so employees should be informed, retention must follow privacy rules, and monitoring must remain limited to AI interactions.The framework must not become a surveillance tool.Source: §7.2 · p. 8

7.3 Future Work

  • Future work includes controlled enterprise validation, multi-agent and federated governance, formal verification, and adversarial-robustness testing.The proposed validation would measure detection and false-positive rates, latency overhead, and evidence quality.Source: §7.3 · p. 8

8 Conclusion

The conclusion frames the governance gap as a widening mismatch between policy-layer frameworks and machine-speed AI systems. It proposes AGIL as enforcement infrastructure, while emphasizing that the conceptual framework still requires controlled empirical validation.

8 Conclusion

  • The governance gap is widening: shadow AI incidents doubled in a year, while the average breach costs USD 4.99 million and AI-related breaches exceed USD 5.3 million.The conclusion says regulators are demanding proof that policies work.Source: §8 · p. 8
  • Existing policy-layer frameworks depend on human-speed processes, a mismatch the conclusion says requires enforcement operating at the systems’ temporal resolution.Source: §8 · p. 8
  • AGIL’s five-layer conceptual architecture is designed to convert policies into operational controls and documentation requirements into continuous evidence, but requires prototype and controlled-deployment validation.Source: §8 · p. 8
Loading 2609.13466v1…