Frameworks
Free to read and cite with attribution to Sougata Roy and sougataroy.com. Do not republish, rebrand, or claim authorship of any framework, term, or model as your own.
Governance frameworks built from enterprise AI governance work in regulated environments. Each framework addresses a gap that became visible during real deployment, not in theory.
Start here
The index is a library, but the work has an order. Name the risk, diagnose the current state, authorize the action, operate the control, and keep the record.
DOWNLOAD
The Authorization Layer: The Enterprise AI Agent Governance Framework Library, v1.0, July 2026. Five core concepts, nine operating frameworks, and one governance record, structured for reading, printing, and internal circulation. Free to read and cite with attribution. Deposited on Zenodo under DOI 10.5281/zenodo.21245690.
Download PDFStart here
Answer two questions. Land on the right place to begin.
Governance works as a sequence. Name the problem, measure what exists, decide before go-live, govern after, keep the record.
Learn the problem language.
The concepts that make the governance failure visible.
Measure what you already have before designing anything new.
Find the gap between deployed agents and approved records.
Decide and record what an agent may do before it goes live.
Create the decision structure before deployment.
Govern drift, detection, and coverage after an agent is live.
Keep authorization current as systems change.
Turn the decision into the artifact an examiner reads.
Make the authorization evidence inspectable.
All five stages design one thing the operational governance stack assumes already exists: the authorization layer.
Core concepts
5 conceptsStart here. These concepts name the failure patterns that make agent governance visible before the organization tries to control them.
Use this section to diagnose what kind of governance failure you are seeing. Then move to the frameworks section to choose the control that addresses it.
The accumulated accountability design work deferred while deploying AI at speed. It builds the moment a deployment goes live without authorization, a named owner, or a compliance review. It becomes visible when an examiner asks a question nobody can answer.
The unplanned divergence between what an organization genuinely intended an AI system to do and what it actually does in production. Not deliberate misrepresentation, the gap governance failed to detect before deployment.
The implicit belief that accountability for an AI agent's decisions resides with the vendor, the platform, or another team. It doesn't. And regulators have started saying so explicitly, regardless of what contracts say.
Three tiers of uncontrolled AI proliferation: employee shadow AI, organizational procurement without central visibility, and authorized agents with over-permissive operational scope. Each tier requires a different governance response.
The organizational design layer that defines purpose, boundaries, and accountability before any agent goes live. The difference between a governance posture that holds under examination and one assembled under pressure after something goes wrong.
Operational frameworks
9 frameworksUse these when the organization needs a decision structure, an authorization record, or a repeatable governance process.
Use this section to select the control point: pre-deployment authorization, post-deployment response, ownership, reconciliation, or audit evidence.
Measure what already exists before you design anything new.
Agent count versus authorization coverage. Designed for environments where the agent inventory and the authorization record had never been compared.
Five steps for reconciling what your tenant actually contains against what your organization formally approved. Built from environments where platform visibility and formal approval records did not match.
A two-tier diagnostic for regulated enterprises deploying AI agents across systems of record. Built from deployments where the substrate became governance infrastructure before it was ready.
Govern drift, detection, and coverage after an agent is live.
Six requirements that convert a signal into a formal governance decision. Built from environments where detection infrastructure was mature and decision infrastructure did not exist.
Three phases every organization moves through as its ratio of governed agents to total agents changes. Built from deployments where authorization coverage lagged behind agent growth.
Quick checks
6 reference cardsOne-page instruments for board reviews, team workshops, audit preparation, and fast governance triage.
Use this section when the question has moved from understanding to action. These are designed for meetings, workshops, and fast internal reviews.
Quick check
Calculate your Governance Debt Ratio and identify your quadrant.
Quick check
Twelve governance items across three layers before any agent goes live.
Quick check
Four steps from deployment count to ratio to remediation priority.
Quick check
Three tiers. Map who owns what before the agent goes live.
Quick check
Five steps from M365 inventory to shadow agent count.
Quick check
Baseline, comparison, and trigger conditions for every agent in production.
Governance Documents
1 documentTurn the decisions into the artifact that survives audit.
Use this section when the governance decision needs to become evidence: who approved what, what the system may do, and who answers for it.
Agent Authorization Document
The record that proves who authorized the agent, what it may do, and who authorized the schedule that runs it.
View documentThe Standing Trigger Clause
Section 05 of the record. Who authorized the unattended run, and what happens to it when that person leaves.
White papers
2 publicationsDeeper publications for the accountability architecture behind enterprise AI governance.
Use this section when you need the full argument behind the framework system, not a quick operational artifact.
Framework Library
The Enterprise AI Agent Governance Framework Library, v1.0, July 2026. DOI 10.5281/zenodo.21245690.
v1.0 | July 7, 2026
White Paper
The Intent Architecture Stack
v1.0 · May 2026
Revision history
4 entriesThe framework index records additions to the public library structure.
v1.3, July 2026: added Zenodo publication of The Authorization Layer, DOI 10.5281/zenodo.21245690.
v1.2, July 2026: fact corrections verified against primary sources; updated the master PDF download citation title and metadata.
v1.1, July 2026: Added the Authorization Layer library PDF download block to the framework index.
v1.0, April 2026: Original publication.
The Governance Gap newsletter
Enterprise AI governance on the Microsoft stack. Built from primary sources. Every Tuesday.