v1.0There is no single 2027 agent law to prepare for. There are several dated duties, each with its own scope.Read →Research on governing AI that acts
Theses, whitepapers and regulatory reviews of the rules shaping AI agents and automated decisions.
v1.0There is no single 2027 agent law to prepare for. There are several dated duties, each with its own scope.Read →
v3.2Policy can be well written while the authority to act remains poorly controlled. That gap is where agent risk lives.Read →
v3.1Nothing executes until it is authorised. AI agents now operate where that same principle matters.Read →
v4.1Trust is the oldest technology. Before language. Before tools. Before fire.Read →
Oct 2026 · 3 min readFive Forces of Enterprise AIAI programmes rarely stall because the technology doesn't work. They stall because they're pulled in several directions at once, by people who are each right about their own piece.
Sep 2026 · 3 min readAgentic AI is testing the controls we thought we hadAI agents used to draft, summarise and recommend. More and more they also pull data, call tools, change records and push work along to the next step.
Scroll for more
The terms we use, in plain words
Governance and engineering use the same words differently. These are the meanings we use across the platform and our research.
01 / 14 · Governance
Accountable executive
The named person answerable for an AI system, usually the holder of the related FAR key function or business accountability.
02 / 14 · Engineering
Action gate
The point where CognaOne decides whether an agent may take a proposed action: allow, needs approval or block.
03 / 14 · Governance
AI system
Any model, agent, endpoint, copilot or MCP server an organisation runs or relies on, including AI inside vendor software.
04 / 14 · Engineering
Agent
An AI system that can take actions, such as sending messages, calling tools or changing records, not only produce text.
05 / 14 · Engineering
Conflict
Two sources disagreeing about a fact an agent relies on, for example two different claim amounts. CognaOne records conflicts instead of overwriting one value.
06 / 14 · Governance
Control
A specific measure that satisfies an obligation, with an owner, the AI systems it governs and an implementation level.
07 / 14 · Engineering
Decision receipt
The record of one gate decision: what was asked, what was known, which rule applied and the outcome. Kept as evidence.
08 / 14 · Engineering
Deterministic decision
A gate decision that does not depend on a model judgement: given the same governed state and policy, it always produces the same outcome and can be replayed.
09 / 14 · Engineering
Governed state
Facts an agent relies on, held as typed, versioned items with their source, instead of loose text in a prompt.
10 / 14 · Governance
Impact assessment
A recorded assessment of how an AI system could affect people, customers or operations, kept with the system it covers.
11 / 14 · Engineering
MCP server
A Model Context Protocol server: a standard way for agents to reach tools and data. CognaOne tracks which agents can reach which MCP servers.
12 / 14 · Governance
Obligation
A requirement from a framework or law, with its source and effective date, that one or more controls satisfy.
13 / 14 · Governance
Proof levels
How far a control is proven: declared, observed, implemented, evidenced, tested and effective. Effective is never inferred without a passed test.
14 / 14 · Governance
Risk tier
The level set by a written rule over an AI system's risk dimensions. It decides which controls apply and how often the system is reviewed.
Connect an agent to the gate
Send the facts agents rely on as governed state; agents call the gate before each consequential action.
One call before each consequential action. Every decision comes back with reason codes and a receipt ID you can trace.
- 01Register the agent and its tools
- 02Send governed state from your sources
- 03Run the gate in observe mode first: decisions are recorded, nothing is blocked
- 04Switch to enforce and handle defer and block in the agent
- 05Reuse the clientRequestId on retries; keep receipt IDs with each action
CognaOne also runs an MCP server with OAuth, so agents built on MCP-capable frameworks can reach governed state and the gate as tools, without custom integration code.
MCP connection
Authorization: Bearer <agent token> { "threadId": "thr_claims_0142", "actionType": "payment.release", "clientRequestId": "req_7f3c91", "payload": { "amount": 48000, "currency": "AUD" }, "evaluationMode": "enforce"}{ "decision": "block", "reasonCodes": ["gate_block_conflict", "gate_block_missing_key"], "missingKeys": [{ "canonicalKey": "claim.approved_amount" }], "blockingConflictIds": ["cf_91a2"], "lineage": { "evaluationId": "ge_5d10", "receiptId": "gr_a8f2e1" }}ServerMCP server at api.cognaone.comAuthOAuth client registrationReachGoverned state and the gate, as toolsModelsWorks across model providersOutputSame decisions and receipts as the REST APIPOST https://api.cognaone.com/api/actions/evaluate
Works withHow CognaOne connects →
AWS Bedrock
Azure AI Foundry
Databricks
Google Vertex AI
Snowflake
Microsoft 365 Copilot
Model Context Protocol
LangChain
CrewAI
AutoGen
OpenTelemetry
Datadog
Grafana
GitHub
SlackLet's connect
Tell us where your AI programme is today. We scope the first engagement to your own AI estate, and every enquiry is handled in confidence.
Contact us