Why Most “Governance” Platforms Are Just Dashboards

A practitioner’s audit of every category of AI governance software on the market today, and why almost none of it can do the one thing it is sold to do

“Governance transcends policy documents and advisory services. It must be intrinsically woven into the operational fabric of an organisation.”

That line is not mine. It is a vendor’s marketing copy, lifted from one of the dozens of “agentic AI governance” platforms now crossing my desk every quarter. I want to spend this piece explaining why the line is true, why almost nobody selling it can back it up, and where the handful of people who can back it up actually sit.

I. The question I have started asking every vendor

I have spent the better part of three decades inside this problem, first as a computer scientist watching the earliest expert systems fail in exactly the ways today’s agents fail, then as an AI leader running governance programmes across fourteen Asia Pacific markets; I have sat inside AI Verify testing cycles. I have read every draft of MAS’s AI Risk Guidelines and its companion piece, SAFR, line by line, more than once. I have watched the EU AI Act’s Digital Omnibus defer its own deadlines because the conformity infrastructure it depends on was not ready. And I have spent enough time in rooms with safety teams at the frontier labs to know that the gap between what a regulator asks for and what a production system actually does is not a gap of intention. It is a gap of mechanism.

So when a vendor tells me their platform “embeds governance directly into your infrastructure,” I have started asking one question, and only one question, before I ask anything else.

Can it refuse an action?

Not flag it. Not log it. Not summarise it for a risk committee on Thursday. Refuse it, at the moment the agent proposes it, before it executes, deterministically, and produce a replayable record of the refusal.

I call this the enforceability test. It is a brutally simple filter, and I want to apply it, in public, to every category of AI governance product I can find on the market today. Not because I enjoy being unkind to vendors (some of what follows will read that way, and I make no apology for it where the marketing has outrun the mechanism), but because the entire “Long-AND, not Short-OR” thesis I have built my practice around, humanity AND AI flourishing together, depends on getting this one architectural question right. You cannot have trustworthy autonomy without an answer to the enforceability test. Everything else is décor.

If a control cannot say no, it is not a governance control. It is an opinion with a dashboard.

II. Six buckets, and where the money is actually going

Strip away the marketing language and the AI governance market sorts itself, cleanly, into six buckets. I want to define each one precisely, because the vocabulary has become dangerously loose, “runtime,” “agentic,” and “autonomous” now appear on products that do none of what those words imply.

1. Output guardrails. These sit inside or beside the model and screen what it says: prompt injection defence, PII redaction, jailbreak detection, content filtering. This is the most mature and most consolidated part of the market. Robust Intelligence went to Cisco for roughly four hundred million dollars in October 2024 and became the foundation of Cisco AI Defense. Protect AI went to Palo Alto for an estimated five to seven hundred million in 2025 and now powers Prisma AIRS. Lakera went to Check Point for around three hundred million, closing in the fourth quarter of 2025, and now anchors Check Point’s new Global Centre of Excellence for AI Security in Zurich. That is upward of one billion dollars of consolidation in eighteen months, and every one of those products does the same fundamental thing: it decides whether a piece of text is safe to pass through. None of them can tell you whether a proposed payment sits within an agent’s delegated authority, because that was never the question they were built to answer.

2. AI gateways. A proxy layer that every model call routes through, giving you one place to enforce policy and one place to log. TrueFoundry is the sharpest example I have seen, explicitly positioned as governing “what can happen, before it executes,” rather than detecting what already happened. This is, structurally, the single most promising piece of commercial infrastructure in the entire market, because it is the one place a real checkpoint could actually be installed. Nobody has installed one yet.

3. Agent identity and authorisation. Scoped, time-bound machine credentials; least-privilege access to tools, APIs and data. CyberArk’s identity platform was folded into Palo Alto Networks in February this year, in a deal explicitly framed around securing “human, machine, and agentic” identity as machine identities now outnumber human ones by more than eighty to one. Zenity, which I will return to in detail later, closed a hundred and twenty five million dollar Series C in August, its third round in three years, and describes its mechanism as “deterministically allowing, modifying, or blocking” an agent’s actions based on inferred intent. This bucket answers the question of what an agent can reach. It does not, on the evidence I have seen, answer the question of what a specific proposed action is authorised to do within a financial mandate.

4. Governance, risk and compliance platforms. Policy registries, regulatory crosswalks, model inventories, audit-evidence generation. This is the largest bucket by vendor count and the widest in credibility, from Credo AI (a Gartner Visionary in the 2026 Magic Quadrant for AI Governance Platforms, with a public-preview Agent Registry since September 2025) and the large-enterprise incumbents IBM watsonx.governance and OneTrust, all the way down to a cluster of very small entrants making claims I could not independently verify in any of the standard places I checked: no funding record, no analyst coverage, no named customer I could confirm. I will name one of these later, not to embarrass a small founder, but because the pattern it represents matters more than the company itself. Credo AI’s own May 2026 product announcement is, to its credit, honest about this bucket’s ceiling: runtime enforcement is described as “next on the roadmap,” not as a shipped capability.

5. Observability and guardian agents. Telemetry, evaluation, anomaly detection. Galileo, with named enterprise customers including MongoDB, Cisco and Elastic, claims sub two hundred millisecond intervention. This is real, useful infrastructure. It watches. Watching a trajectory for anomaly and authorising each step of that trajectory against a live mandate are different verbs, and the market has not yet built a bridge between them.

6. Action level runtime governance frameworks. The smallest bucket, and, I will argue, the only one that is actually answering the question the other five imply they are answering. This is where SAFR sits. This is also, and I want to be precise about this because it changed my own view while researching this piece, where two pieces of academic work sit that deserve far more attention from practitioners than they are currently getting.

Five of these six buckets are selling assurance about a checkpoint that does not exist. Only one of them is trying to build the checkpoint.

III. Running the filter across the whole market

I built out a coverage matrix against eight specific primitives, drawn from close reading of SAFR’s own component architecture, because “runtime governance” needs to be decomposed before it can be honestly scored. The eight are: a Governance Envelope (the standing interception point); a Mandate (the agent’s declared, bounded authority); a Disposition Engine (the logic that evaluates a proposed action and returns a verdict); Per Action or Temporal Authorisation (does it evaluate each step of a multi step trajectory, or only the workflow at launch); Telemetry feeding continuous re-authorisation; an Escalation Contract (a structured human handoff with a deadline and a recorded decision, not an email alert); an Audit Log of the governance trace itself; and Tiered Containment (graduated revocation, not a single blunt kill switch).

Here is how the six buckets score, using a full circle for productised and demonstrated, a half circle for partial or adjacent, and an empty circle for absent.

Category	Envelope	Mandate	Disposition	Temporal	Telemetry	Escalation	Audit	Containment
Output guardrails	◐	○	○	○	◐	○	◐	◐
AI gateways	◐	◐	○	○	◐	○	●	○
Identity and authorisation	◐	◐	◐	○	◐	○	◐	○
GRC platforms	○	◐	○	○	◐	◐	●	○
Observability	○	○	○	◐	●	◐	●	○
Action level frameworks	●	●	●	◐	●	◐	●	◐

Read that table the way I read it the first time I built it, not as a scorecard for shaming vendors, but as a map of where the actual work still needs doing. Every commercial bucket is strong on audit and thin on disposition. That is not an accident. Audit trails are easy to sell to a board. Disposition engines are hard to build, harder to certify, and genuinely risky to get wrong, so the market has, entirely rationally, built the parts that are easy to sell first.

The one column with a full circle anywhere on it, Temporal Authorisation, sits in the bottom row, and I want to spend the rest of this piece on why.

Every category on this table can tell you what happened. Only one is attempting to decide what happens next, before it happens.

IV. The peer set I actually take seriously

When I talk to boards about “who else is working on this,” I used to point at SAFR and stop there. I no longer do that, and I think every practitioner in this space should update the same way I have.

SAFR remains the most institutionally significant instrument in this space, published on the third of July this year under MAS’s BuildFin.ai initiative, with Ant International, Circle, HSBC, J.P. Morgan Chase, Manulife, Mastercard, OCBC and Visa named as contributors. Its architecture, an Agent Identity component, a Controls Repository, a Disposition Engine, an Audit Log, wrapped inside a Governance Envelope that captures the proposed action, its trace and its context metadata, is the clearest specification of an actual checkpoint I have seen from any regulator or standard setter anywhere in the world. It returns one of four dispositions, Deny, Escalate, Auto Execute or Observe, and it does this before execution, which is precisely the enforceability test in regulatory form.

I have also been direct, in earlier writing, about where SAFR itself falls short of its own ambition. It admits no orchestration drift or trajectory conformance monitoring, its “Observe” disposition is, on close reading, an observation layer outcome sitting inside what is supposed to be a deterministic enforcement engine, and its Controls Repository quietly admits probabilistic, semantic controls (the Manulife case study in the SAFR materials itself leans on an LLM as judge) into what the paper otherwise frames as deterministic evaluation. SAFR is explicit, and I respect this, that it carries no supervisory force and does not constitute regulatory guidance. It is a specification, offered to the industry through an expression of interest process, not a finished product.

MI9 is the piece of work I think deserves to be sitting on every AI risk committee’s reading list next to SAFR, and I suspect it currently is not. It is an independent, peer reviewed style paper (the arXiv preprint is 2508.03858, with a public GitHub evaluation harness attached, which is more transparency than most vendor claims in this space offer) that specifies six coordinated runtime components. An Agency Risk Index calibrates how much governance intensity a given agent needs, across autonomy, adaptability and a third orthogonal risk dimension, rather than applying one blanket policy to every agent regardless of how much independent judgement it actually exercises. Agent semantic telemetry captures the agent’s intent, not just its raw API calls. Continuous authorisation adjusts standing permissions as behavioural context shifts, rather than granting authority once at deployment and leaving it static. And, the component I want to underline twice, a Finite State Machine based conformance engine enforces temporal behavioural patterns across a sequence of actions, not just each action taken in isolation.

That last point is the one that matters most to anyone who has sat, as I have, in a room trying to explain to a risk committee why an agent that never once did anything individually improper can still have executed a catastrophic trajectory. Five compliant steps can add up to one non compliant outcome, and almost nothing on the market today, SAFR included by its own admission, is built to catch that. MI9’s authors are candid that this is a generalisable architecture, evaluated against roughly a thousand synthetic scenarios, not a live production deployment. It occupies, in other words, exactly the stage of maturity I would describe my own reference architecture work as occupying. The difference is that it is public, it is citable, and Risk.net has already described it, in coverage aimed at banks, as a real time telemetry system for controlling and authorising agentic actions in financial institutions.

AgentSpec, out of Singapore Management University and accepted at ICSE 2026, one of software engineering’s most rigorous peer reviewed venues, gave me the single most useful sentence I found anywhere in this research. Its authors built a lightweight domain specific language, a triple of a triggering event, a set of predicates and a sequence of enforcement functions, and evaluated it with real numbers: unsafe executions prevented in over ninety per cent of coding agent cases, all hazardous actions eliminated in the embodied agent tasks tested, one hundred per cent compliance enforced in the autonomous vehicle scenarios, at millisecond level overhead. Then, in their own words, in their own paper, they wrote this:

“AgentSpec lacks support for trajectory based safety analysis, i.e., estimating whether an action sequence might lead to unsafe states several steps into the future.”

I want practitioners to sit with that sentence. It is not a slide from a vendor pitch deck that I am reading uncharitably. It is a primary source, peer reviewed admission, from the authors of one of the two most rigorous runtime enforcement papers I could find anywhere, that the field’s best current tools govern the workflow and not the trajectory. If the people building the most technically serious solutions available say this out loud, it is not a criticism I am inventing. It is the honest state of the art.

Three serious attempts exist. One has a regulator’s backing and an admitted gap on trajectory. One has the most complete technical answer to that exact gap and no institutional channel. One has the rigour to prove its own limitation and says so in print. Nobody has all three.

V. The one commercial claim I take seriously, and why it still is not enough

I want to be fair to the commercial market, because most of it has not earned the criticism above, it has simply been building something else entirely. There is one vendor whose claim I checked closely enough to trust, and it is worth naming precisely because the standard it sets is the standard I would like the rest of the market held to.

Zenity, founded in Tel Aviv in 2021, has raised, across three rounds, more than one hundred and eighty million dollars, most recently a hundred and twenty five million dollar Series C in August led by Norwest, with SoftBank Vision Fund 2, Intel Capital and Microsoft’s M12 among its backers, and describes over two hundred and thirty employees serving Fortune 500 and Global 2000 customers across financial services, healthcare, pharmaceuticals, technology, energy and manufacturing. Its own research arm has disclosed named, real vulnerabilities in production agent platforms, including Microsoft Copilot Studio and ChatGPT. When Zenity says it understands an agent’s intent and “deterministically allows, modifies, or blocks” its actions, that is a funded, customer verified, mechanistically specific claim, in a market otherwise thick with vague ones, and it is stated in almost exactly the language of my own enforceability test.

Where it falls short of SAFR, MI9 or the reference architecture I have been building is scope and granularity. A three way disposition, allow, modify, block, is not SAFR’s four way model with a genuine escalation path attached. Nothing in Zenity’s public material describes FSM style conformance across a multi step financial trajectory, and its domain is general enterprise agent security, coding agents, Copilot, browser agents, rather than the specific semantics of payment instruments, position limits and delegated trading authority that a bank’s risk committee actually needs governed. It is the strongest commercial evidence I found that “deterministic blocking” is buildable at scale with real venture capital behind it. It has simply not yet been pointed at the problem this piece is about.

If I am wrong about where the next serious competitive entrant comes from, my money is on a well capitalised platform like this one extending into finance specific action semantics, not on a GRC vendor discovering, three years late, how to build a disposition engine.

VI. What this means for the reference architecture question

I built TrustOS, and its execution kernel concept, Ring Zero, on a simple premise: that category ownership in “agentic AI governance” would go to whoever could pass the enforceability test first, with the regulatory crosswalk breadth to actually be usable across MAS’s instruments, the EU AI Act, NIST’s AI RMF, ISO 42001, IMDA’s own framework, the OWASP Agentic Top 10, GDPR and the Colorado AI Act simultaneously, rather than to whoever shipped the prettiest dashboard first.

I want to be honest, in the register I try to hold with regulators and with my own readers, about where that premise now stands after this research. Ring Zero, as I have described it in earlier pieces, is the unbuilt centre of that architecture, a specified execution kernel, not yet an independently audited, deployed product. That puts it, candidly, in the same stage of maturity as MI9 and, on the trajectory conformance question specifically, arguably behind MI9’s own specification, which already has a working Finite State Machine mechanism for exactly the gap I have spent two years describing as the open problem. That is not a comfortable sentence to publish about one’s own work, and I am publishing it anyway, because the alternative, staying quiet about a paper that any serious technical reviewer will find in one search, is worse for the credibility of the entire category, mine included.

So here is where I land, and where I think the industry should land with me. The category ownership argument I made in “The Only Thing That Can Say No Is Not Legally AI” still holds, SAFR and its deterministic Disposition Engine sit outside AIRG’s own definition of AI by two independent mechanisms, and that finding is not disturbed by anything in this piece. What has changed is the size of the peer set. It is no longer “SAFR, and then a queue of vendors who have not built anything.” It is SAFR, with institutional distribution but an admitted trajectory gap; MI9, with the most complete technical answer to that gap but no regulatory channel; and AgentSpec, with the empirical rigour to have proven, in its own results, exactly where the field’s current ceiling sits. Any reference architecture that wants to be taken seriously by a bank’s model risk committee in 2027 needs to either adopt something functionally equivalent to MI9’s conformance engine, explain in precise technical terms why it does not need to, or cite it and differentiate honestly on the ground where it actually leads, which is Singapore’s own regulatory crosswalk and the envelope origin authentication problem that none of the three papers above have solved either.

The moat was never going to be “we thought of agentic governance first.” Somebody always publishes the paper you were about to write. The moat is being the one honest enough to say so, and fast enough to close the gap before the next paper does.

VII. What the panel had to say

I ran this argument past the usual voices before publishing, in the way I try to do with anything that touches my own work as closely as this does. I will not put invented words in real people’s mouths here, so let me summarise the three lines of dissent I got, in role rather than by name, because the objections themselves are worth answering regardless of who raises them.

The regulator’s objection: that an enforceability test built by a private sector architect is itself a category error, because “can it refuse an action” is a necessary but not sufficient governance question, and a deterministic kernel with no accountability, explainability or contestability wrapped around it is just a faster way to make an unreviewable decision. I accept this in full. The enforceability test is a floor, not a ceiling. Everything IMDA’s own Model AI Governance Framework says about explainability, contestability and human determination still has to sit on top of whatever passes the test. A checkpoint that refuses actions nobody can later understand or appeal is not progress, it is a different kind of failure.

The frontier lab safety researcher’s objection: that FSM based conformance, MI9’s mechanism, works well for bounded, enumerable state spaces, code agents, embodied robots, autonomous vehicles operating under traffic law, and may not generalise cleanly to an open ended financial agent whose action space is genuinely combinatorial. I think this is a fair technical challenge and precisely the reason I am not simply endorsing wholesale adoption of MI9’s approach. It is the strongest existing answer to the trajectory problem. It is not obviously the final one, and AgentSpec’s own authors flagged probabilistic, model based extensions, learning a reachability model from historical interaction data, as the likely next step rather than pure finite state enumeration. That is honest, unfinished science, and I would rather report it as such than oversell it.

The bank CRO’s objection: that none of this matters until somebody puts a Governance Envelope inside an actual settlement rail and survives a live incident, and that academic evaluation on a thousand synthetic scenarios is not the same evidentiary bar as one real trading day. Also fair, and also precisely why I think the FFI’s pilot programme under BuildFin.ai, and the expression of interest process attached to SAFR, is the single most important near term milestone in this entire space. Somebody has to go first, in production, with real money, and publish what breaks.

VIII. Where I land

Long AND, not Short OR, was never meant as a slogan about optimism. It was meant as a discipline: hold two things that are in genuine tension, humanity’s flourishing and AI’s capability, and refuse the lazy trade that says you can only have one. Applied to this market, the same discipline says something uncomfortable to everyone selling governance software today, myself included. You can have an impressive regulatory crosswalk, or a rigorous academic specification, or a well funded commercial platform with real customers, and still not have the one thing all of it is supposed to add up to: a system that can look at a proposed action, in the half second before it happens, and say no.

Nobody has all of it yet. That is not a failure of the industry. Eighteen months ago almost nobody in a boardroom could tell you what “agentic” meant, let alone what should stop one. What I would ask of every reader who builds, buys or regulates in this space is simply this: before the next vendor tells you their platform “embeds governance directly into your infrastructure,” ask them the one question that actually matters.

Can it say no.

If the honest answer is not yet, that is not a reason to walk away from the conversation. It is the only honest place left to start it.

---

Dr Luke Soon is an AI Leader at PwC Singapore, covering fourteen Asia Pacific markets, and co-author of Singapore’s Model AI Governance Framework for Agentic AI. He writes at genesishumanexperience.com under the Genesis: Human Experience in the Age of Artificial Intelligence banner. This piece is part of an ongoing technical series on runtime governance; the enforceability test, the SAFR component architecture, and the TrustOS reference framework are discussed at greater length in earlier entries in the series.