Should agent governance live in the interface or the engine?

The short answer

Governance should be enforced in the engine that runs the work, not only in the interface that asks for it. The engine is where authorization, state transitions, evidence, and the actual result can be checked together.

Where rules are enforced

Many agent platforms enforce rules in the assistant layer. That means governance holds for the interface it was built into, but not necessarily for anything calling underneath it. If the rules live in the engine instead, the same decisions apply whether the caller is a person, an assistant, or another system.

The important failure mode is a gap between what the interface says and what the engine did. An interface can report an outcome that the engine refused. An audit record assembled from interface claims rather than engine results is not evidence of what actually happened.

How VeroTX enforces governance

In VeroTX, authorization, transitions, and evidence are enforced by the runtime across the product's shipped interfaces and runtime paths. A refused action stays refused regardless of who asked, and run state lives in the engine rather than in the conversation.

Every business action in a WorkStream is recorded, tamper-evident, by the runtime rather than added afterward. The record therefore reflects the engine's result, including approvals, refusals, evidence, and the Playbook version governing the run.

See the engine decide

The same purchase request is sent from two shipped VeroTX interfaces. The runtime evaluates the same Playbook rule in both cases, holds the run at the same tollgate, and writes the same Execution Ledger entry, differing only in the recorded caller.

Where to next

Product and platform pages on the same topic, drawn from the VeroTX knowledge base.

Search everything in one place in the Research Center, or ask Veroli, which answers from the same knowledge base.