Set: Define fleet-wide rules with agent contracts

With the fleet visible, you can decide what each agent is allowed, and never allowed, to do. Here's a hard truth to start from: Applying uniform governance across all agents leads to failure.¹⁷ Governance must match autonomy. An agent that only observes needs different controls than an agent that acts on its own, and each autonomy level is a distinct trust boundary. Add risk: Classify agents by data sensitivity times autonomy. The meeting notes summarizer and the autonomous agent touching customer PII can't live under one rulebook.

But notice the trap on the other side: Hand-built proportional governance means a bespoke rulebook per agent. At fleet scale, that's 1,000 rulebooks, which nobody can write or maintain. So most organizations regress to uniform rules that are either too loose or too strict. The way out is layered, human- and machine-readable agent contracts: Turn enterprise policies into controls that machines can read and enforce, across every agent.

Set fleet-wide rules with agent contracts: a global AI code of conduct, specialized by domain, inherited by every agent

A contract translates governance requirements into machine-readable controls: What data and tools an agent may use, what actions it may take, under which conditions. One source of truth that humans can review and runtime controls can enforce. Not a PDF someone reads quarterly. Contracts capture structured rules plus intent, the agent's purpose and expected operating boundaries, because explicit rules can't anticipate every combination of data and request. A clinical research agent's contract, for example, encodes both its access rules and its intent to protect patient privacy. When a request arrives that no rule anticipated, the intent still applies.

Contracts layer and inherit like a code of conduct for the fleet. Define a global contract once, the baseline every agent inherits. Then specialize by function, domain, risk classification and operating context. Define once. Specialize where needed. Scale across the fleet. A new agent is born governed instead of becoming a separate policy project. And because contracts are built on an open standard, independent of any runtime, cloud, or AI technology, you get one consistent control framework across a heterogeneous fleet.

Define once. Specialize where needed. Scale across the fleet.

What belongs in an agent contract? The rules that define how an agent should operate, what it can and cannot do, and when human oversight is required. These may cover permitted actions, access to data and tools, autonomy boundaries, escalation conditions and approval requirements. The level of detail depends on the agent’s purpose, risk and business context.

You won't be building against the grain. Across the industry, policy enforcement is moving from documents to machine-verifiable contracts, and the EU AI Act already requires intervention capability by design for high risk systems (Article 14, in force since August 2, 2026).¹⁶ Note: Machine-readable contracts are an emerging practice. The trajectory is clear, the standards are young and early movers are writing the patterns everyone else will inherit.

Rules on paper, though, are only half the answer. The other half is making sure agents actually follow them while they run. That's the third capability.