Agent Fleet Governance: Applied Case Lab
If an enterprise operates 10,000 autonomous agents, who authorises each actor, what can it legitimately do, how may it delegate authority, who is accountable, how can it be stopped, and what evidence proves whether it acted within its mandate? A proposed four-week laboratory that extends Mandate Engineering from one actor to a population.
Status. Proposed programme in development. The design assumptions on this page — four weeks, approximately 24–32 notional learning hours, simulation-based, evidence-centred, tool-neutral, assessed through practical artefacts — are proposals, not an approved programme specification. No cohort has run; no credential, price, date or admission exists; the Foundation programme's own specification, assessment weights and gates are unchanged.
From one mandate to the organisation
One discipline, one vocabulary and one lifecycle — BUILD → OPERATE → GOVERN — applied at three scales. Each level inherits the artefacts of the level below.
Mandate Engineering — Foundation
Design, operate, verify and revoke bounded authority for one actor or a limited agent system. Eight weeks, 64 hours, nine artefacts, ten domains, four gates. Complete at development-draft level; In Development — Not Open for Enrolment. Programme page
Agent Fleet Governance: Applied Case Lab
Govern a population of interacting agents under one enterprise: registry, envelopes, delegation graph, runtime decisions, aggregate limits, revocation cascades, evidence and independent review. This page.
Synthetic Enterprise Architecture
The organisation itself: human–agent organisational design, enterprise-level allocation of decision rights, multi-agent accountability, cross-organisational delegation, risk concentration and systemic failure, governance architecture and auditability. Scope stated; no curriculum; not specified. Programme architecture
The three programme levels are distinct from the Institute's conceptual five-level competence ladder (Foundation · Operator · Architect · Governor · Fellow), which remains conceptual.
The distinction the Lab is built to teach
Four things are routinely confused. A technical identity answers which workload is this and is established by an identity issuer. A technical permission answers what can it call and is established by platform scopes and policies. An organisational mandate answers what is it authorised to achieve, within which boundaries, reserved decisions and limits, on whose accountability and is established by a principal and an accountable owner. Legal authority — whether the principal actually holds the power delegated — lies outside all three.
A log of an action proves that the action occurred. It does not by itself establish that the actor held a valid mandate, that the mandate lay within the principal's authority, or that the authority was legitimate. The Lab trains practitioners to make and test that distinction at scale.
What the Lab teaches
- Agent population architecture and mandate classification — every active identity maps to exactly one valid mandate held by a named human.
- Delegation graphs, permission inheritance and accountability — authority is inherited within an explicit right and only narrows; it is never created by delegation.
- Runtime authority decisions and change-of-plan re-authorisation — permit, deny or escalate as a record, not an event; a changed plan is not covered by the original mandate.
- Collective risk, resource limits and emergency revocation — individually permitted actions cannot bypass an enterprise-wide ceiling; evaluation fails closed when facts are missing.
- Evidence records, incident reconstruction and independent assurance — what a stranger needs to establish which authority an action rested on, and where proof ends.
Four weeks, seven artefacts, one fleet
Each week produces artefacts on the flagship case. Hours are notional and untested.
- WK 1Population architecture and classification — BUILDCorrect and annotate the Enterprise Mandate Registry; write an Authority Envelope for one agent class that a stranger could enforce. Artefacts A and B.
- WK 2Delegation graphs and accountability — BUILD → OPERATEMap every delegation edge with both accountable owners and its enforcement point; find where attribution would break. Artefact C. Scenario S1.
- WK 3Runtime authority, collective risk, emergency revocation — OPERATERecord every authorisation decision under aggregate limits and change-of-plan events; execute and verify a revocation cascade. Artefacts D and E. Scenarios S2–S5.
- WK 4Evidence, reconstruction, independent assurance — GOVERNTurn every claim into evidence that could fail; reconstruct an incident; write an Independent Governance Review with a continuation decision; defend it under a material change. Artefacts F and G. Scenario S6.
ME-001 — Synthetic Enterprise 10K
A hypothetical enterprise of 10,000 agents across six functional areas — customer operations 3,000 · data and research 2,500 · production and workflow 2,000 · finance 1,000 · supply chain 1,000 · oversight and assurance 500. The counts are design inputs. The registry is synthetic and regenerated deterministically; no 10,000-agent system has been deployed or executed. The case includes human accountable principals, a mandate registry, agent identity and configuration records, authority envelopes, delegation chains, spending and resource limits, human approval conditions, prohibited actions, revocation and suspension pathways, evidence provenance, separation of duties and cross-agent incident escalation.
Unauthorised subdelegation
An agent attempts to delegate authority it does not possess. Expected: denied; delegation inherits and narrows, never creates.
Collective budget violation
Three hundred payments, each within its individual limit, reach the enterprise-wide daily ceiling part-way through. Expected: the first payment over the ceiling is escalated; nothing above it executes.
Changed execution plan
An agent meets an obstacle and proposes a materially different method. Expected: re-authorisation by the accountable owner; the original mandate does not cover the new plan.
Compromised agent identity
A request arrives under an existing identity whose configuration does not match the registry. Expected: denied, suspended, incident raised; reinstatement is a recorded human act.
Revocation cascade
A human authority revokes a parent mandate while delegated tasks are pending. Expected: all pending tasks halt; the revocation is verified by probe, not assumed.
Missing evidence
A completed transaction lacks records sufficient to establish which mandate authorised it. Expected: the finding "unproven", recorded; the ledger entry proves movement, not authority.
Each scenario is provided to learners with initial conditions, actor and principal, applicable mandate, expected safe behaviour, failure conditions, required evidence, the learner task and a statement of what remains unproven. Assessor rubrics and planted conditions are never published.
A working demonstration
A small, deterministic, browser-based demonstration accompanies the case. A learner can inspect an agent's current authority, propose an action, see the applicable boundary and the resulting decision — permit, deny or escalate — trigger a change-of-plan event and a revocation, and read the resulting evidence record. Aggregate-limit enforcement prevents individually permitted actions from bypassing the enterprise-wide ceiling; evaluation fails closed when necessary facts are unavailable; a denied action never appears to execute. The demonstration distinguishes agent simulation, policy evaluation and real operational execution — the last never occurs. It establishes that a stated rule set can be enforced; it establishes nothing about any real product, enterprise or legal position.
Assessment, as proposed
Practical artefacts assessed against descriptors; no quiz, no attendance credit. Seven proposed domains — population architecture and registry integrity; authority envelope design; delegation, inheritance and attribution; runtime decisions and fail-closed behaviour; revocation cascade and recovery; evidence sufficiency and incident reconstruction; governance review and defence — with two proposed critical gates (delegation and attribution; revocation cascade) that cannot be averaged away. A first assessor and an independent second reader, as in the Foundation. These descriptors are separate from the Foundation's D1–D10 and G1–G4, which are unchanged. Assessment and evidence
Prerequisites and boundaries
Entry presupposes the competences the Foundation gates test — boundaries, evidence, revocation, accountability; whether Foundation completion becomes a formal prerequisite is an owner decision, and no admission rule exists. The Lab does not teach vendor-specific configuration, legal opinion on corporate authority, cryptographic protocol design or penetration testing; it teaches the governance layer between organisational intent and machine-enforceable permission, and names where that layer ends.
Research foundation
The Lab rests on the Institute's analysis The 10,000-Agent Problem: Who Has the Authority to Let Machines Act? — a reading of the September–October 2026 record of vendor agent controls, identity and authorisation standards work and security guidance, and of the layer they leave untreated: the translation of an organisational mission into a bounded, enforceable and revocable mandate.
Roles the Lab prepares
Delegation Architect, Agent Fleet Manager, Evidence Architect and Synthetic Enterprise Architect — four of the seven role clusters on the Future professions page, each with the maturity label the Institute has assigned it. None is a recognised profession or an official qualification.
Programme enquiries
The Institute corresponds with practitioners, organisations, standards bodies, regulators, insurers and prospective participants who see the same gap. There is no application, enrolment or payment form; early interest registration opens shortly; enquiries are answered by e-mail.
Programme enquiries
Agent Fleet Governance: Applied Case Lab is a proposed programme in development and is not open for enrolment. Enquiring does not place you on a waiting list and creates no obligation on either side.