Credo AI announced Agent Governor on July 14, releasing it as a research preview and describing it as a product that governs AI agents at the layer where they actually act. The company calls that layer the agent harness, meaning the software that runs an agent and decides which tools it can reach, which data it can see, and what happens in the instant before and after every action it takes. Claude Code is the first harness the product supports, with others planned.
The mechanism is straightforward to describe. An organization's risk team selects one of three policy postures, described by Credo AI as permissive, balanced, and strict, and an administrator installs it onto the harness on a single machine or across the company. The policy then evaluates the agent at each meaningful step of its loop, covering session start, the prompt, the moment before and after every tool call, and session end. Each of those checkpoints resolves to one of four outcomes: allow, block, escalate, or advise. Every decision leaves a structured record showing which policy version was active, who started the session, what tool was called with what arguments, and what was decided.
Ehrik Aldana, Credo AI's head of product, set out the reasoning in the product announcement:
A prompt gives an agent an instruction. A harness determines how it acts.
Ehrik Aldana, Head of Product, Credo AI, "Introducing Credo AI Agent Governor," July 14, 2026
The company published a companion essay by its chief executive on the same day, along with a longer framework paper on governing agents at the harness. Read together, the three documents amount to an argument that the governance model the industry spent six years building was designed for a technology that answered questions, and that agents, which take actions, require the controls to sit somewhere else entirely.
The Conditions That Drove This
Agent counts are about to move by four orders of magnitude. Gartner projects that the average Fortune 500 company will run more than 150,000 AI agents by 2028, against fewer than 15 in 2025, which is a scale that no committee, review board, or approval queue built for human-paced work can absorb.
Almost nobody is governing what they have already deployed. Credo AI's own survey of 371 senior leaders found that 60% already run AI across multiple departments while only 4% govern it at scale, which means the gap between deployment and control was wide before the agent wave arrived.
Agents act rather than answer, and actions cannot be reviewed after the fact. A single coding session can read a repository, call dozens of tools, write code, change records, and move work between systems, and each of those lands directly on production without a draft passing through a reviewer first.
The harness, and not the model, determines what an agent can touch. Two agents running on the same model behave completely differently depending on what their harnesses permit, which makes the harness the single largest lever on agent behavior and the one most enterprises have left set to whatever the vendor shipped.
Harnesses are already in production whether anyone approved them or not. Claude Code, Codex, and Cursor are harnesses wrapped around coding models, and every homegrown agent built on an SDK runs inside a harness its own developers assembled, which means something is already deciding what those agents can reach.
The cost of an ungoverned agent action is now documented rather than hypothetical. The Guardian reported in April that an AI coding assistant deleted a company's database, and a bad commit, a leaked credential, or a destructive shell command are the ordinary failure modes of a coding agent operating without boundaries.
Binary permission models fail in both directions. A control that only allows or denies either blocks so much that engineers route around it or catches so little that it provides no protection, which is why the middle outcomes, escalation to a named human and advisory warnings the agent can act on, are the part that makes runtime governance workable.
What AI Governance Looked Like Before This
Enterprise AI governance has passed through two settled eras, and both of them assumed a gap between what the AI produced and what the business did about it.
The first era governed models. The questions were which models an organization had, who owned them, whether they had been tested, and whether they met internal requirements. The artifacts were inventories, model cards, validation reports, and a registry somebody maintained. That work was sound, and it remains the right approach for models and vendors.
The second era arrived with generative AI and governed outputs. The questions became whether an answer was accurate, safe, and consistent with policy. A bad output was never harmless, since it could mean wrong guidance, leaked data, or a biased decision. But an output only became an outcome when a person or a process acted on it, and that gap between the answer and the business is precisely where governance lived. Teams could evaluate, review, and correct in the space between.
Everything built during those two eras depends on that space existing. Policy documents, oversight committees, review gates, risk assessments, and dashboards all operate on the assumption that somebody looks at the output before it becomes an action. Remove the gap and the entire apparatus is reporting on events that have already happened.
What It Looks Like Now
Credo AI is arguing for a third era that governs actions, and the practical consequence is that the controls move from a document into the agent's own execution loop. The company describes this as governance-as-code, meaning the organization's approved policy is compiled into versioned, enforceable rules that the harness applies while the agent is running rather than rules a person is expected to remember and enforce afterward.
In practice this changes what a control looks like. Under the balanced posture, Credo AI's example is a Claude Code agent fixing a security bug. It can read the repository and cannot reach the credential store. Its tests run without interruption. A destructive shell command is blocked outright. A new dependency above the risk threshold stops and waits for a named human to approve it. A secure-coding suggestion arrives as advice rather than a ticket. When the session ends, there is a record of every governed action.
The four-outcome model is the part worth studying, because it is where this differs from the permission systems enterprises already run. Allow and block are familiar. Escalate routes a specific action to a specific person before it proceeds, which preserves human authority at the points where consequences are real without demanding a person review every keystroke. Advise passes a warning to the agent that it can take into account, which treats the agent as something that can respond to guidance rather than only to a gate.
Navrina Singh, Credo AI's chief executive, framed the shift in a companion essay published the same day:
A model supplies capability. Only governance earns it the right to act.
Navrina Singh, CEO, Credo AI, "The Agentic Trust Moment," July 14, 2026
Singh's essay also makes an argument about how autonomy should be granted, which is the more durable idea in the announcement. An agent does not deserve wider authority because the model beneath it scored well on a benchmark. It earns that authority by demonstrating, with evidence a reviewer can examine, that it behaves as intended inside the boundaries it was given. Boundaries widen as trust is earned and tighten the moment it is not.
The organizations that lead the agent era will not be the ones willing to accept the most uncontrolled autonomy. They will be the ones that can govern authority precisely, learn continuously, and earn the right to do more.
Navrina Singh, CEO, Credo AI, "The Agentic Trust Moment," July 14, 2026
Credo AI's framework paper on agent governance configuration sets out the underlying model in more detail, and the company says it ran Agent Governor in its own environment before releasing it, having reached the point where reviewing what its internal agents had done after the fact stopped being sufficient.
Our Take
AI Governance Take
The central claim here holds up, and it holds up independently of who is making it. A policy that cannot reach the moment an agent acts is a description of intent rather than a control, and once agents are taking hundreds of consequential actions per session, the review-after-the-fact model is producing an audit trail of things that already happened. Moving enforcement into the harness is the correct architectural response, and Credo AI is early to name it clearly.
Two questions belong on the evaluation list anyway.
The first is coverage. Agent Governor supports one harness today. An enterprise running Claude Code, Codex, Cursor, and a set of homegrown agents built on three different SDKs has four or more harnesses in production, and governance installed on one of them leaves the rest operating on whatever defaults their builders chose. Credo AI says more harnesses are coming and has been straightforward about the current scope, which is the right way to ship a research preview. Buyers should size the gap between what they run and what is supported before treating this as a solved problem.
The second is where the record lives. Runtime enforcement generates the evidence that a regulator or an auditor will eventually ask for, and that evidence is most useful when it sits in an accountability structure the enterprise owns across every agent it runs, rather than in the tooling of whichever vendor happened to govern one harness. That is a general point about agent governance rather than a criticism of this product, and it applies with equal force to every vendor now moving into this layer.
The practical test for a governance team reading this is simple enough. Name every harness running in the organization. Say who approved what each one permits. If the answer to the second question is that nobody did, the defaults of whoever built the tool are currently serving as company policy, and that was true before this announcement and remains true after it.
