Governance

Autonomy without losing control.

Define who can use each Secure AI Agent, which systems it accesses, what it can execute on its own, and which actions require approval.

Talk to UPXUnderstand governance
Permissions and limits panel for the Finance Agent: querying the ERP, generating reports, and creating tasks are allowed; issuing a payment requires approval; deleting records is blocked.
FAFinance AgentSecure AI Agent
Active
Permissions and limits
Query the ERPRead-onlyAllowed
Generate reportsOperational dataAllowed
Create taskWithin the rulesAllowed
Issue paymentA person decidesRequires approval
Delete recordsOutside the scopeBlocked
The principle

The more capable the agent, the stronger the governance must be.

An AI Agent can query systems, interpret information, make decisions within rules, and execute actions in the operation.

Governance sets the limits of that work: who can access it, what the agent can do, when it must stop, and who needs to approve.

This way, autonomy no longer means the absence of control. It exists within a defined scope.

Governance principle diagram: capability levels (read with 1 active control, analyze with 3, act with 5) pass through the governance limits — who can access, what the agent can do, when it must stop, and who approves — resulting in autonomy within a defined scope.

Capability

  • Read1 active control
  • Analyze3 active controls
  • Act5 active controls

Governance

Limits of the work

What governance defines

  • Who can access itIdentity and permission
  • What the agent can doScope of actions
  • When it must stopAuthority limit
  • Who needs to approveHuman approval
Capability and control grow togetherControlled execution

Result

Controlled

Autonomy with scope

  • Autonomy is not the absence of control
  • Each level carries its own control
  • Higher-impact actions require approval
Governance model

Control across four dimensions.

Each Secure AI Agent operates according to policies defined for the context in which it will be used.

Governance layers panel: the Finance Agent at the center, wrapped by access, scope, autonomy, and oversight.
Governance layers
01Access
02Scope
03Autonomy
04Oversight
Finance AgentSecure AI Agent
  1. 01Access

    Who can use it

    Define the users, teams, and contexts authorized to interact with each agent.

  2. 02Scope

    What it can access

    Determine which systems, integrations, information, and tools are available.

  3. 03Autonomy

    What it can execute

    Establish which tasks can happen automatically and which have limits.

  4. 04Oversight

    How to follow up

    Keep visibility over the agent's actions, approvals, and operational results.

Controlled autonomy

Not everything needs approval. Not everything should be automatic.

Autonomy can vary by action. Operational tasks can happen automatically, while sensitive decisions remain subject to human approval or are fully blocked.

Explore autonomy
Execution policy panel: querying data and generating reports are allowed automatically; issuing a payment requires approval; deleting records is blocked.
Execution policy
Query dataAllowed automaticallyAutomatic
Generate reportAllowed automaticallyAutomatic
Issue paymentRequires approvalApproval
Delete recordsBlockedBlocked
Human approval

The agent prepares. You decide.

When an action exceeds the defined autonomy level, the Secure AI Agent stops execution and requests a decision from an authorized person.

Approval screen: the Finance Agent prepared payment 447 to the carrier, for R$ 48,200.00, with data checked, policy applied, and limit verified. The action awaits approval.
FAFinance AgentRequest prepared
Pending
Payment #447CarrierR$ 48,200.00
  • Data checked
  • Policy applied
  • Limit verified
Approval required
ApproveReview
Traceability

Know what happened.

Governance also depends on visibility. Relevant actions can be logged to allow follow-up, investigation, and review of how Secure AI Agents operate.

Audit trail panel: the chronological sequence of one operation, from the request received to the action executed, including the policy applied and the human approval.
Audit trailRecord created
  1. 09:41:03Request receivedFinance Agent
  2. 09:41:06Policy appliedFIN-024
  3. 09:41:07Approval requestedPending
  4. 09:43:21Approved by managerID #84921
  5. 09:43:22Action executedInvoice 4471
Responsibility

Control does not end at configuration.

Governance follows the agent's life cycle. Rules can evolve as processes, integrations, and responsibilities change.

  1. 01 / Define

    Clear policies

    Establish access, permissions, limits, and autonomy levels before execution.

  2. 02 / Follow up

    Operational oversight

    Keep visibility over relevant actions, approvals, and results.

  3. 03 / Adjust

    Ongoing governance

    Review rules and permissions as the agent takes on new responsibilities.

AI governance

More autonomy. Within the rules.

Put Secure AI Agents into your operation with permissions, limits, human approval, and traceability defined for your company's context.

Talk to UPX