# Governance-as-a-Service: A Multi-Agent Framework for AI System Compliance and Policy Enforcement

arXiv: https://arxiv.org/abs/2508.18765 · HTML: https://mlsanity.com/paper/2508.18765/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 15 references that are in the map.
- First posted on arXiv 26 Aug 2025.

## Builds on (most cited first, 5 of 5)

- [Training language models to follow instructions with human feedback](https://mlsanity.com/paper/2203.02155/) (2022)
- [Cooperative Inverse Reinforcement Learning](https://mlsanity.com/paper/1606.03137/) (2016)
- [Process for Adapting Language Models to Society (PALMS) with Values-Targeted Datasets](https://mlsanity.com/paper/2106.10328/) (2021)
- [LOKA Protocol: A Decentralized Framework for Trustworthy and Ethical AI Agent Ecosystems](https://mlsanity.com/paper/2504.10915/) (2025)
- [Enforcement Agents: Enhancing Accountability and Resilience in Multi-Agent AI Frameworks](https://mlsanity.com/paper/2504.04070/) (2025)

## Built on by (most cited first, 17 of 17)

- [A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes](https://mlsanity.com/paper/2601.05293/) (2026)
- [Runtime Governance for AI Agents: Policies on Paths](https://mlsanity.com/paper/2603.16586/) (2026)
- [Towards Responsible and Explainable AI Agents with Consensus-Driven Reasoning](https://mlsanity.com/paper/2512.21699/) (2025)
- [Right to History: A Sovereignty Kernel for Verifiable AI Agent Execution](https://mlsanity.com/paper/2602.20214/) (2026)
- [AI Trust OS -- A Continuous Governance Framework for Autonomous AI Observability and Zero-Trust Compliance in Enterprise Environments](https://mlsanity.com/paper/2604.04749/) (2026)
- [Ontology-Constrained Neural Reasoning in Enterprise Agentic Systems: A Neurosymbolic Architecture for Domain-Grounded AI Agents](https://mlsanity.com/paper/2604.00555/) (2026)
- [FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs](https://mlsanity.com/paper/2607.27267/) (2026)
- [Prose2Policy (P2P): A Practical LLM Pipeline for Translating Natural-Language Access Policies into Executable Rego](https://mlsanity.com/paper/2603.15799/) (2026)
- [Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents](https://mlsanity.com/paper/2604.24686/) (2026)
- [Governing What the EU AI Act Excludes: Accountability for Autonomous AI Agents in Smart City Critical Infrastructure](https://mlsanity.com/paper/2605.01091/) (2026)
- [Governance by Construction for Generalist Agents](https://mlsanity.com/paper/2605.20874/) (2026)
- [KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition](https://mlsanity.com/paper/2605.25376/) (2026)
- [Overcoming the Regulatory Bottleneck via Agent-to-Agent Protocols: A Nuclear Case Study](https://mlsanity.com/paper/2606.07866/) (2026)
- [Where Reliability Lives: Experimental Localisation of Behavioural Properties in an Agent System](https://mlsanity.com/paper/2609.03192/) (2026)
- [Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance](https://mlsanity.com/paper/2609.10105/) (2026)
- [Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems](https://mlsanity.com/paper/2609.20016/) (2026)
- [Structured Decomposition for Reliable LLM-Generated Access Control Policies](https://mlsanity.com/paper/2609.24036/) (2026)

## Abstract (arXiv)

As AI systems evolve into distributed ecosystems with autonomous execution, asynchronous reasoning, and multi-agent coordination, the absence of scalable, decoupled governance poses a structural risk. Existing oversight mechanisms are reactive, brittle, and embedded within agent architectures, making them non-auditable and hard to generalize across heterogeneous deployments. We introduce Governance-as-a-Service (GaaS): a modular, policy-driven enforcement layer that regulates agent outputs at runtime without altering model internals or requiring agent cooperation. GaaS employs declarative rules and a Trust Factor mechanism that scores agents based on compliance and severity-weighted violations. It enables coercive, normative, and adaptive interventions, supporting graduated enforcement and dynamic trust modulation. To evaluate GaaS, we conduct three simulation regimes with open-source models (LLaMA3, Qwen3, DeepSeek-R1) across content generation and financial decision-making. In the baseline, agents act without governance; in the second, GaaS enforces policies; in the third, adversarial agents probe robustness. All actions are intercepted, evaluated, and logged for analysis. Results show that GaaS reliably blocks or redirects high-risk behaviors while preserving throughput. Trust scores track rule adherence, isolating and penalizing untrustworthy components in multi-agent systems. By positioning governance as a runtime service akin to compute or storage, GaaS establishes infrastructure-level alignment for interoperable agent ecosystems. It does not teach agents ethics; it enforces them.