# Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems

arXiv: https://arxiv.org/abs/2606.26298 · HTML: https://mlsanity.com/paper/2606.26298/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 27 references that are in the map.
- First posted on arXiv 24 Jun 2026.

## Builds on (most cited first, 6 of 6)

- [Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization (Extended Version)](https://mlsanity.com/paper/2403.04651/) (2024)
- [Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents](https://mlsanity.com/paper/2603.20953/) (2026)
- [Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure](https://mlsanity.com/paper/2606.11632/) (2026)
- [From Logic Monopoly to Social Contract: Separation of Power and the Institutional Foundations for Autonomous Agent Economies](https://mlsanity.com/paper/2603.25100/) (2026)
- [Securing LLM Agents Need Intent-to-Execution Integrity](https://mlsanity.com/paper/2605.16976/) (2026)
- [Sovereign Execution Broker: Enforcing Certificate-Bound Authority in Agentic Control Planes](https://mlsanity.com/paper/2606.20520/) (2026)

## Abstract (arXiv)

Autonomous AI agents may begin to perform consequential, irreversible actions such as clinical prescribing and production software deployment. This paper observes that human institutions have governed powerful autonomous actors not by monitoring their reasoning but by requiring independently attested evidence at the point of consequential action. We formalise this institutional pattern as a computational governance model for AI agent systems. Under the proposed model, an agent retains full autonomy over planning and reasoning but holds no execution authority over designated high-risk actions. Execution is conditional on preconditions that are each independently attested by a separate authoritative source, cryptographically bound to a declared intent, and evaluated by a deterministic policy. Decisions are recorded in a tamper-evident log amenable to independent re-verification. We present a proof-of-concept implementation and illustrate the model with examples from software deployment and clinical prescribing.