{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1240",
  "slug": "governance-at-runtime",
  "edition": "2026-11-07T00",
  "url": "https://hangingcontext.com/stories/2026-11-07/governance-at-runtime/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "AI governance stops being a policy document and becomes runtime enforcement",
  "headline": "Governance Moves From the Policy Binder to the Runtime",
  "dek": "Patching cannot keep up with machine-speed exploits, so control is shifting to the moment before an agent acts: allow, constrain, approve, block or halt, with privacy and resilience built into the same layer.",
  "published_at": "2026-11-07T00:44:11Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 5 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 5,
  "publishers": [
    "andreessen-horowitz-articles",
    "databricks-blog",
    "openbox-ai-blog",
    "protecto-blog",
    "zenity-blog"
  ],
  "sources": [
    "andreessen-horowitz-articles",
    "databricks-blog",
    "openbox-ai-blog",
    "protecto-blog",
    "zenity-blog"
  ],
  "distinct_source_count": 5,
  "key_facts": [
    {
      "text": "Median full remediation time for vulnerabilities was 43 days in 2026, while average flaw-remediation time reached 252 days in 2025.",
      "cites": [
        {
          "claim_ids": [
            "1794000762319469451",
            "1794000762320469452"
          ],
          "manifest_id": "1794000520184468410"
        }
      ],
      "self_reported": false
    },
    {
      "text": "OpenBox returns one of five governance decisions for agent operations: ALLOW, CONSTRAIN, REQUIRE_APPROVAL, BLOCK or HALT, with a stricter verdict overriding a looser one.",
      "cites": [
        {
          "claim_ids": [
            "1793996279090444454",
            "1793996279103444455"
          ],
          "manifest_id": "1793976820975313639"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Databricks' Unity Gateway lets administrators control model availability by user, group or team, set spending limits and hard caps, and restrict processing to specific geographies.",
      "cites": [
        {
          "claim_ids": [
            "1793998663114456400",
            "1793998663117456402",
            "1793998663119456404"
          ],
          "manifest_id": "1793998382329455510"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Tokenization replaces personal values in a prompt or document with opaque tokens so a model can reason without seeing clear-text personal data.",
      "cites": [
        {
          "claim_ids": [
            "1793973077300303275"
          ],
          "manifest_id": "1793972825405302503"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Only 28% of ransomware victims recovered all their data in 2026, and victims whose backups were compromised reported median recovery costs of $3 million, against $375,000 when backups survived.",
      "cites": [
        {
          "claim_ids": [
            "1794000762323469454",
            "1794000762325469455"
          ],
          "manifest_id": "1794000520184468410"
        }
      ],
      "self_reported": false
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The gap patching cannot close",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794000762319469451",
                "1794000762320469452",
                "1794000762322469453"
              ],
              "manifest_id": "1794000520184468410"
            }
          ],
          "markdown": "The old security bargain was that a flaw would be found, a patch would be written, and systems would be fixed before attackers caught up. That bargain no longer holds. Median full remediation time for vulnerabilities was 43 days in 2026, and average flaw-remediation time reached 252 days in 2025, up from 171 days five years earlier. Meanwhile AI systems can turn a published fix into a working exploit in hours, so the window between disclosure and attack keeps widening while the fix stays slow and human-gated."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794000762323469454",
                "1794000762325469455",
                "1794000762326469456",
                "1794000762331469459"
              ],
              "manifest_id": "1794000520184468410"
            }
          ],
          "markdown": "The cost of that gap shows up in recovery, not just in breaches. Only 28% of ransomware victims successfully recovered all their data in 2026, and victims whose backups were compromised reported median recovery costs of $3 million, compared with $375,000 when backups survived. The authors of the analysis identify six opportunities for new security products that make patching unnecessary or someone else's job, and for systems that cannot be patched at all, such as industrial control or medical devices, they point to off-device controls like network segmentation or removing access from the open internet."
        }
      ]
    },
    {
      "heading": "Enforcement before execution",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793996279070444452",
                "1793996279129444461",
                "1793996279090444454",
                "1793996279103444455"
              ],
              "manifest_id": "1793976820975313639"
            }
          ],
          "markdown": "The same timing problem now faces enterprises running autonomous agents, and the answer taking shape is governance at runtime rather than review after the fact. OpenBox draws a sharp line between observability, which shows what agents have already done, and governance, which determines what agents are allowed to do before execution. Enterprise agents that can take consequential actions without step-by-step approval require review processes that occur before the action runs, and OpenBox returns one of five decisions for each operation: ALLOW, CONSTRAIN, REQUIRE_APPROVAL, BLOCK or HALT, with a stricter verdict overriding a looser one."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793996279039444447",
                "1793996279050444448",
                "1793996279057444449",
                "1793996279064444451",
                "1793996279116444457",
                "1793996279110444456",
                "1793996279131444462"
              ],
              "manifest_id": "1793976820975313639"
            }
          ],
          "markdown": "The urgency is grounded in Anthropic's September 2026 threat report, which describes AI autonomy in cyber operations ranging from chat assistance to workflows running with minimal human supervision. Anthropic treats autonomy and harm as separate axes: autonomy multiplies the scale and speed of an operation while reducing operating costs and complexity, and a majority of the cyber operations it described were enabled by AI through direct execution or orchestration. Humans remained heavily involved in target selection, monetisation and review of results, and the report covers operations disrupted between December 2025 and August 2026, though its findings describe cases chosen for publication and do not measure how common the activity is."
        }
      ]
    },
    {
      "heading": "One gateway for models, money and geography",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793998663111456398",
                "1793998663112456399",
                "1793998663114456400",
                "1793998663117456402",
                "1793998663118456403"
              ],
              "manifest_id": "1793998382329455510"
            }
          ],
          "markdown": "For public sector organisations the governance question arrives before any model is chosen, and it is practical rather than abstract. Public sector AI projects often stall because governance questions about data location, cost and access remain unanswered, and the organisations making real progress are the ones that solve governance before scaling adoption. Databricks' Unity Gateway is built around that sequence: administrators can control model availability by user, group or team, set spending limits and hard caps by user, team or use case, and use Smart Routing to direct tasks to cost-effective models."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793998663119456404",
                "1793998663110456397",
                "1793998663116456401",
                "1793998663121456405",
                "1793998663122456406"
              ],
              "manifest_id": "1793998382329455510"
            }
          ],
          "markdown": "Geography is part of the same control plane. Account admins can restrict processing of Databricks-hosted foundation models to specific geographies, which matters because third-party coding agents like Codex and Claude Code can route requests to infrastructure in other countries. The gateway provides day-zero access to frontier and open-source models, supports models from multiple providers, open-source models and external endpoints, and is built into Databricks without separate infrastructure. This suggests the emerging pattern is a single choke point where model choice, budget and data residency are decided together, rather than three separate approvals."
        }
      ]
    },
    {
      "heading": "Privacy at the prompt layer, resilience by design",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793973077291303270",
                "1793973077294303271",
                "1793973077300303275",
                "1793973077309303282",
                "1793973077305303279",
                "1793973077301303276",
                "1793973077302303277",
                "1793973077304303278"
              ],
              "manifest_id": "1793972825405302503"
            }
          ],
          "markdown": "Privacy law is pushing in the same direction, toward controls that act on data before a model sees it. GDPR does not ban the use of AI, and seven specific controls cover the majority of GDPR exposure for AI applications, according to the analysis. Tokenization replaces personal values with opaque tokens to allow model reasoning while maintaining privacy, but tokenized data remains personal data if the controller holds the re-identification key, and encryption does not solve clear-text exposure at the moment of model inference. Vendor training on user data should be disabled, Article 22 restricts decisions made solely by automated means with significant effects, and agent tool calls that carry personal data constitute a disclosure under GDPR."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793996259707441997",
                "1793996259709441998",
                "1793996259712442000",
                "1793996259710441999",
                "1793996259713442001",
                "1793996259714442002",
                "1793996259716442003"
              ],
              "manifest_id": "1793995892935440753"
            }
          ],
          "markdown": "The final piece is accepting that agents will fail, and designing the failure. Agentic AI systems fail by continuing to operate and improvising around errors rather than stopping, and catastrophic failures result from chains of incorrect outputs accepted as ground truth in workflows lacking checkpoints. The proposed answer is four control planes: Bounded Authority, Circuit Breaker, Observable Reasoning and Graceful Degradation, with resilience treated as an architectural decision made before code is written or tools are purchased. Bounded Authority means treating each agent as a distinct non-human identity with its own credentials, circuit breakers halt autonomous execution at irreversible boundaries, and observable reasoning logs must capture decision provenance, not just side effects. The implication is that governance, privacy and resilience are converging into one runtime discipline, and the organisations that treat them as separate documents will keep discovering the gap after the action has already happened."
        }
      ]
    }
  ],
  "unresolved": [
    "OpenBox notes runtime governance does not cover operations an agent can reach by an ungoverned route.",
    "Anthropic's report does not measure how common autonomous AI misuse is in the wild.",
    "The legal status of tokenized data remains a case-by-case determination based on the recipient's ability to re-identify individuals.",
    "The long-term impact of centralised cloud control on internet sovereignty, and the civil-liberties trade-offs of government-led remote remediation, remain open."
  ],
  "decision_card": {
    "not_for": [
      "Teams looking for a vendor ranking or a product recommendation",
      "Legal advice on GDPR or the EU AI Act"
    ],
    "useful_for": [
      "Executives deciding where governance controls should sit as agents gain autonomy",
      "Security and compliance leads comparing runtime enforcement with after-the-fact review"
    ],
    "compare_against": [
      "Runtime agent-governance products and gateway platforms",
      "Patch-management and backup-recovery benchmarks"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-07T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794000520184468410",
    "1793976820975313639",
    "1793998382329455510",
    "1793972825405302503",
    "1793995892935440753"
  ],
  "manifests": [
    {
      "title": "Defense in Depth, Rebuilt for Machine Speed",
      "source_url": "https://a16z.com/defense-in-depth-rebuilt-for-machine-speed",
      "manifest_id": "1794000520184468410",
      "source_name": "andreessen-horowitz-articles",
      "published_date": "2026-11-06"
    },
    {
      "title": "Governing Autonomous AI Agents That Act Without Asking",
      "source_url": "https://openbox.ai/blog/governing-autonomous-ai-agents-that-act-without-asking",
      "manifest_id": "1793976820975313639",
      "source_name": "openbox-ai-blog",
      "published_date": "2026-11-06"
    },
    {
      "title": "How public sector organizations can govern AI at scale",
      "source_url": "https://databricks.com/blog/how-public-sector-organizations-can-govern-ai-scale",
      "manifest_id": "1793998382329455510",
      "source_name": "databricks-blog",
      "published_date": "2026-11-06"
    },
    {
      "title": "GDPR-compliant AI: the core rules, the edge cases, and where tokenization fits",
      "source_url": "https://protecto.ai/blog/gdpr-compliant-ai",
      "manifest_id": "1793972825405302503",
      "source_name": "protecto-blog",
      "published_date": "2026-11-06"
    },
    {
      "title": "Resilience by Design: Architecting Agentic Systems to Fail Safely, Not Catastrophically",
      "source_url": "https://zenity.io/blog/resilience-by-design-architecting-agentic-systems-to-fail-safely",
      "manifest_id": "1793995892935440753",
      "source_name": "zenity-blog",
      "published_date": "2026-11-06"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794000520184468410",
      "1793976820975313639",
      "1793998382329455510",
      "1793972825405302503",
      "1793995892935440753"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794000520184468410",
      "all": "for id in 1794000520184468410 1793976820975313639 1793998382329455510 1793972825405302503 1793995892935440753; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-07/governance-at-runtime/",
    "json": "https://hangingcontext.com/stories/2026-11-07/governance-at-runtime/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-07/governance-at-runtime/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-07T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-07/phone-tree-gets-a-face/",
      "headline": "The phone tree is getting a face, and a memory",
      "slug": "phone-tree-gets-a-face"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-07/certified-coworkers/",
      "headline": "The enterprise AI coworker arrives with a job description and an audit trail",
      "slug": "certified-coworkers"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-07/assistants-enter-regulated-work/",
      "headline": "General assistants step into regulated work, read-only and supervised",
      "slug": "assistants-enter-regulated-work"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-06/enterprise-agentic-ai-measurement-gap/",
      "headline": "98% of companies use AI in customer service. Only 15% run it across departments",
      "slug": "enterprise-agentic-ai-measurement-gap"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Connect your agent over MCP",
    "text": "Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network.",
    "cta": {
      "label": "How to connect",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-07/governance-at-runtime/"
  }
}