agent-runtime-governance

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Agent Runtime Governance

Agent 运行时治理

Design and audit the controls that keep tool-bearing agent systems predictable, observable, and safe to operate.

Scope: Runtime governance for agents that use tools, memory, approvals, subagents, evals, or external systems. NOT for generic vulnerability scanning (

security-scanner

), normal code review (

review

), prompt-only optimization (

prompt-engineer

), or MCP implementation details (

mcp-creator

设计并审计相关控制措施，确保搭载工具的Agent系统具备可预测性、可观测性且运行安全。

适用范围： 针对使用工具、内存、审批流程、子Agent、评估（evals）或外部系统的Agent进行运行时治理。不适用于通用漏洞扫描（

security-scanner

）、常规代码审查（

review

）、仅提示词优化（

prompt-engineer

）或MCP实现细节（

mcp-creator

）。

Dispatch

调度规则

`$ARGUMENTS`	Mode	Action
Empty	`menu`	Show governance modes and required inputs
`design <system>`	`design`	Define runtime policies for a new or changing agent system
`audit <path-or-system>`	`audit`	Review existing tool, approval, memory, telemetry, and eval controls
`permissions <agent-or-tools>`	`permissions`	Design allowlists, denylists, approval modes, and escalation rules
`memory <agent-or-system>`	`memory`	Define memory scope, retention, privacy, and invalidation policy
`evals <workflow>`	`evals`	Plan regression, adversarial, and runtime acceptance eval loops
`rollout <system>`	`rollout`	Define staged release, monitoring, rollback, and operator readiness controls
`incident <failure-mode>`	`incident`	Define containment and recovery controls for agent failures
Natural language about agent tools, permissions, memory, evals, or containment	Auto-detect the closest mode

`$ARGUMENTS`	模式	操作
空值	`menu`	展示治理模式及所需输入
`design <system>`	`design`	为新的或变更中的Agent系统定义运行时策略
`audit <path-or-system>`	`audit`	审查现有工具、审批、内存、遥测及评估控制措施
`permissions <agent-or-tools>`	`permissions`	设计允许列表、禁止列表、审批模式及升级规则
`memory <agent-or-system>`	`memory`	定义内存范围、保留期限、隐私策略及失效规则
`evals <workflow>`	`evals`	规划回归测试、对抗性测试及运行时验收评估循环
`rollout <system>`	`rollout`	定义分阶段发布、监控、回滚及运维人员就绪性控制措施
`incident <failure-mode>`	`incident`	定义Agent故障后的遏制与恢复控制措施
关于Agent工具、权限、内存、评估或遏制的自然语言描述	自动检测最匹配的模式

Governance Surfaces

治理维度

Surface	Review Questions
Tools	Which tools can read, write, spend money, deploy, message users, or delete data?
Approvals	Which operations require explicit user approval or human review?
Memory	What can be stored, for how long, and at what scope?
State	What is durable, replayable, idempotent, and auditable?
Telemetry	Which traces, decisions, tool calls, and failures are observable?
Evals	Which scenarios prevent regression before rollout?
Containment	How does the system stop, rollback, quarantine, or degrade safely?

维度	审查问题
工具	哪些工具具备读取、写入、消费资金、部署、发送用户消息或删除数据的能力？
审批	哪些操作需要明确的用户审批或人工审核？
内存	可存储哪些内容、存储时长及范围？
状态	哪些状态具备持久性、可重放性、幂等性及可审计性？
遥测	可观测哪些追踪数据、决策记录、工具调用及故障信息？
评估	哪些场景可在发布前防止性能退化？
遏制	系统如何安全地停止、回滚、隔离或降级？

Canonical Vocabulary

标准术语

Use these canonical terms exactly when producing governance reports.

Term	Meaning
tool consequence	The real-world effect a tool call can have: read, write, deploy, message, spend, delete, or expose
approval gate	Explicit human or policy checkpoint before a higher-risk action
runtime guard	Hook, wrapper, allowlist, denylist, test, or platform policy that enforces a governance rule
memory boundary	Scope, retention, redaction, and invalidation policy for stored agent context
containment	Stop, rollback, quarantine, or degrade action after unsafe or failed behavior
shadow mode	Runtime mode that records proposed actions without executing them

生成治理报告时请严格使用以下标准术语。

术语	含义
tool consequence	工具调用可能产生的现实影响：读取、写入、部署、发送消息、消费、删除或暴露数据
approval gate	高风险操作执行前的明确人工或策略检查点
runtime guard	用于执行治理规则的钩子、包装器、允许列表、禁止列表、测试或平台策略
memory boundary	存储Agent上下文的范围、保留期限、脱敏及失效策略
containment	出现不安全或故障行为后执行的停止、回滚、隔离或降级操作
shadow mode	记录拟执行操作但不实际执行的运行时模式

Classification Gate

请求分类规则

Classify the request before choosing a mode:

If it asks for app vulnerability scanning, route to
```
security-scanner
```
.
If it asks for code review, route to
```
review
```
.
If it asks for prompt wording only, route to
```
prompt-engineer
```
.
If it asks how to implement an MCP server, route to
```
mcp-creator
```
.
Otherwise, choose the closest runtime governance mode from the dispatch table.

选择模式前需先对请求进行分类：

若请求为应用漏洞扫描，转至
```
security-scanner
```
。
若请求为代码审查，转至
```
review
```
。
若请求仅涉及提示词措辞优化，转至
```
prompt-engineer
```
。
若请求为MCP服务器实现方法，转至
```
mcp-creator
```
。
否则，从调度表中选择最匹配的运行时治理模式。

Workflow

工作流程

Define the agent’s job, users, data sensitivity, and external effects.
Inventory tools by capability: read-only, write, destructive, financial, deploy, messaging, credential access, and network egress.
Map approval gates to consequence, reversibility, and confidence.
Define memory scope, retention, redaction, and invalidation rules.
Require telemetry for tool calls, decisions, approval outcomes, and failures.
Build evals around unsafe tool use, stale memory, missing approval, and failure containment.
Define rollout gates, rollback criteria, and operator evidence for changes that affect live users, accounts, credentials, or external systems.
Return a governance matrix with owners and enforcement points.

明确Agent的职责、用户群体、数据敏感度及外部影响。
按能力盘点工具：只读、写入、破坏性、财务操作、部署、消息发送、凭证访问及网络出口。
根据影响程度、可逆性及置信度映射审批检查点。
定义内存范围、保留期限、脱敏及失效规则。
要求对工具调用、决策、审批结果及故障进行遥测记录。
围绕不安全工具使用、过期内存、缺失审批及故障遏制构建评估体系。
针对影响活跃用户、账户、凭证或外部系统的变更，定义发布检查点、回滚标准及运维人员验证依据。
返回包含负责人及执行点的治理矩阵。

Scaling Strategy

扩展策略

Scope	Strategy
Single agent or workflow	Produce one control matrix and one eval/monitoring set
Multiple agents sharing tools	Group by tool consequence and shared approval gates
Platform-wide governance	Define baseline policy first, then exceptions by agent class
Live production rollout	Add staged rollout, rollback, monitoring, and owner review gates

范围	策略
单个Agent或工作流	生成一份控制矩阵及一套评估/监控方案
共享工具的多个Agent	按工具影响程度及共享审批检查点分组
平台级治理	先定义基线策略，再按Agent类别设置例外规则
生产环境发布	添加分阶段发布、回滚、监控及负责人审核检查点

Progressive Disclosure

渐进式披露

Start with this
```
SKILL.md
```
for routing and control surfaces.
Read
```
references/control-matrix.md
```
for permissions, memory, telemetry, and eval controls.
Read
```
references/rollout-governance.md
```
only when release, rollback, monitoring, or production readiness is in scope.
Do not load security, prompt, or MCP implementation references unless routing redirects to those skills.

从本
```
SKILL.md
```
开始，了解路由规则及控制维度。
阅读
```
references/control-matrix.md
```
获取权限、内存、遥测及评估控制细节。
仅当涉及发布、回滚、监控或生产就绪性时，阅读
```
references/rollout-governance.md
```
。
除非路由转向对应技能，否则不要加载安全、提示词或MCP实现相关参考内容。

Reference File Index

参考文件索引

File	Read When
`references/control-matrix.md`	Designing or auditing runtime control surfaces
`references/rollout-governance.md`	Planning staged release, rollback, monitoring, and operator readiness

文件	阅读场景
`references/control-matrix.md`	设计或审计运行时控制维度时
`references/rollout-governance.md`	规划分阶段发布、回滚、监控及运维人员就绪性时

Output Shape

输出格式

markdown

undefined

markdown

undefined

Agent Governance Report

Agent 治理报告

System:
Mode:
Risk tier:

系统:
模式:
风险等级:

Control Matrix

控制矩阵

Surface	Current	Required	Enforcement	Evidence

维度	当前状态	要求标准	执行方式	验证依据

Required Changes

需变更内容

Evals And Monitoring

评估与监控

Rollout And Containment

发布与遏制

undefined

undefined

Critical Rules

核心规则

Classify tools by consequence before recommending autonomy.
Require explicit approval for irreversible, costly, public, credential, or destructive actions.
Keep memory scope narrow and document retention, redaction, and invalidation.
Require telemetry for tool calls, approvals, denials, failures, and containment actions.
Add evals for unsafe tool use, missing approval, stale memory, and rollback behavior.
Separate policy from enforcement; name the hook, wrapper, test, or runtime gate that enforces each rule.
Do not replace
```
security-scanner
```
,
```
review
```
,
```
prompt-engineer
```
, or
```
mcp-creator
```
; route to them when the request is outside runtime governance.
Do not mark a governance change ready without rollout, rollback, and monitoring criteria.

在推荐自主操作前，先根据影响程度对工具进行分类。
不可逆、高成本、公开、涉及凭证或破坏性操作需明确审批。
保持内存范围狭窄，并记录保留期限、脱敏及失效规则。
要求对工具调用、审批通过/拒绝、故障及遏制操作进行遥测记录。
添加针对不安全工具使用、缺失审批、过期内存及回滚行为的评估项。
将策略与执行分离；明确每个规则对应的钩子、包装器、测试或运行时检查点。
不可替代
```
security-scanner
```
、
```
review
```
、
```
prompt-engineer
```
或
```
mcp-creator
```
；当请求超出运行时治理范围时，需转至对应技能。
若未定义发布、回滚及监控标准，不得标记治理变更已就绪。

Validation Contract

验证契约

Run from this skill directory before declaring changes complete:

bash

python scripts/check.py

Completion criteria:

```
scripts/check.py
```
exits 0.
No portable-CLI violations remain under this skill directory.
Smoke review covers explicit, implicit, rollout, and negative-control prompts.

在宣布变更完成前，需从本技能目录运行以下命令：

bash

python scripts/check.py

完成标准：

```
scripts/check.py
```
执行退出码为0。
本技能目录下无portable-CLI违规项。
冒烟审查覆盖明确、隐含、发布及负向控制的提示词。