From Model Capability to Governed Action: An Architecture for Secure Agentic AI

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Autonomous AI is becoming a systems-security problem, not only a model-safety problem. Modern agents combine foundation models with persistent context, tools, execution environments, credentials, networks, subagents, memory, and increasingly long-running operational loops. Recent frontier-lab disclosures and academic research show why this surrounding architecture matters. A capable model may generate a valid-looking action, discover a path that designers did not anticipate, or execute a sequence of individually permissible steps whose cumulative effect violates a system-level constraint. This article examines three emerging ideas through the lens of governed autonomous systems. First, the runtime or agent harness is becoming a critical boundary between model capability and real-world effect. Second, capability is not authority: knowing how to perform an action does not mean an autonomous system should be permitted to execute it. Third, per-action authorization may be necessary but insufficient when an evolving sequence of actions creates cumulative risk, privilege, or impact. The article introduces the Governed Execution Boundary as a public research framing for the architectural separation between model-generated intent and consequential action. It also examines trajectory-level assurance, governance of reduced-safeguard evaluation environments, machine-speed enforcement, and the relationship between model alignment and external architectural control. The central proposition is: Model capability is not governed authority. A secure autonomous system must decide not only whether an individual action is permissible, but whether the authority remains valid, the evolving trajectory remains acceptable, the resulting effect matches what was authorized, and the behavior remains attributable, revocable, and evidentiary.