The Verified Agentic Operating Model

1. Why the current ADLC is necessary but insufficient

The conventional agent lifecycle – Build, Test, Deploy, Monitor – is a critical advance over treating agents as isolated demonstrations. It puts evaluation before deployment, requires durable runtimes and sandboxes, makes traces the basis of debugging, and feeds production failures back into datasets and experiments [2]. The accompanying Agentic Operating Model correctly reframes agent engineering as an organizational capability spanning people, process, and technology, with governance, security, FinOps, compliance, and interoperability cutting across the lifecycle [3]. The AGF then moves governance to the center of the AI-native firm and defines verified autonomy as the unit of productive capacity [1].

Those foundations are strong, but the next phase requires a more explicit control theory. At scale, the lifecycle is no longer a sequence managed primarily by humans. It becomes an always-on cybernetic system that authorizes, observes, evaluates, corrects, and reallocates agentic work. The enterprise must be able to answer, at any moment: What is this agent authorized to do? Which compound version is running? What evidence supports continued autonomy? What changed in its world model? Which failures are recurring? Which proposed fix is responsible for improvement? What does the action cost in total? What value did it create? What residual risk is concentrated in the portfolio? Existing lifecycle diagrams imply some of these answers; a future-forward operating model must make them first-class artifacts and runtime decisions.

1.1 Seven scaling gaps

• Verification remains too monolithic: a single LLM judge or aggregate score is often asked to stand in for correctness, policy compliance, security, trajectory validity, and business outcome.
• Observability is not assurance: traces show what happened, but do not automatically determine whether the action was authorized, correct, sufficient, cost-effective, or safe to repeat.
• Compound versioning is incomplete: agents are combinations of models, prompts, skills, tools, routers, policies, data, memory, ontology, and runtime settings. Versioning only code or prompts leaves the real system unidentified.
• Self-improvement lacks a production constitution: trace mining and automated prompt repair are useful, but unbounded change, co-evolving graders, and skill accumulation can create silent regressions and Goodhart effects.
• Cost is separated from value: token budgets and model routing reduce spend, but they do not establish whether verification depth, latency, and human attention are economically justified by the value and risk of the action.
• Portfolio risk is under-modeled: one agent may be safe in isolation while many agents create correlated tool, data, vendor, ontology, or liquidity dependencies.
• Governance is still too episodic: committee reviews and one-time approvals cannot keep pace with changing models, protocols, threats, data, or user behavior. Controls must execute in the runtime and generate continuous evidence.

1.2 The evidence from production practice

The Kepler case study illustrates why enterprise agents need a context substrate rather than a model alone. OpenAI reportedly grounded its internal data agent in metadata, lineage, human annotations, code-level enrichment, runtime context, memory, evaluation, and permission enforcement; corrections were converted into reusable context rather than relearned in every session [4]. The same case study shows that semantic drift, tribal knowledge, and permissions beyond row-level data access are practical reliability problems, not abstract governance concerns. Separately, a production checklist for agent governance emphasizes runtime-enforced network, filesystem, tool, and audit controls rather than prompt-level promises [5]. These patterns point toward a broader conclusion: reliability emerges from the surrounding operating substrate, not from the base model in isolation.

The emerging agentic-economy literature adds a longer-horizon view. Decision traces can become episodic organizational memory; context graphs can represent dynamic enterprise state; learned ontologies can capture how work actually happens; and orchestration loops can turn outcomes into precedent and future policy [6]. These mechanisms are promising, but they also increase the need for evidence discipline. A living world model that cannot be versioned, challenged, rolled back, or priced is a source of systemic uncertainty. The V-ADLC is designed to make that intelligence infrastructure governable.

2. Core concepts and economic objective

2.1 Raw, verified, and monetized autonomy

The AGF distinguishes three economic states. Raw autonomy is what an agent can technically do. Verified autonomy is the subset that is attributable, authorized, policy-compliant, evidence-backed, and reversible or escalated where required. Monetized autonomy is verified autonomy linked to a P&L, contractual outcome, accepted productivity gain, or decision-quality improvement [1]. This paper preserves that progression and adds an operational unit beneath it: the verified agentic capability.

DEFINITION: VERIFIED AGENTIC CAPABILITY

A verified agentic capability is a versioned configuration of intent, workflow, model and routing policy, prompts and skills, tool contracts, authority, knowledge state, verifiers, runtime controls, cost budget, value hypothesis, owner, and rollback mechanism that holds a current release certificate for a defined environment and time window.

2.2 Assurance confidence is not model confidence

Model confidence is usually a local, weakly calibrated signal. Assurance confidence is an enterprise estimate that a material action satisfies the full set of requirements for its task class and risk tier. It is computed from evidence: deterministic assertions, policy proofs, grounded support, trajectory conformance, adversarial resistance, predicted risk, outcome reconciliation, and human or independent review. It must be calibrated on real outcomes, penalized for correlated verifiers, reduced when drift is high, and capped by any failed critical control. A fluent answer with high model confidence but failed authorization has zero release authority.

2.3 Residual agentic risk

Residual agentic risk is the expected loss that remains after preventive, detective, corrective, and recovery controls. It includes direct error, unauthorized action, data exposure, security compromise, regulatory harm, customer impact, financial loss, operational propagation, and the systemic effects of correlated agents. A practical model is:

Expected loss = sum over scenarios [ probability x impact x propagation factor ]

The propagation factor matters because agentic failures can compound across tool calls, handoffs, memory, and downstream systems. Controls that reduce blast radius or improve rollback can therefore create economic value even when they do not change the probability of the initial error.

2.4 Risk-adjusted verified value

The optimization target is not raw automation, accuracy, or cost. It is risk-adjusted verified value (RAVV):

RAVV = P(verified success) x business value – execution cost – verification cost – human attention cost – expected loss – latency penalty

This formulation forces trade-offs into the open. A more capable model may increase verified success but also increase cost and latency. A second verifier may be valuable for an irreversible payment but uneconomic for a reversible internal lookup. Human review may reduce loss on edge cases while destroying throughput if applied universally. The system should allocate intelligence, verification, and attention where their marginal value exceeds their marginal cost.

2.5 What this paper adds to the AGF

Table 1. Foundation retained and extensions introduced

Layer	Contribution
AGF foundation	Governance as productive infrastructure; raw to verified to monetized autonomy; agentic capital; seven governance layers; hub-and-spoke operating model.
Lifecycle extension	A seven-phase V-ADLC with execution, verification, improvement, and portfolio loops running continuously.
Assurance extension	A heterogeneous verification mesh, assurance confidence, evidence-bearing release certificates, runtime decision bands, and second-line risk aggregation.
Learning extension	A bounded self-improvement kernel with separation of duties, locked anchors, regression budgets, skill retirement, shadowing, canaries, and rollback.
Economic extension	RAVV, a live risk-value index, a value ledger, cost/value routing, loss reserves, and agentic capital renewal decisions.
Architecture extension	An eight-plane, protocol-portable reference architecture linking systems of record to world models and capital steering.

3. Design laws for a verified agentic enterprise

The operating model is governed by twelve design laws. They are deliberately stated as engineering constraints rather than aspirational principles.

Table 2. Non-negotiable design laws

Design law	Operating implication
1. Evidence before authority	An agent gains or retains authority only when the evidence required for its risk tier is current and sufficient.
2. Least agency	Grant the minimum action scope, duration, data access, tool set, and autonomy needed to create value.
3. No self-certification	The executor, proposer, verifier, and release controller must be separable; high-impact changes require independent challenge.
4. Deterministic boundary around the probabilistic core	Identity, permissions, network, filesystem, transaction limits, and irreversible commits are enforced outside the prompt.
5. Risk-tiered verification	Verification depth scales with consequence, irreversibility, uncertainty, novelty, and propagation potential.
6. Outcome-grounded learning	Proxies and judges are useful, but the learning loop should reconcile against systems of record and delayed business outcomes whenever possible.
7. Reversible by default	Shadow, simulate, stage, canary, checkpoint, and design compensating actions before broad autonomous execution.
8. Version the compound system	A material change to model, policy, tool, ontology, memory, router, verifier, or authority invalidates the prior release certificate.
9. Separate improvement from promotion	Agents may propose changes more freely than they may approve or deploy them.
10. Govern the semantic layer	Common semantics, graphs, embeddings, memories, and learned relationships are production artifacts with owners, versions, tests, and drift controls.
11. Optimize RAVV	Spend more when additional intelligence or assurance increases expected value; spend less when it does not.
12. Keep evidence portable	Use open telemetry, explicit contracts, and protocol-neutral artifacts so agents, verifiers, and controls can move across vendors.

4. The Verified Agent Development Lifecycle

The V-ADLC turns the lifecycle into a closed evidence-bearing control system. The seven phases are sequential for a specific release, but the portfolio runs them concurrently. Governance, telemetry, knowledge, and economics are continuous planes rather than separate checkpoints.

Table 3. V-ADLC phases, automation, and exit gates

Phase	Primary work	Automation opportunity	Exit gate
1. Frame & Authorize	Intent, value hypothesis, task boundary, non-delegable decisions, risk tier, authority source, owner, success and stop conditions.	Opportunity mining, process discovery, risk pre-classification, control recommendation.	Signed intent-and-authority record; positive expected RAVV; explicit owner and escalation path.
2. Build & Compose	Workflow graph, prompts, skills, models, tools, context contract, policy hooks, state, memory, and typed outputs.	Scaffolding, tool-schema generation, retrieval assembly, synthetic test generation, dependency mapping.	Reproducible compound build; externalized behavior artifacts; least-privilege tool contracts.
3. Verify & Simulate	Golden, synthetic, adversarial, trajectory, policy, security, cost, and multi-turn tests; realistic deployment simulation.	Test generation, evaluator execution, causal replay, attack simulation, coverage analysis.	Tier-specific assurance threshold met; critical controls pass; regression and risk budgets intact.
4. Promote & Release	Release certificate, canary scope, budgets, SLOs, runtime policies, rollback, compensating action, and expiry.	Manifest signing, policy decision, environment validation, automated rollout orchestration.	Valid evidence-bearing certificate; accountable release decision; kill switch and rollback proven.
5. Operate & Assure	Durable execution, runtime enforcement, full traces, online evals, predictive risk, anomaly detection, feedback, and outcome reconciliation.	Policy interception, dynamic routing, commit barriers, monitoring, alerting, risk/value banding.	Continued operation while evidence remains current; automatic restriction, escalation, or stop when not.
6. Improve & Re-evaluate	Failure and value-leakage mining, trace diagnosis, minimal change proposals, new evals, regression testing, shadowing.	Clustering, root-cause localization, patch generation, evaluator generation, impact prediction.	Net improvement on locked holdouts; no critical regression; reversible and attributable change.
7. Renew, Scale or Retire	Certificate renewal, broader scope, reuse, repricing, model or tool substitution, skill retirement, deprecation, archive.	Portfolio recommendation, capacity allocation, asset reuse discovery, drift-driven renewal.	Scale only when RAVV and assurance remain positive; retire when capital decays or a better asset exists.

4.1 The four continuous loops

• Execution loop – plan, act, observe: the runtime performs work, obtains tool results, updates state, and produces outcomes.
• Verification loop – specify, check, challenge, escalate: every material action is evaluated against hard constraints and calibrated evidence.
• Improvement loop – detect, diagnose, propose, prove, promote: production experience becomes controlled change rather than ad hoc prompt editing.
• Portfolio loop – allocate, route, budget, price, renew, retire: compute, verification capacity, human attention, risk budget, and capital are reallocated to the highest-RAVV capabilities.

The important shift is that the improvement and portfolio loops are no longer afterthoughts. In mature systems, they consume more attention than initial construction. The platform therefore automates the repetitive parts while preserving explicit human accountability for risk appetite, constitutional boundaries, and material exceptions.

4.2 The release is a state transition, not a deployment event

A release changes an agent from one authorized state to another: experimental to bounded, bounded to actuating, actuating to broader scope, or active to retired. Promotion requires evidence; restriction or rollback may occur automatically when evidence deteriorates. This state-machine framing makes the lifecycle compatible with continuous delivery without confusing speed with permission.

5. The verification mesh

Reliable verification cannot be delegated to a single general-purpose model. NIST’s 2026 work on evaluation probes emphasizes rubric-based, source-grounded evaluators and structured audit trails for reconstructing the evidence behind agent outputs [10][11]. Recent research on evaluator co-evolution shows that metrics themselves can be gamed and that anchor discipline plus outer audits are required when no reliable automatic verifier exists [26]. The verification mesh treats assurance as a portfolio of heterogeneous checks with different failure modes.

Table 4. Heterogeneous verifier classes

Verifier class	Examples	Strength and limitation	Decision role
Deterministic	Exact match, schema, invariants, identity, authorization, rate limits, data classification, transaction limits.	High precision for explicit assertions; low interpretive breadth.	Veto for critical failures.
Formal / solver	Temporal rules, preconditions, state constraints, segregation of duties, value-flow restrictions.	Stronger guarantees where policy can be formalized; specification effort required.	Veto or block.
Grounded semantic	Factual support, completeness, sufficiency, citation correctness, policy interpretation.	Covers nuanced language; requires calibration and authoritative sources.	Weighted evidence.
Trajectory	Plan quality, state transitions, tool sequence, handoffs, approvals, recovery behavior.	Detects successful-looking outputs reached through unsafe or wasteful paths.	Weighted evidence; critical path veto.
Adversarial	Prompt injection, tool misuse, data exfiltration, jailbreak, collusion, deceptive behavior, evaluator gaming.	Finds attack and distribution-shift failure modes; coverage is never complete.	Release gate and continuous probe.
Probabilistic / predictive	Likelihood of unsafe state, anomaly score, uncertainty, drift pressure, future risk.	Provides early warning and tunable intervention; statistical assumptions must be monitored.	Banding and escalation.
Outcome	Reconciliation to systems of record, delayed truth, customer outcome, financial result, incident data.	Most economically meaningful; may be delayed, sparse, or confounded.	Calibrates all other verifiers.
Human / independent	Expert review, second-line challenge, red team, audit, exception approval.	Handles novelty, values, liability, and ambiguous evidence; scarce and variable.	Required at significant checkpoints.

5.1 Assurance composition

Assurance is conjunctive before it is additive. Hard constraints – authority, prohibited action, critical safety invariant, mandatory approval, budget ceiling – have veto power. Only after those pass should the system aggregate softer evidence. A practical assurance confidence estimate should include:

• calibration of each verifier by task class and risk tier;
• coverage of the relevant requirement set;
• independence or correlation between verifiers;
• recency and drift of the data, model, tool, policy, and ontology;
• quality and representativeness of holdout and production samples;
• outcome reconciliation and known blind spots;
• uncertainty in the evaluator itself.

One implementation can compute a weighted evidence score and subtract correlation and drift penalties, while capping the result at the weakest critical control. The exact formula matters less than the discipline: assurance confidence is empirically calibrated, versioned, and auditable; it is not copied from a model’s self-reported confidence.

5.2 Decision bands

Table 5. Assurance decision bands

Band	Condition	System response
Green – execute	Hard controls pass; assurance confidence exceeds the tier threshold; residual risk is within appetite; RAVV is positive.	Proceed automatically within the certified scope.
Amber – add evidence	No hard failure, but uncertainty, novelty, drift, or value at stake warrants more evidence.	Use a stronger model, independent verifier, retrieval, simulation, shadow run, or narrower action scope.
Red – escalate	Residual risk or uncertainty exceeds automated authority, or evidence conflicts.	Pause and route to an accountable human or independent assurance function.
Black – block	Action is outside the constitution, lacks authority, violates a critical invariant, exceeds a hard budget, or has negative expected value.	Deny, contain, and create an incident or exception record.

5.3 Reliability of the verifiers

Every verifier is itself a governed component. Its rubric, prompt, model, source corpus, thresholds, and calibration set are versioned. Locked anchor examples are excluded from evaluator evolution. Outer audits test whether a verifier has become vacuous, overfit, collusive, or biased. Pairwise and multi-judge agreement can be informative, but correlated model families do not constitute independent evidence. For critical decisions, at least one verifier should arise from a different mechanism – deterministic, formal, outcome-based, or human – than the executor.

6. The evidence-bearing release certificate

An agent release is a compound object. Models, prompts, skills, retrieval, tools, policies, authority, memory, ontologies, and evaluators can change independently and alter behavior. The release certificate makes the compound version explicit and binds it to a defined environment, authority scope, and validity window. It is the operational equivalent of an airworthiness certificate for agentic work: evidence-based, revocable, and specific to a configuration.

Table 6. Canonical release-certificate contents

Bundle domain	Required release evidence
Intent and owner	Purpose, value hypothesis, accountable owner, value owner, risk owner, task and non-task boundaries, expiry.
Behavior artifacts	Workflow graph, prompts, skills, planner, supervisor, model versions, router policy, structured output contracts.
Authority	Agent identity, delegator, permission scope, credentials, tool contracts, rate and action limits, approval rules.
Knowledge state	Data products, retrieval sources, metadata, ontology or graph version, memory snapshot, semantic compatibility.
Verification	Datasets, simulations, adversarial suites, verifier versions, calibration results, coverage, open issues, residual risk.
Operations	Runtime image, environment, canary scope, SLOs, checkpointing, rollback, compensating actions, incident hooks, kill switch.
Economics	Budget, expected RAVV, cost ceilings, chargeback dimensions, reserve, value event mapping, termination criteria.
Provenance	Hashes, signatures, lineage, exceptions, approvals, policy decision, certificate ID, validity window, revocation history.

6.1 Material-change rules

Not every edit requires a full restart of the lifecycle, but every material change must re-enter at the phase where its evidence becomes invalid. A typo fix may return to Build and a narrow regression suite. A tool-scope change returns to Frame and Authorize as well as Verify. A new model requires capability, security, cost, and calibration tests. An ontology update may require replay against all dependent agents. A changed evaluator cannot validate itself; it requires independent calibration and outer audit. These rules allow fast iteration without pretending that all changes are equivalent.

6.2 Certificate status

• Valid: evidence is current and the capability may operate within scope.
• Conditional: operation is allowed under narrower scope, additional verification, or elevated monitoring.
• Suspended: operation pauses pending evidence refresh, incident review, or authority repair.
• Revoked: the version may not run; credentials and tool access are disabled.
• Expired: recertification is required because time, drift, or dependency changes have reduced confidence.

7. Runtime assurance and the live risk-value index

Pre-deployment evaluation cannot anticipate every production state. Runtime assurance therefore combines enforcement, prediction, observation, and outcome reconciliation. Prompt instructions remain useful for behavior shaping, but they are not the security boundary. The UK’s NCSC argues that current LLMs do not robustly separate data from instructions, so prompt injection should be mitigated through secure design and impact reduction rather than assumed solvable by better prompting alone [16]. Runtime controls must intercept actions before they cross consequential boundaries.

7.1 Runtime control surfaces

Table 7. Runtime control surfaces and evidence

Control surface	Runtime control	Evidence emitted
Model gateway	Provider allowlists, credential management, routing, PII and secret handling, budgets, rate limits, trace correlation.	Every invocation, policy decision, cost, and selected model.
Tool gateway / MCP	Approved server and tool catalog, typed contracts, scoped tokens, argument validation, transaction ceilings, approvals.	Tool identity, inputs, outputs, policy result, delegator, side-effect class.
Network	Proxy, allowlisted domains and IP ranges, egress policy, production-segment restrictions.	Destination, session, rule, decision, bytes, exception.
Filesystem / sandbox	Explicit mounts, read/write scope, blocked sensitive paths, isolated code execution, resource limits.	File lineage, reads/writes, process, sandbox ID, artifact hashes.
Memory and knowledge	Permission-aware retrieval, provenance, retention, contamination checks, semantic compatibility, memory write policy.	Sources, retrieval path, memory mutations, ontology version.
Inter-agent / A2A	Agent identity, capability discovery, delegation depth, trust domain, task contract, timeout and termination.	Sender, receiver, delegated authority, task state, handoff result.
Commit barrier	Pre-commit deterministic and formal checks, approval, idempotency, compensating action, two-phase commit for irreversible work.	Proposed action, proof/check result, approver, commit/abort record.
Outcome reconciler	System-of-record checks, delayed labels, financial and customer events, incident and rollback results.	Actual outcome, value, loss, latency, dispute, corrective action.

7.2 Predictive and adaptive runtime governance

Reactive rules block known violations. Predictive monitors estimate whether the current trajectory is likely to enter an unsafe state and intervene earlier. ProbGuard, for example, models agent behavior from traces and uses probabilistic reachability to trigger an intervention when predicted risk crosses a threshold [29]. The enterprise pattern is broader: combine deterministic policies with predictive risk, anomaly detection, drift pressure, and value-at-stake to choose among execute, add evidence, restrict, escalate, or block. Adaptive governance means the control response changes with state; it does not mean the constitution changes automatically.

7.3 The live index is a control surface, not a vanity score

The index aggregates residual risk, assurance confidence, realized or expected value, and drift pressure at agent, workflow, value-stream, business-unit, and enterprise levels. It should preserve concentration and uncertainty rather than hiding them inside a single average. A green portfolio average cannot offset a black-band constitutional violation. The operative decision is conjunctive: value must be positive, residual risk must remain within appetite, hard controls must pass, and assurance confidence must exceed the tier threshold.

7.4 Independent second-line challenge

For high-impact systems, a second-line agentic assurance function consumes the same traces and evidence as the first line but applies independent policies, evaluators, aggregation logic, and escalation rights. It does not operate the business workflow. It challenges risk classification, tests evidence sufficiency, monitors correlated exposures, reviews exceptions, and can narrow or suspend autonomy. Human risk owners remain accountable for appetite and material exceptions; the second-line system expands their coverage rather than replacing them.

8. Bounded self-improvement

A self-improving agentic enterprise is not one in which agents rewrite themselves without constraint. It is one in which production experience is converted into proposed, tested, reversible changes faster than manual teams could accomplish alone. The improvement target is usually the harness – prompts, skills, workflow graph, retrieval, router, tool descriptions, middleware, policies, and context – rather than unconstrained modification of model weights.

Recent research provides useful building blocks. Self-Harness uses weakness mining, minimal harness proposals, and regression validation [22]. GRASP admits skill edits only when they improve a balanced held-out probe under a hard regression budget [23]. HarnessFix localizes failure evidence to responsible trajectory steps and harness layers before applying scoped repairs [24]. Library Drift and Ratchet show that unbounded skill accumulation can reduce performance and that outcome-driven retirement plus a bounded active library are structural controls [25]. Who Grades the Grader demonstrates that evaluator evolution requires locked anchors and independent outer audits [26]. These results support automation, but also reject naive self-modification.

8.1 Improvement flow

1. Detect: online evaluations, user corrections, incidents, drift, cost anomalies, and value shortfalls create candidate issues.
2. Cluster: recurring failures and value leakage are grouped by task, state, agent version, tool, ontology region, and user context.
3. Diagnose: trace evidence is attributed to the responsible layer – intent, context, model, workflow, tool, policy, verifier, runtime, or outcome measurement.
4. Propose: an improvement agent generates the smallest change likely to fix the diagnosed class, with an expected effect and rollback plan.
5. Prove: locked holdouts, regression suites, adversarial tests, policy checks, cost tests, and evaluator audits determine whether the proposal is admissible.
6. Shadow: the candidate replays representative production traffic without real side effects.
7. Canary: bounded live traffic runs with tighter limits, rapid rollback, and independent monitoring.
8. Promote or roll back: the release controller changes state based on evidence; the proposer never approves its own patch.

8.2 Change classes and authority

Table 8. Self-improvement change classes

Change class	Examples	Promotion authority	Recovery
A – low-impact content	Descriptions, examples, retrieval ranking, formatting, non-authoritative metadata.	Automated proposal and promotion after deterministic and regression checks.	Automatic rollback.
B – behavior shaping	Prompts, skills, workflow branches, routing thresholds, memory policies within existing authority.	Automated proposal; independent verifier; canary; named owner notified.	Automatic rollback and certificate amendment.
C – consequential capability	Model substitution, new tools, changed side effects, expanded data or permission scope, new external agent, ontology action schema.	Human product owner plus security/risk approval; full recertification.	Pre-proven compensating action; credentials revoked on failure.
M – meta / constitutional	Risk appetite, non-delegable decisions, evaluator anchors, release controller, identity root, reserve policy, self-improvement kernel.	Never self-approved. Independent assurance and executive or committee decision.	Manual recovery, forensic review, and controlled redeployment.

8.3 Admission criteria for an automated improvement

• Net RAVV is positive on the intended distribution and not merely on the failure cluster that motivated the change.
• No critical safety, policy, security, fairness, or authority regression occurs.
• Performance loss on previously correct cases remains inside a predeclared hard regression budget.
• Holdout, anchor, and audit sets were inaccessible to the proposer and any co-evolving evaluator.
• The change is localized, attributable, reversible, and linked to a specific diagnosis.
• Cost and latency remain within the approved envelope, or the additional cost is justified by value or risk reduction.
• Ontology, memory, and downstream compatibility tests pass.
• The proposed evaluator or metric has an independent validity test and cannot promote itself.

8.4 Learning asset lifecycle

Skills, memories, examples, and learned relationships are capital assets with lifecycle costs. The platform should maintain an evidence log for each asset: provenance, applicability, successful and failed uses, marginal contribution, conflicts, drift, and retirement status. A bounded active set prevents context bloat and retrieval interference. Assets that no longer create value are retired, not preserved indefinitely because they once helped.

9. Cost/value steering and the value ledger

FinOps for AI brings necessary visibility into tokens, models, GPU allocation, quotas, tags, and volatile usage [33]. Agentic systems require an additional step: cost must be joined to verified outcomes and risk. The cheapest run can be the most expensive decision if it fails, loops, escalates, or requires rework. Conversely, a frontier model or additional verifier can be economical when it prevents a material loss or unlocks a high-value autonomous action.

9.1 The full cost stack

• Model cost: input, cached input, output, reasoning, fine-tuning, and provisioned capacity.
• Tool and data cost: APIs, search, databases, data products, vector stores, graph queries, and external agent calls.
• Orchestration cost: decomposition, supervision, retries, loops, parallel agents, and long-running state.
• Execution-environment cost: sandbox, browser, compute, storage, network, and durable runtime.
• Verification cost: deterministic checks, solver time, graders, simulations, red-team probes, outcome reconciliation, and evidence storage.
• Human-attention cost: approvals, clarifications, exception handling, annotation, incident response, and second-line challenge.
• Failure cost: rework, rollback, customer remediation, disputes, downtime, regulatory response, and expected-loss reserve.
• Opportunity and latency cost: delayed decisions, blocked throughput, or value lost while gathering more evidence.

9.2 The value ledger

Table 9. Minimum value-ledger fields

Ledger field	Purpose
Action / outcome ID	Join the agent trace to a business event or system-of-record outcome.
Value type	Revenue, margin, capacity, cost avoidance, loss prevention, conversion, decision quality, compliance, or option value.
Counterfactual baseline	What would likely have happened without the agent or without the additional verification.
Attribution	Agent, workflow, feature, tenant, value stream, and human contribution.
Confidence and delay	Uncertainty, outcome maturity, causal confidence, and reconciliation date.
All-in cost	Execution, verification, human attention, latency, incidents, reserve, and shared platform allocation.
RAVV and realization	Expected versus realized RAVV; variance and reason codes.
Capital effect	Reusable asset created, depreciation, renewal need, retirement, or reuse credit.

9.3 Dynamic routing policy

The router chooses not only a model, but an execution strategy: tools, number and diversity of agents, verification depth, human checkpoint, context budget, and stopping rule. Topaz demonstrates explainable routing based on task requirements, model capability, and cost [30]. Bayesian orchestration frames additional model or tool calls as information purchases that are warranted only when expected value of information exceeds cost [31]. Compression and latency-aware research shows further opportunity to reduce unnecessary computation while preserving task success [32].

A practical policy is: use the least expensive configuration that is expected to meet the verified quality bar for the risk tier. Escalate only when uncertainty, disagreement, novelty, or value at stake justifies it. Stop gathering evidence when the expected benefit of another verifier is below its cost or when a hard constraint already determines the outcome. The policy itself is evaluated and versioned because cost-optimization can create hidden quality regressions.

9.4 Portfolio allocation

At portfolio level, the Agentic Portfolio Controller allocates four scarce resources: compute, verification capacity, human attention, and risk budget. It favors capabilities with high RAVV, strong reuse, low concentration, and improving evidence. It may reduce autonomy where costs rise faster than value, reserve human review for cases with the highest value of judgment, and retire assets whose drift or maintenance burden exceeds replacement value. This is how agentic capital becomes managed capital rather than a collection of projects.

10. The Verified Agentic Operating Model

The organizational pattern retains the three-ring model because it balances central consistency with domain speed and broad participation [3]. The extension is the explicit addition of verification, independent assurance, and economic steering. These are functions and decision rights, not necessarily three large standalone departments.

Table 10. Core roles and decision rights

Role	Primary responsibility	Decisions owned
Executive risk / business sponsor	Sets risk appetite, non-delegable decisions, strategic outcomes, and exception authority.	Constitution, autonomy envelope, material exceptions, portfolio stop decisions.
Ring 1 – Platform & Control Plane	Builds and operates identity, gateways, runtime, telemetry, evaluator infrastructure, policy engines, registries, evidence store, and reference patterns.	Platform standards, control implementation, shared services, minimum release bar.
Ring 2 – Domain Agent Product Team	Owns the agentic product, value-stream outcome, workflow design, domain tests, operating SLOs, and first-line risk.	Build, risk classification request, release proposal, incident remediation, value realization.
Ring 3 – SMEs, Operators & Users	Defines what good looks like, contributes ground truth, operates agents, reports exceptions, and increasingly builds low-risk agents on paved paths.	Domain criteria, feedback, annotations, approval at assigned checkpoints.
Verification Operations	Industrializes datasets, simulations, evaluator calibration, trace review, release evidence, online evals, and incident learning.	Evaluation methods, evidence sufficiency recommendation, dataset and verifier lifecycle.
Agentic Assurance / Second Line	Independently challenges risk tier, evidence, policy compliance, concentration, and exceptions; aggregates portfolio risk.	Independent thresholds, challenge, escalation, restriction, exception concurrence.
Agentic Portfolio Controller / Finance	Maintains value ledger, budgets, chargebacks, reserves, RAVV, capital turnover, depreciation, and retirement economics.	Portfolio allocation, economic hurdle rates, reserve logic, renewal and retirement recommendation.
Ontology and Knowledge Steward	Owns common semantics, graph and ontology versions, knowledge quality, compatibility, and drift response.	Semantic changes, dependency impact, knowledge release and rollback.
Security and Red Team	Threat-models agentic systems, tests tool and protocol attack surfaces, validates isolation and incident response.	Security baseline, attack suites, remediation acceptance, emergency containment.
Internal Audit / External Assurance	Tests the management system, evidence lineage, control operation, second-line independence, and management representations.	Audit opinion, findings, assurance scope, remediation tracking.

10.1 Operating cadences

• Per action, automated: authority, policy, verification, routing, cost, trace, and band decision.
• Per release, automated with accountable sign-off: evidence certificate, canary, rollback, and budget.
• Daily or weekly: incident clusters, drift, evaluator health, cost anomalies, value leakage, and proposed improvements.
• Monthly: portfolio RAVV, concentration, reserve, reusable assets, depreciation, and autonomy changes.
• Quarterly: risk appetite, constitutional rules, second-line effectiveness, ontology health, and strategic capital allocation.
• Event-driven: critical incident, model or protocol change, regulatory change, security disclosure, or material ontology drift.

10.2 Governance as an enabling hub

The model avoids two extremes: a central committee that becomes a delivery bottleneck and uncontrolled decentralization that creates sprawl. Ring 1 encodes the minimum bar into reusable platform capabilities. Rings 2 and 3 deliver within those constraints. Verification Operations makes evidence cheap enough to produce continuously. Second-line assurance focuses scarce challenge on material uncertainty and correlated risk. The portfolio controller makes value and cost visible. Governance accelerates delivery because teams inherit controls and evidence rather than reconstructing them for every agent.

10.3 The innovation swimlane

Innovation is a separate swimlane, not a fourth ring. Researchers and teams can test new models, protocols, tools, world-model techniques, or improvement methods in isolated environments with synthetic or masked data. Promotion into production requires the same evidence gates as any other capability. This preserves exploration while preventing experimental shortcuts from becoming implicit production standards.

11. Eight-plane reference architecture

The reference architecture separates concerns so that models and frameworks can change without rebuilding the governance and evidence substrate. It is vendor-neutral: individual components may be implemented by cloud platforms, agent frameworks, open-source services, or internal systems, but their contracts and evidence must remain explicit.

Table 11. Eight architecture planes

Plane	Primary capabilities	Evidence and control purpose
1. Enterprise Integration & Event	Systems of record, APIs, data products, event streams, identity providers, business events, outcome sources.	Ground truth, business state, authority source, value realization.
2. Semantic Operating Layer	Common semantic model, metadata, lineage, prescribed and learned ontology, policy-aware graph, entity resolution.	Meaning, relationship, permission, compatibility, and semantic drift evidence.
3. Context, Decision Memory & Provenance	Trace store, episodic memory, precedent, feedback, annotations, decision lineage, outcome reconciliation.	Why an action occurred, what informed it, and what happened later.
4. Workflow Compiler & Contract	Intent-to-workflow, typed tools, state machine, approval logic, action contracts, release manifest.	Executable specification, preconditions, postconditions, and dependency graph.
5. Agentic Execution & Runtime	Agent frameworks, durable orchestration, sandboxes, human interrupts, checkpointing, recovery, commit barriers.	Actual trajectory, tool actions, state, latency, resource use, and recovery.
6. Governance, Verification & Evidence	Policy engine, verifier mesh, risk index, evidence graph, audit, incident, rollback, certificate service.	Authorization and assurance decisions with full provenance.
7. Learning, Simulation & World Model	Failure mining, diagnosis, proposal agents, synthetic environments, counterfactual replay, deployment simulation, causal models.	Evidence for improvement and predicted effect before live promotion.
8. Value & Agentic Capital	RAVV engine, value ledger, budgets, chargeback, reserves, pricing, reuse, depreciation, renewal, retirement.	Economic accountability and portfolio allocation.

11.1 Cross-cutting rails

• Identity: every agent, tool, delegator, verifier, and release controller has a distinct identity and attributable authority.
• Security: least privilege, network and filesystem boundaries, secrets management, isolation, content security, and incident response span all planes.
• Telemetry: traces, metrics, logs, events, model and tool spans, policy decisions, costs, and business outcomes share a correlation model.
• Policy: constitutional rules, domain policy, tool contracts, release rules, and runtime conditions are represented as executable controls where possible.
• FinOps and value: cost allocation and value attribution are present from design through retirement, not added after scale.
• Interoperability: tools and agents communicate through versioned, authenticated contracts; evidence is portable across vendors and runtimes.

11.2 Protocol portability and open evidence

OpenTelemetry’s generative-AI conventions standardize recording of model operations, tokens, and – when enabled – prompts, completions, tool calls, and tool results [17]. MCP provides a standard interface between model applications and tools or context; its July 2026 specification added a stateless core, authorization hardening, routing, and an extensions framework [18]. A2A provides a common interaction model for independent agents and reached a 1.0 specification in 2026 [19]. These protocols do not solve governance by themselves, but they create stable interception and evidence points. The operating model should preserve semantic and policy contracts above protocol syntax so that a protocol upgrade does not silently change authority.

11.3 Evidence graph

The evidence store should behave as a graph rather than a folder of reports. A release certificate links to the exact workflow, model, prompts, tools, policies, datasets, verifier results, approvals, runtime traces, incidents, outcomes, costs, and value events. A failure can be traversed backward to the responsible version and forward to affected assets. An ontology change can reveal every dependent agent and certificate. This graph is the backbone for automated audit, impact analysis, and capital renewal.

12. Semantic operating layer, memory, ontology, and world models

12.1 Context is a governed production dependency

Kepler’s reported six-layer context model demonstrates a production pattern: structural metadata and lineage; human annotations; code-derived enrichment; business context from collaboration systems; live runtime context; and memory, all combined with evaluation and permission enforcement [4]. The lesson is not that every enterprise should reproduce the same stack. It is that agents need governed meaning, provenance, and correction memory across systems. A table name or vector search result is not sufficient context for consequential action.

12.2 Common semantic layer

The common semantic layer defines enterprise objects, relationships, metrics, policies, and action semantics consistently across humans, agents, data products, and controls. It includes both prescribed semantics – approved definitions and constraints – and learned semantics – patterns inferred from decision traces and outcomes. The prescribed layer provides stability and compliance. The learned layer captures tacit practices, emerging exceptions, and real operational structure. Learned relationships are candidates, not truth, until validated and promoted.

12.3 Decision traces as episodic memory

A normal activity log records that an action occurred. A decision trace records the context, authority, options, evidence, policy, tool sequence, verifier results, outcome, and corrections associated with the action. This makes traces usable as episodic organizational memory and as training data for future evaluation and improvement [6]. Memory writes are governed: provenance, scope, privacy, retention, confidence, and applicability are explicit. User corrections become proposed memories or rules that require confirmation and lifecycle management rather than being appended uncritically.

12.4 Ontology drift management

Ontology drift occurs when the enterprise’s representation of reality diverges from current language, relationships, processes, policies, or outcomes. It can be caused by new products, reorganizations, data changes, model-generated concepts, hidden workflow evolution, or user behavior. The platform should detect drift through schema changes, embedding movement, query failures, changed decision clusters, policy conflicts, outcome variance, and human corrections. Every proposed ontology change receives impact analysis, compatibility tests, dependent-agent replay, steward approval, versioning, and rollback. Drift cycle time is a board-relevant learning metric because stale semantics undermine every downstream verifier and agent.

12.5 World models and simulation

A long-term direction is an organizational world model: a queryable, simulatable, governable representation of how work actually happens, built from state, decisions, causal hypotheses, policies, and outcomes [6]. OpenAI’s Deployment Simulation shows the value of replaying realistic contexts against candidate models before release and reports that it improved estimates of deployment behavior for studied model rollouts [20]. The enterprise extension is to replay candidate agent versions through historical and synthetic organizational states, test counterfactual policies, and estimate downstream effects before committing real actions.

Simulation is not proof. It is another verifier whose representativeness, causal assumptions, and tail coverage must be measured. World models should be versioned, challenged, and prevented from changing production policy directly. Their strongest use is to generate evidence, identify blind spots, and prioritize controlled experiments.

13. Risk tiers, change classes, and control scaling

The AGF classifies agents into bounded, actuating, and autonomous/high-stakes tiers, with additive controls [1]. The V-ADLC retains that structure and adds a Tier 0 for assistive experiments plus a separate meta-change class for systems that alter the control substrate. Risk classification occurs during Frame and Authorize and is re-evaluated whenever authority, tools, data, model capability, external connectivity, autonomy duration, or reversibility changes.

Table 12. Risk tiers and additive controls

Tier / class	Typical scope	Minimum additive controls
Tier 0 – Assistive / experimental	Drafting, analysis, recommendations, sandboxed prototypes; no unreviewed external action.	Identity, logging, data controls, baseline evals, human acceptance of outputs.
Tier 1 – Bounded informational	Retrieval, summarization, classification, knowledge Q&A, content for review.	Tier 0 plus permission-aware retrieval, grounded evaluation, source provenance, output filtering, release certificate.
Tier 2 – Actuating / reversible	Communications, system updates, workflow actions, bounded transactions with compensating action.	Tier 1 plus scoped tools, runtime policy, HITL at significant checkpoints, canary, rollback, outcome reconciliation, online evals.
Tier 3 – Autonomous / high-stakes	Long-horizon work; financial, legal, medical, safety, customer, or regulated actions; agent-to-agent coordination.	Tier 2 plus independent assurance, red-team simulation, predictive monitoring, stricter assurance threshold, named executive owner, reserve, enhanced audit and incident response.
Meta-change class M	Changes to constitution, identity root, evaluator anchors, release controller, risk appetite, reserve policy, or self-improvement kernel.	Never self-approved; isolated testing, outer audit, executive or committee authorization, full recertification and recovery plan.

13.1 Risk amplifiers

• Irreversibility or weak compensating actions;
• high value at stake or asymmetric loss;
• sensitive data, privileged infrastructure, or production write access;
• long autonomy horizon, high delegation depth, or open-ended goals;
• multi-agent coordination and correlated dependencies;
• external network, protocol, vendor, or counterparty exposure;
• novel or drifting context with weak ground truth;
• self-modification or changes to evaluators, policies, identity, ontology, or memory governance.

Risk tier is not a permanent label. A Tier 1 research agent can become Tier 2 when it gains a write-capable tool. A reversible Tier 2 workflow can become Tier 3 when deployed across millions of customers or linked to regulated decisions. The certificate service should recalculate tier and evidence requirements from the actual authority graph, not rely on a static registry description.

14. Metrics and management dashboards

Traditional software metrics remain necessary but insufficient. Uptime, latency, error rate, and infrastructure cost do not reveal whether an agent selected the correct tool, complied with authority, used valid context, followed the required approval path, or created business value. The dashboard must track stock, flow, assurance, risk, economics, learning, and human attention.

Table 13. Core management metrics

Family	Metric	Definition / use
Stock	Production capability inventory	Certified agents and reusable workflows by owner, tier, environment, and certificate status.
Stock	Reusable asset ratio	Share of tools, contracts, skills, evals, and ontology assets reused across domains.
Flow	Autonomous action volume and mix	Actions by tier, band, workflow, customer, and value stream; human versus automated resolution.
Assurance	Verified autonomy ratio	Material autonomous actions that passed required controls and outcome reconciliation divided by total material autonomous actions.
Assurance	Assurance confidence / calibration error	Predicted assurance compared with actual outcomes by tier and verifier.
Assurance	Trace and evidence completeness	Material actions with reconstructable lineage, policy decision, cost, and outcome.
Risk	Residual risk and concentration	Expected loss, correlated dependencies, top exposures, and risk-budget utilization.
Risk	Policy adherence and prevented actions	Pass rate, blocked actions, exception rate, false blocks, and near misses.
Risk	Rollback and containment success	Failed or suspicious actions reversed or contained within target time.
Economics	RAVV and value realization variance	Expected and realized risk-adjusted verified value; attribution and variance reasons.
Economics	Cost per verified action	All-in execution, verification, human, latency, and incident cost per successful verified outcome.
Economics	Governance yield	Change in verified gross margin or loss avoided divided by incremental governance spend.
Economics	Agentic capital turnover	Verified value created divided by net investment in agentic capital.
Learning	Failure-to-fix cycle time	Time from material failure detection to verified production improvement.
Learning	Regression escape rate	Regressions that passed release gates and reached production.
Learning	Ontology drift cycle time	Time from semantic mismatch detection to governed update and dependent-agent renewal.
Human	Escalation precision and attention yield	Share of escalations that truly required judgment; value or loss reduction per review hour.
Human	Automation bias and override quality	Patterns of rubber-stamping, unnecessary overrides, and reviewer disagreement.

14.1 Board dashboard

The board view should be compact and economic: certified agentic capital stock; verified autonomy ratio; top residual-risk concentrations; RAVV; governance yield; capital turnover; major incidents and rollbacks; certificate exceptions; ontology drift; and the autonomy decisions requested for the next period. It should distinguish realized value from modeled value and expose uncertainty. A high number of agents is not a success metric.

14.2 Operational dashboard

The operating dashboard is trace-driven and near real time. It shows action bands, evaluator disagreement, drift, policy violations, tool failures, cost spikes, loops, human queue load, incident clusters, and candidate improvements. Each chart links to the evidence graph so operators can move from aggregate signal to the exact decision trajectory and release certificate.

15. Maturity journey and implementation roadmap

Maturity is measured by the quality and automation of the evidence-to-action loop, not by model sophistication or agent count. Each level expands autonomy only after the operating substrate can absorb the additional blast radius.

Table 14. Maturity levels and gates

Level	Characteristic state	Gate
1. Instrumented pilots	Named owners, traces, baseline datasets, explicit permissions, sandboxed execution, rough value hypothesis.	Every material pilot is discoverable and reconstructable.
2. Governed release	Shared V-ADLC, risk tiers, evidence bundles, gateways, canaries, rollback, cost tags, first online evals.	No production agent without a certificate and runtime control points.
3. Continuous assurance	Verification mesh, calibrated evaluators, predictive monitoring, second-line challenge, outcome reconciliation, value ledger.	Assurance and RAVV are managed continuously, not at release only.
4. Bounded self-improvement	Automated failure mining, diagnosis, gated proposals, shadowing, canaries, skill retirement, evaluator audits.	Verified improvements ship in days while regression and meta-change controls remain intact.
5. Portfolio-optimized autonomy	Live risk/value aggregation, dynamic allocation, agentic capital turnover, depreciation, automated renewal and retirement, trust-premium evidence.	Autonomy is expanded, priced, reserved, and renewed as a managed capital stock.

15.1 A 24-month implementation path

Table 15. Implementation roadmap

Horizon	Primary work	Exit outcome
0-30 days – constitution and inventory	Define risk appetite, non-delegable decisions, tier model, ownership, agent inventory, common trace ID, and top value streams.	Constitution v1; inventory; minimum event schema; 2-3 evidence-ready use cases.
30-90 days – minimum viable verified lifecycle	Implement model/tool gateways, runtime identity, scoped tools, baseline datasets, release manifest, canary/rollback, cost tags, and certificate service.	First certified Tier 1-2 agents; release checklist automated; trace-to-cost linkage.
3-6 months – continuous assurance	Add online evals, verifier calibration, adversarial probes, outcome reconciliation, live bands, second-line dashboard, and ontology stewardship.	Verification mesh for priority domains; risk aggregation; value ledger pilots.
6-12 months – bounded improvement	Deploy failure clustering, diagnosis, proposal generation, locked holdouts, shadow replay, canary automation, skill library hygiene, and evaluator audits.	Automated change classes A-B; measurable failure-to-fix reduction; regression budget enforced.
12-18 months – world-model and portfolio layer	Build context graph, decision memory, drift detection, deployment simulation, RAVV routing, chargeback, reserve and depreciation logic.	Cross-domain evidence graph; portfolio steering; certificate renewal automation.
18-24 months – scaled verified autonomy	Expand Tier 2-3 use cases, automate renewal/retirement recommendations, expose trust evidence to customers and auditors, optimize capital turnover.	Portfolio-managed agentic capital; governance yield and trust-premium business cases.

15.2 The first 90 days: minimum viable foundation

• Choose two or three value streams with measurable outcomes and bounded, reversible actions.
• Create the autonomy constitution, risk tiers, change classes, and named decision owners.
• Instrument every run with agent, version, user, authority, tool, policy, cost, and outcome correlation identifiers.
• Externalize prompts, skills, tool schemas, policies, and context into versioned artifacts.
• Build a small golden dataset plus adversarial and trajectory examples before production.
• Route all model and tool calls through enforceable gateways; deny unapproved network, filesystem, and MCP access by default.
• Issue the first release certificates with canary, rollback, budget, and expiry.
• Measure verified action rate, cost per verified action, value realization, and failure-to-fix time.

16. Standards and regulatory alignment

The V-ADLC is not a substitute for legal analysis or certification. It is an operating architecture that makes evidence easier to produce for the management systems, risk frameworks, security guidance, and regulations enterprises must address. As of August 2026, the EU AI Act is broadly applicable and enforcement powers began on 2 August 2026, while the high-risk timelines were extended for specified categories under the AI Omnibus [14]. The architecture therefore emphasizes traceability, human oversight, lifecycle controls, quality management, and evidence portability.

Table 16. Standards and regulatory crosswalk

Anchor	Primary expectation	V-ADLC alignment
NIST AI RMF and GenAI Profile	Govern, Map, Measure, Manage; lifecycle risk and generative-AI risk categories.	Constitution, risk tier, verification mesh, runtime assurance, incident and improvement loops [7][8].
NIST AI Agent Standards Initiative	Trusted, interoperable, secure agents; open protocols; identity and security evaluation.	Runtime identity, tool and agent contracts, open evidence, protocol portability, independent testing [9][34].
NIST evaluation probes / TEVV	Source-grounded probes, structured audit trails, reproducible evaluation.	Grounded semantic verifiers, evidence graph, calibration, trace reconstruction [10][11].
IMDA Agentic AI governance	Upfront risk assessment, reversibility, meaningful human accountability, testing, gradual rollout, monitoring.	Frame/Authorize, risk tiers, significant checkpoints, canary, runtime bands, periodic review [12].
ISO/IEC 42001	Establish, implement, maintain, and continually improve an AI management system.	Operating model roles, documented lifecycle, performance evaluation, corrective action, continual improvement [13].
EU AI Act	Risk classification, quality management, data governance, technical documentation, logging, human oversight, transparency.	Certificate, trace/evidence completeness, authority, human checkpoints, management-system integration [14].
OWASP Agentic Top 10	Threats across planning, memory, tools, identity, multi-agent coordination, and autonomous action.	Adversarial verifier, tool gateway, sandbox, identity, memory controls, security red team [15].
UK NCSC prompt-injection guidance	No robust instruction/data boundary; focus on secure design and limiting impact.	Deterministic boundary, least privilege, egress controls, commit barriers, isolation [16].
OpenTelemetry GenAI conventions	Standardized traces, metrics, model and tool operations.	Portable evidence and end-to-end correlation [17].
MCP and A2A	Open contracts for tools/context and inter-agent communication.	Governed protocol gateways, capability catalogs, typed delegation, traceable handoffs [18][19].

16.1 Evidence once, use many times

A central objective is to generate evidence as a by-product of operating the system, then reuse it for product management, risk, security, compliance, internal audit, external assurance, customer trust, and finance. The same trace should support debugging, policy review, cost attribution, value realization, and incident reconstruction. This reduces duplicate control work and improves consistency. It also makes gaps visible: if a required claim cannot be supported from the evidence graph, the system is not yet evidence-ready.

17. Research agenda and limitations

17.1 Research agenda

Table 17. Priority research agenda

Research problem	Core question
Assurance composition under dependence	How should evidence from correlated models, judges, data sources, and tools be combined without overstating confidence?
Evaluator governance and Goodhart resistance	How can evaluators evolve while preserving locked anchors, independence, interpretability, fairness, and outer audit?
Outcome latency and causal attribution	How should learning and value steering operate when ground truth arrives months later or is confounded by human and market actions?
Predictive runtime governance	How can probabilistic monitors remain calibrated under distribution shift and intervene without excessive false blocks?
Ontology and world-model validity	How should learned concepts, causal relationships, embeddings, and simulations be verified, explained, and rolled back?
Multi-agent systemic risk	How should enterprises measure concentration, contagion, collusion, recursive delegation, and correlated vendor or protocol failures?
Human attention allocation	Which cases create the greatest value of judgment, and how can escalation avoid both automation bias and review overload?
Accounting and insurance of agentic capital	How should formation cost, depreciation, reserves, contingent liability, trust premium, and capital turnover be recognized?
Privacy-preserving organizational memory	How can decision traces support learning and audit while minimizing exposure, retention, and cross-context leakage?
Limits of bounded self-improvement	Which change classes can be safely automated, and what evidence is sufficient for promotion in high-stakes domains?

17.2 Limitations and cautions

• No verification mesh guarantees absolute correctness. It improves evidence quality and control, but residual risk remains.
• Formal methods provide strong assurance only for properties that can be specified and observed. Many business, ethical, and semantic requirements remain partially formalizable.
• LLM judges are fallible, correlated, and vulnerable to prompt and distribution effects. They should not be the sole authority for consequential actions.
• Simulation improves coverage but cannot fully represent rare, adversarial, or structurally novel deployment states.
• Outcome-based learning can reinforce historical bias or local optimization unless outcomes, values, and counterfactuals are carefully defined.
• RAVV and value ledgers can be gamed if teams control their own baselines or omit externalities. Finance and independent assurance must challenge attribution.
• Automated improvement can accelerate both repair and error propagation. Separation of duties, bounded change classes, rollback, and meta-governance are essential.
• The operating model requires organizational change. Technology cannot compensate for unclear ownership, weak incentives, poor domain participation, or absent risk appetite.

18. Conclusion

The agentic enterprise will not be distinguished merely by how many agents it deploys or how capable its models are. It will be distinguished by how quickly it can convert experience into independently verified improvement, how precisely it can allocate authority and attention, how accurately it can connect autonomous action to value and loss, and how well it can renew or retire its agentic capital as reality changes.

The V-ADLC makes that operating logic explicit. Frame and Authorize prevents technical possibility from becoming accidental permission. Build and Compose externalizes behavior and contracts. Verify and Simulate produces heterogeneous evidence. Promote and Release binds the compound version into a certificate. Operate and Assure enforces policy and measures real behavior. Improve and Re-evaluate turns traces into bounded, regression-aware changes. Renew, Scale, or Retire makes learning and economics part of lifecycle completion rather than an afterthought.

The Verified Agentic Operating Model aligns the people and decision rights around that lifecycle. Platform and control-plane teams create the substrate; domain teams own outcomes and first-line risk; SMEs define ground truth and participate in building; Verification Operations industrializes evidence; independent Agentic Assurance challenges and aggregates risk; and the Agentic Portfolio Controller steers cost, value, reserves, and capital renewal. The eight-plane architecture makes those commitments executable and portable.

FINAL THESIS

The next competitive frontier is not maximum autonomy. It is the fastest safe expansion of risk-adjusted verified autonomy. Enterprises that automate execution without automating verification, improvement, and value steering will accumulate fragile agents. Enterprises that close all four loops will compound trustworthy agentic capital.

Appendix A. Evidence-ready release gate checklist

Table A1. Release gate checklist

Domain	Control question
Frame & authorize	Named business, value, risk, and escalation owners are assigned.
Frame & authorize	The task boundary, non-delegable decisions, autonomy tier, change class, and expiry are explicit.
Frame & authorize	Expected RAVV is positive and the value event can be measured.
Build	Prompts, skills, policies, workflow, model, router, tools, context, and memory are externalized and versioned.
Build	Every tool has a typed contract, scoped credential, allowed action set, rate limit, validation, and safe-failure behavior.
Build	Network, filesystem, model, data, and inter-agent access are denied by default outside approved scope.
Verify	Golden, synthetic, adversarial, trajectory, policy, cost, and multi-turn datasets are present for the risk tier.
Verify	At least one independent or non-LLM verifier covers every critical requirement.
Verify	Evaluator calibration, coverage, drift, correlation, and known blind spots are documented.
Verify	Locked holdouts and anchor sets are isolated from builders, proposers, and evolving evaluators.
Verify	Deployment simulation or representative replay covers realistic states and high-value failure modes.
Release	The compound manifest, evidence summary, policy decision, approvals, budget, SLOs, canary, rollback, and expiry are signed.
Release	Credentials, policy engines, traces, alerts, kill switches, checkpoints, and compensating actions work in the target environment.
Operate	Every material action emits identity, authority, context, model, tool, policy, verifier, cost, and outcome correlation evidence.
Operate	Hard controls can block before commitment; predictive monitors can restrict or escalate before an unsafe state.
Operate	Outcome reconciliation, incident taxonomy, user feedback, and second-line aggregation are connected.
Improve	Failure clustering and diagnosis identify the responsible layer before a change is proposed.
Improve	The proposer cannot approve, verify, or release its own material change.
Improve	Regression budget, cost envelope, shadow, canary, rollback, and asset-retirement rules are enforced.
Economics	Cost per verified action, RAVV, value realization variance, human attention, reserve, and capital turnover are visible.
Renew / retire	Certificate renewal, drift review, dependency impact, reusable asset status, and retirement criteria are scheduled.

Appendix B. Canonical agentic event and evidence schema

Table B1. Canonical event schema

Domain	Minimum fields
Identity	run_id, trace_id, session_id, agent_id, agent_version, workflow_version, tenant, user, delegator, owner.
Authority	risk_tier, action_scope, credential_id, tool_contract_version, approval_requirement, exception_id.
Context	input_hash, data_product_version, retrieval_sources, ontology_version, memory_snapshot, policy_version.
Execution	plan_id, state_transition, model_id, router_policy, tool_call, arguments_hash, tool_result_hash, handoff, sandbox.
Verification	verifier_id and version, requirement, result, score, calibration class, evidence links, disagreement, band decision.
Economics	token and model cost, tool cost, sandbox cost, verification cost, human time, latency, reserve, expected value.
Outcome	commit status, system-of-record result, business event, realized value, loss, rollback, incident, user correction.
Learning	failure cluster, diagnosis, candidate change, dataset example, skill or memory contribution, retirement decision.
Provenance	timestamps, hashes, signatures, environment, certificate_id, correlation links, retention and privacy labels.

Appendix C. Management formulas and decision rules

Table C1. Core formulas and rules

Metric / rule	Definition
Risk-adjusted verified value	RAVV = P(verified success) x business value – execution cost – verification cost – human attention cost – expected loss – latency penalty.
Expected loss	EL = sum(probability of scenario x impact x propagation factor), after controls.
Verified autonomy ratio	Verified material autonomous actions / total material autonomous actions.
Cost per verified action	All-in execution, assurance, human, latency, incident, and reserve cost / verified successful actions.
Governance yield	Change in verified gross margin or loss avoided / incremental governance spend.
Agentic capital turnover	Verified value created / net agentic capital invested.
Escalation precision	Escalations judged to require material human intervention / total escalations.
Regression escape rate	Regressions reaching production / accepted improvements.
Renewal decision	Renew or scale only when hard controls pass, assurance exceeds tier threshold, residual risk is within appetite, and forward RAVV remains positive.
Retirement decision	Retire when expected future RAVV is negative, evidence cannot be renewed economically, dependency risk is unacceptable, or a replacement dominates.

References

[1] Agentic Governance Framework. Agentic Governance as the Operating System of the AI-Native Firm: A foundational framework for AI-native operating models and a revenue engine for agentic capital. Working paper, April 2026.

[2] Chase, H. The Agent Development Lifecycle: Build, Test, Deploy & Monitor AI Agents. LangChain, May 2026. https://www.langchain.com/blog/the-agent-development-lifecycle

[3] LangChain. The Agentic Operating Model: Aligning People, Process, and Technology for Production AI at Scale. 2026.

[4] Collate and OpenAI. A self-service AI data agent for 3,500+ employees: How OpenAI built Kepler on OpenMetadata as the open context layer that grounds every answer. Case study, 2026.

[5] Docker. The Agent Governance Checklist for Security and Platform Teams. 2026.

[6] The Emerging Infrastructure of the Agentic Economy. Working paper, 2026.

[7] National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, 2023. https://www.nist.gov/itl/ai-risk-management-framework

[8] National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1, 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf

[9] National Institute of Standards and Technology. AI Agent Standards Initiative. 2026. https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative

[10] National Institute of Standards and Technology. Building Evaluation Probes into Agentic AI. 2026. https://www.nist.gov/programs-projects/building-evaluation-probes-agentic-ai

[11] National Institute of Standards and Technology. Building Measurement Probes into Agentic AI Ecosystems. Webinar and project materials, 2026. https://www.nist.gov/video/nist-information-technology-laboratory-ai-webinar-series-building-measurement-probes-agentic

[12] Infocomm Media Development Authority. Updated Model AI Governance Framework for Agentic AI. Singapore, 2026. https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/updated-model-ai-governance-framework-for-agentic-ai

[13] International Organization for Standardization. ISO/IEC 42001:2023 – Artificial intelligence management systems. https://www.iso.org/standard/42001

[14] European Commission. AI Act: application and enforcement timeline, including 2026 AI Omnibus changes. Accessed August 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

[15] OWASP GenAI Security Project. OWASP Top 10 for Agentic Applications for 2026. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

[16] UK National Cyber Security Centre. Prompt injection is not SQL injection (it may be worse). December 2025. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection

[17] OpenTelemetry. Inside the LLM Call: GenAI Observability with OpenTelemetry. May 2026. https://opentelemetry.io/blog/2026/genai-observability/

[18] Model Context Protocol. The 2026-07-28 Specification and changelog. July 2026. https://modelcontextprotocol.io/specification/2026-07-28/changelog

[19] Agent2Agent Project. A2A Protocol Specification 1.0. 2026. https://a2a-protocol.org/latest/specification/

[20] OpenAI. Predicting model behavior before release by simulating deployment. June 2026. https://openai.com/index/deployment-simulation/

[21] OpenAI. Agents SDK, tracing, guardrails, human review, and agent evaluation documentation. Accessed August 2026. https://developers.openai.com/api/docs/guides/agents

[22] Zhang, H., Zhang, S., Li, K., et al. Self-Harness: Harnesses That Improve Themselves. arXiv:2606.09498, 2026. https://arxiv.org/abs/2606.09498

[23] Moll, J., Corbeil, J.-P., Pan, J., et al. GRASP: Gated Regression-Aware Skill Proposer for Self-Improving LLM Agents. arXiv:2605.29668, 2026. https://arxiv.org/abs/2605.29668

[24] Chen, M., Wang, J., Liu, Z., Wang, Y., and Wang, Q. From Failed Trajectories to Reliable LLM Agents: Diagnosing and Repairing Harness Flaws. arXiv:2606.06324, 2026. https://arxiv.org/abs/2606.06324

[25] Zhang, X., Cui, Y., Wang, G., et al. Library Drift: Diagnosing and Fixing a Silent Failure Mode in Self-Evolving LLM Skill Libraries. arXiv:2605.19576, 2026; and A Minimal Hygiene Recipe for Self-Evolving LLM Agents, arXiv:2605.22148, 2026. https://arxiv.org/abs/2605.19576

[26] Zhang, X., Wang, G., Cui, Y., et al. Who Grades the Grader? Co-Evolving Evaluation Metrics and Skills for Self-Improving LLM Agents. arXiv:2607.12790, 2026. https://arxiv.org/abs/2607.12790

[27] Wang, H., Poskitt, C. M., and Sun, J. AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents. arXiv:2503.18666, 2025. https://arxiv.org/abs/2503.18666

[28] Winston, C., Winston, C., and Just, R. Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agents. arXiv:2603.20449, 2026. https://arxiv.org/abs/2603.20449

[29] Wang, H., Poskitt, C. M., Wei, J., and Sun, J. ProbGuard: Probabilistic Runtime Monitoring for LLM Agent Safety. arXiv:2508.00500, revised 2026. https://arxiv.org/abs/2508.00500

[30] Okamoto, et al. Explainable Model Routing for Agentic Workflows (Topaz). arXiv:2604.03527, 2026. https://arxiv.org/abs/2604.03527

[31] Amin, D. Bayesian Orchestration of Multi-LLM Agents for Cost-Aware Sequential Decision-Making. arXiv:2601.01522, 2026. https://arxiv.org/abs/2601.01522

[32] Taha, Z. A. K., et al. AgentCompress: Task-Aware Compression for Affordable Large Language Model Agents. arXiv:2601.05191, 2026; Shi, X., Zheng, M., and Lou, Q. Learning Latency-Aware Orchestration for Multi-Agent Systems. arXiv:2607.13359, 2026. https://arxiv.org/abs/2601.05191

[33] FinOps Foundation. FinOps for AI Overview and 2026 guidance on AI cost, usage, and value management. https://www.finops.org/wg/finops-for-ai-overview/

[34] National Cybersecurity Center of Excellence, NIST. Software and AI Agent Identity and Authorization project. 2026. https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization