Security & governance

Built to be inspected by the CIO, CFO, GC, and CISO.

Milton's wedge is not that it has agents. It is the discipline that decides what an agent is allowed to do, with what oversight, and how you prove it after the fact. Every control on this page exists because the operating record demanded it, not because a checklist asked. Governance is the product, not the disclaimer.

Documented roles · scoped permissions · human sign-off · separate domains · audit trail
01The principle

Most agentic projects are canceled for the controls, not the models.

The agentic failure data does not point at weak models. It points at escalating cost, unclear value, and inadequate risk controls. A large majority of enterprises still have no mature governance model for agents at all. Milton was built the other way around: the governance came first, hardened across eighteen months of live operation, and the agents were deployed into it.

40%+

of agentic AI projects projected to be canceled by 2027, largely from inadequate risk controls and unclear value

Gartner (2025)

21%

of enterprises have a mature governance model for agentic AI, the rest are deploying ahead of their controls

Deloitte, State of AI in the Enterprise (2026)

90 days

of probationary shadowing by a human supervisor before any agent is fully trusted

Internal operating record (2024–26)

Governance as infrastructure

Four questions, answered before an agent acts.

Good governance is not a policy document or a compliance checklist. It is running code that checks every agent action, every time, before it happens, enforced outside the model so the agent is stopped at the gateway, not asked nicely after the fact. Any serious agent workforce has to answer the same four questions on every request. Milton was built to answer them.

01 · Who is the agent?

Every agent has a verifiable identity before it can do anything. No anonymous process ever touches your systems.

02 · Who authorized it?

Every action traces back to a named human who is accountable for it. Authority is granted on the record, never assumed.

03 · What may it do?

Hard limits and human sign-off thresholds, declared per agent in its permissions file. The boundaries are the product.

04 · Can we prove it?

Continuous checks that it is behaving as expected, and a full audit trail you can replay, action by action.

Agents find their own path, the way water does. The policy is the riverbank: an agent can meander toward the outcome, it cannot cross the line you have drawn. That is the difference between asking an agent to behave and building a system where it cannot misbehave.

02How every agent is governed

Every agent arrives like a hire, not an install.

No agent is provisioned without four things on file. Together they answer the question a security team actually asks: who is this, what may it do, what may it never do, and who is accountable.

Documented role & identity

A named role definition and identity file. You always know which agent took an action, and against which mandate, never an anonymous process.

A role-and-behavior file

What the operating record calls a soul file: the agent's documented purpose, values, and limits, in writing, so behavior is reviewable rather than assumed.

A permissions-and-authority file

The boundary file: hard, negative constraints. Never authorize a payment over a defined threshold without dual human sign-off. Never access the compensation database.

A 90-day probation

Every agent serves a probationary period shadowed by a human supervisor before full trust is extended. New authority is earned against the record, not granted on day one.

03Identity & audit

Humans and agents never share an identity.

Humans operate on the company's standard domain. Agents operate on a separate, clearly designated agent domain. Every message declares its author, so a security team can tell who sent what in sixty seconds, with zero ambiguity. Every action and decision is logged against the operating record, the same dated changelog discipline the workforce has run on from the start, so review is a lookup, not an investigation.

Human sign-off thresholds sit at the boundaries: the agent prepares, routes, and recommends, with its reasoning attached, and a person approves anything that crosses a defined line. Judgment stays human, in writing. The throughput, and the tireless watching, does not.

04Your stack, your models

Governed access to your systems, on models you choose.

Agents operate against your existing systems through their own interfaces, APIs, exports, inboxes, and file systems, with read and write scopes declared per agent and governed per connection by the boundary file. No walled garden, no rip-and-replace, no betting the operating model on a single application vendor. The workforce runs on Claude, OpenAI, Gemini, Ollama, and Grok models, with model costs transparent and paid without a middleman markup.

05For procurement

A packet your security team can sign off on.

Security is not a slide at the end. The M1 assessment produces a security and procurement packet, and names the governance gaps to close before any agent is provisioned. It is designed for a CIO to forward to the CFO, GC, and CISO.

Bring your security team to the fit call.