AI agent governance in Canada

Every governed action is authorized before it executes, not observed after. The decision to allow, hold or deny is taken against the active policy inside the same write transaction that reserves the budget and consumes the approval, so a policy change lands entirely before or entirely after an action — never halfway through one.

An action held for approval produces no effect until a separately authenticated human with the required role approves that exact request. The approval is bound to the payload and the envelope, is consumed once, and cannot release a different action or the same action twice.

Spend and action limits are reserved atomically inside the authorization transaction. A limit lowered below what is already spent stops further spend without rewriting history, and the change is recorded as a signed configuration record naming the principal who made it.

An authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.

Each decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.

Evidence is verified by a portable verifier with no database, no signing key, no network and no product installation on the path. Deliberately altered evidence — an edited amount inside a signed body, a stripped signature, a broken chain link, a checkpoint re-signed by the writer's own key — is refused, and a verifier that cannot run reports an instrument failure rather than a refusal.

Limitation · The verifier was written by the same party as the system it checks. Verifying with it confirms signatures, linkage and key separation; it is not a substitute for an independent implementation of the documented record format.