Runtime Governance Contracts

Status: Draft preview extension for the v1.0 alpha publication surface
Last Updated: 2026-02-26
Not required for ACGP v1.0 Standard conformance. Safety-Critical conformance claims are not available in v1.0.0-alpha.2.

Abstract

Runtime Governance Contracts provide per-action runtime negotiation of evaluation depth, latency budgets, and fallback behavior between an Operating Agent and its Governance Steward. This specification standardizes the human-facing concept as Runtime Governance Contracts while retaining the reserved wire field name governance_contract for protocol stability. They operate within Governance Tier constraints and cannot reduce governance below the minimum controls required by the agent's Governance Tier.

Profile-failure fallback handles Steward/session-path unavailability. Evaluation-timeout policy handles an exceeded negotiated latency budget while the Steward/session path remains available.

Key Concepts (Preview)

Risk Levels

  • low_risk: Easily reversible or no side effects (default)
  • elevated_risk: Has consequences but not catastrophic
  • critical_risk: Difficult/impossible to reverse or high-value target

Evaluation Tiers

  • Eval-0: Must-pass synchronous checks (<100ms, no external deps)
  • Eval-1: Fast synchronous policy checks (<300ms target)
  • Eval-2: Deep asynchronous analysis (LLM-based, seconds to minutes)
  • Eval-3: Human-in-the-loop approval (human time)

For v1.0 conformance claims, Eval Tier 2 is reserved (non-normative) per ACGP-3 Section 5.7. Runtime Governance Contracts keeps Eval-2/Eval-3 in this preview as optional extension behavior and MUST NOT be interpreted as a v1.0 Standard requirement.

Performance Budgets

Per-request latency contract specifying how long the agent will wait for a governance decision. Core fields include latency_budget_ms, fallback_on_timeout, and optional tier_budgets.

Evaluation Timeout Policies

These policies apply when a specific evaluation exceeds its negotiated latency budget while the Steward/session path remains available. They do not redefine the core profile failure fallback used for disconnects or Steward unavailability.

  • deny: Block the action (safety > availability)
  • allow_and_log: Allow with heavy logging (availability > safety)
  • cached_decision: Use cached policy if available, else deny
  • escalate: Move to higher eval tier or human approval

Hook Point

Core hook in ACGP-2 via reserved governance_contract envelope field.

Status

This document defines the current preview extension surface referenced by ACGP-1 terminology and ACGP-2 extension boundaries.

Implementations MAY provide this interface. If not provided, the core hook MUST be a no-op (the governance_contract envelope field is silently ignored).

Interface Signature

from typing import Protocol, Optional, Literal
from dataclasses import dataclass

@dataclass
class PerformanceBudget:
    latency_budget_ms: int
    fallback_on_timeout: Literal["deny", "allow_and_log", "cached_decision", "escalate"]
    tier_budgets: Optional[dict] = None  # e.g., {0: 50, 1: 200, 2: 5000}

@dataclass
class GovernanceContract:
    risk_level: Literal["low_risk", "elevated_risk", "critical_risk"]
    performance_budget: PerformanceBudget
    eval_tier: int  # Requested evaluation depth (0–3)

class GovernanceContractProvider(Protocol):
    """Per-action governance contract negotiation."""

    def negotiate(
        self,
        agent_id: str,
        action: str,
        governance_tier: str,
        requested: GovernanceContract,
    ) -> GovernanceContract:
        """Returns the effective contract (may tighten requested parameters)."""
        ...

Reserved Wire Field

Field Type Location Description
governance_contract object TRACE envelope Per-action runtime governance contract parameters

Minimal Forward-Compatible Example

{
  "governance_contract": {
    "risk_level": "elevated_risk",
    "performance_budget": {
      "latency_budget_ms": 300,
      "fallback_on_timeout": "cached_decision"
    },
    "eval_tier": 1
  }
}