OperationalAgents—theexecutionlayerofNeuroClusterintelligence.
A NeuroCluster Agent is not a generic “read SAP and send an email” bot. It is triggered by operational state on the ontology, retrieves evidence, evaluates policy, recommends intervention, and acts only under approval.
- Its own principal. Not a shared service account.
- A named person accountable for its behaviour.
- What it exists to do, in the business's words.
- The decisions it may make without asking.
- Explicit grants, default deny.
- Which objects and records it may read.
- Which tools and MCP servers it may call.
- Which models are permitted for this work.
- Where it may egress, if anywhere.
- When its credentials and mandate expire.
- Spend ceiling per run and per period.
- Which actions require a human decision.
- What it must record for every run.
- How it is stopped, and by whom.
Agents are not the product
Ontology = understanding. Intelligence = reasoning. Agents = execution. NeuroCluster Operational Agents sit on the live operational model. External enterprise agents consume the same intelligence through Interfaces. Do not lead with “Build AI agents with NeuroCluster.”
Theshapeoftheproblem
Building one agent is a weekend. Running fifty in an organisation that has auditors is a different discipline. The difficulty is not the reasoning loop — that part is well understood and increasingly commoditised. The difficulty is that each agent quietly accumulates access, and that nothing in a typical stack records why it was given.
The failure mode is rarely dramatic. It is an agent built for one purpose that still holds a token from a previous integration; a shared service account that four teams now depend on; a tool call that worked in testing against production data. None of these are exotic, and none of them are visible without a governance model.
So NeuroCluster treats an agent as a managed object with a declared record, rather than as code with a prompt attached.
Whatamandateactuallyconstrains
A mandate is not a system prompt. It is enforced outside the model, which is what makes it a control rather than a request.
Purpose and owner
Why the agent exists, in the business's words, and which named person answers for its behaviour. Agents without owners are decommissioned.
Decision authority
Which decisions it may make alone, which it must propose for approval, and which it may never make. Expressed against declared actions in the ontology.
Data scope
The object types, instances and regions it may read. Default deny — an agent sees what it was granted, not what its credentials happen to reach.
Tool scope
The tools and MCP servers it may call, with argument constraints and rate limits. Access is brokered, so the agent holds a capability rather than a secret.
Model policy
Which models are permitted for this agent's work, given the sensitivity of the data it handles and where inference may occur.
Network policy
Whether it may reach the internet at all, and if so, precisely where.
Lifetime and review
When credentials expire, when the mandate is next reviewed, and what happens if nobody reviews it.
Cost budget
A spend ceiling per run and per period. Runaway loops become a stopped agent and an alert rather than an invoice.
Evidence obligations
What it must record: inputs, retrieved context, model selection, tool calls, approvals and outputs.
Kill switch
A tested path to stop this agent, or every agent, immediately — including revoking credentials already issued to in-flight runs.
Delegation
When one agent asks another to do something, authority narrows. A sub-agent can never hold more than the mandate that invoked it, and the chain of delegation is recorded as part of the evidence.
Whatagovernedagentactuallydoes
The loop is unremarkable. What makes it enterprise-grade is that every stage resolves against typed objects and leaves a record.
- ObserveSignals arrive from operational systems, sensors, documents and people.Signals are typed as events against known objects.
- UnderstandThe signal is placed in context: which asset, which contract, which obligation.Relationships supply the context a model cannot infer from text.
- DecideOptions are generated and assessed against rules, risk and precedent.Rules and metrics make the decision criteria explicit.
- ActA permitted action is taken, or routed to a human with the case assembled.Actions are declared operations with owners and preconditions.
- VerifyThe outcome is checked against what was expected, and recorded.Evidence attaches to the object, not to a chat transcript.
- LearnEvaluations, corrections and outcomes feed back into models and policy.The semantic model absorbs new categories and constraints.
Learn feeds back into Observe. The loop is continuous, and every turn of it is recorded.
Humanoversightthatpeoplewillactuallyuse
Approval queues fail when they ask a person to rubber-stamp something they cannot assess. The design goal is a decision, not a confirmation.
The case, assembled
An approval arrives with the proposal, the evidence behind it, the objects affected and the alternatives considered.
Consequence of inaction
What happens if the approver does nothing, so that declining is an informed choice rather than a safe default.
Routing by ownership
The request goes to whoever owns the affected object, resolved from your directory rather than a static list.
Escalation and expiry
Unanswered approvals escalate or expire. Nothing sits in a queue indefinitely.
Recorded reasoning
Approvers can record why, and that reasoning becomes part of the evidence for the decision.
Reversibility
Where an action can be undone, the undo path is part of the proposal rather than an afterthought.
Questions
- Can we bring agents built elsewhere?
- Yes, where they can be routed through the control plane for data access, tool calls and model calls. An agent that obtains credentials directly and calls systems out of band cannot be governed by any control plane, which is worth knowing about your existing estate either way.
- How many agents is realistic?
- The number is less interesting than the ratio of agents to owners. Governance scales when each agent has a named owner, a scoped mandate and an expiry date; it collapses when a platform team becomes the de facto owner of everything.
- What stops an agent from talking its way past a policy?
- Policy is evaluated outside the model. The agent's output is a request; the control plane decides whether to honour it. No amount of persuasive text changes a permission, because the permission is not being read by the model.
- How do you handle agents that need broad read access?
- Broad read is sometimes legitimate. It is granted explicitly, scoped to object types rather than systems, time-bounded, and monitored — and the evidence record shows what was actually read rather than what could have been.
Continue
- Control planeWhere mandates are enforced and evidence is produced.
- OntologyThe typed objects a mandate is written against.
- SecurityNon-human identity, credentials, sandboxing and isolation.
- GovernanceRisk classification, approvals, evaluation and change control.
- RuntimeWhere agents execute, and how they are contained.
- ModelsHow model choice becomes a policy decision.
Bring us one operational problem.
You do not need a finished brief. Bring the problem — we will work out the next step together.
Or book a call with the team