Intent-Based Governance for AI Systems

Permission models authorize an agent to touch a resource; they say nothing about why it should. This series builds intent-based governance from the ground up: governing an autonomous agent by its declared intent rather than an enumerated list of permissions. It develops the intent-governance model and how it differs from access control, how to capture and verify intent with intent specifications and provenance while confronting the intent-action gap, how to compile intent into enforceable runtime guardrails and where those guardrails fail open, how to measure intent conformance — did the agent do what was asked, and only that — and how to govern at scale with intent ledgers, audit trails, and a mapping to the NIST AI RMF, the EU AI Act, and ISO/IEC 42001. Grounded in the NIST AI Risk Management Framework and Generative AI Profile, NIST SP 800-207 Zero Trust, the OWASP Agentic Security Initiative and LLM Top 10, MITRE ATLAS, ISO/IEC 42001, and the EU AI Act.