Constrain agent tools, identity, memory, approvals, execution, and signed action evidence.
Learning outcomes
Curriculum
The chapters are individually addressable documentation pages. You can link directly to a concept from another program, architecture decision, or implementation guide.
Define the agent boundary, assets, actors, flows, and action consequences.
Model an agent as a bounded decision-and-action system with explicit authority, tools, memory, and evidence.
Set the intended purpose, actors, assets, dependencies, lifecycle, and system boundary before selecting controls.
Map where trust changes and where data, artifacts, requests, identities, tools, and evidence cross a boundary.
Inventory the data, models, prompts, artifacts, identities, tools, interfaces, infrastructure, and evidence that require protection.
Allow only identifiable tools and permissions that are valid for the actor, purpose, and step.
Define allowlisted tools, schemas, identities, scopes, credentials, side effects, and revocation behavior.
Review MCP trust boundaries, authorization, malicious tool results, and measurable security acceptance cases.
Preserve user, workload, service, and tool identity across AI boundaries and make policy decisions explicit.
Enforce source permissions through ingestion, indexing, retrieval, caching, generation, and evidence handling.
Bound planning, execution, memory, side effects, budgets, and exceptions.
Constrain plans and execution with approvals, budgets, isolation, memory boundaries, and deterministic policy checks.
Translate sovereignty goals into testable statements of what must be allowed, prevented, approved, observed, retained, and recovered.
Evaluate behavior, observe operations, retain action evidence, and control change.
Record attributable action traces and test success, policy compliance, recovery, and incident response.
Turn acceptance criteria into repeatable promotion decisions with recorded evidence and rollback conditions.
Design signals that explain service health, AI behavior, policy outcomes, change, and incidents without leaking sensitive content.
Design evidence alongside controls so important decisions, releases, configurations, and operating events can be verified.
Version complete AI behavior, assess change impact, approve promotion, support rollback, and retire superseded assets.
Record context, options, control consequences, evidence, dependencies, limitations, and reversal triggers for material decisions.
Produce a governed-agent design and evaluate its control coverage.
Review and apply a fixed two-file proposal, reject stale state, and confirm separate test results.
Design a bounded approval-based agent workflow and its verification package.
Verify tool, identity, permission, approval, confinement, memory, receipt, evaluation, and incident controls.
Preview a single-file Python correction with local Ollama inference, approve a fresh proposal, and run separate Docker tests with networking disabled. Host isolation and signed audit evidence are outside this prototype.
Public introductory prototype; target-host run evidence is not published
Review a fixed two-file proposal, enforce source hashes and an explicit write allowlist, reject stale approval, and run separate Python tests. This deterministic harness does not invoke an LLM or isolate the host.
Python-only validation recorded (11 safety checks, one symlink check skipped); Docker and independent reproduction not performed
Design bounded agent tools, approvals, confinement, memory, and action receipts.
Design exercise; executable implementation pending
SAI-280 remains an outline for advanced governed agents. The basic local coding lab and the deterministic intermediate repository change exercise are available as separate teaching prototypes; they do not satisfy the advanced confinement, signed-receipt, or independent-reproduction requirements. The advanced executable lab and practical assessment remain unreleased.