Flagship white paper

Glossary

The key concepts of the Governed Agentic Organization (GAO), explained in plain language. Every term has its own link you can share and cite.

The basics

Governed Agentic Organization (GAO): An organization in which humans and AI agents work together under explicit mandates, attributable identity, bounded authority, enforceable controls, durable evidence and named human accountability.
Agentic Organization: An organization in which AI agents do real work. It becomes governed only when it has explicit governance over who may do what.
Category axiom: Every Governed Agentic Organization is agentic, but not every Agentic Organization is governed.
Verified Autonomy: The principle that an agent gets as much autonomy as the organization can verify, and no more. It grows with evidence, not with how powerful the AI model is, and it must always be possible to take it back.
Autonomy levels (VA0–VA5): Six levels for how much a single agent may do on its own: observe, recommend, execute with approval, execute within mandate, coordinate and delegate, and adapt within pre-approved limits.
Maturity model (M0–M5): Six levels for the organization as a whole, from fragmented AI use to an institutionalized GAO. Maturity is set by the weakest critical control, not by the average.
The GAO test: Ten questions an organization must be able to answer to count as a Governed Agentic Organization. Take the test.

Organizational constitution: The rules for who may act, why, within which limits and who answers for it: purpose, identity, authority, mandate, control and accountability.
Purpose: The reason an agent exists: the organizational outcome it serves. An agent should not exist just because the technology makes it possible.
Identity: The organization always knows which agent did what. Credentials, process names and API keys are not an identity.
Authority: Organizational permission to act. That an agent can technically reach a system does not give it authority to use it.
Mandate: The description of an agent's task: why it exists, which outcomes it serves, what it must do and where it must stop. A mandate narrows authority; it does not create it.
Control: A boundary that is actually enforced or can be verified: it stops, pauses or shows what happened. Policy text alone is not a control.
Evidence: A durable record of what happened: who acted, under which authority and mandate, which controls were triggered and what the effect was.
Accountability: Named humans and governing bodies remain accountable. Agents receive bounded authority but never take over responsibility.
Core rule: A mandate does not create authority, and technical access does not create authority. An agent may act only when authority, mandate, limits and controls all hold at once.

Control stack: Governance in five layers: the AI model's capability at the base, then agent execution, controls, fleet steering and, on top, the people who are accountable. The model can be replaced; governance sits in the layers above it.
Control plane: The layer that enforces the limits on what agents do. It is itself a risk that also needs governing.
Fleet steering: Directing many agents towards the organization's outcomes without expanding their authority.
AI Chief of Staff: An AI agent that coordinates the fleet: it allocates work and keeps priorities together. It does not make the consequential decisions; accountable people do. An AI Chief of Staff is one way to organize coordination, not a requirement.
Independent review: Review that sits outside the chain doing the work. The builder cannot be the sole judge of its own controls, and consequential findings must be able to reach an accountable person directly.
Evidence discipline: Separating what is designed, what is implemented and what is proven in operation. A policy document does not prove that anything is enforced.
Solve for N: The principle that every meaningful failure should improve the whole system, not just be fixed once.
Reference implementation: Navis Mater's own operations, where the GAO model is used and tested in real work and from which the model is generalized.

NIST AI RMF: The US National Institute of Standards and Technology's voluntary framework to govern, map, measure and manage AI risk. GAO connects such requirements to daily operations. No conformance is claimed.
ISO/IEC 42001: The international standard for an AI management system. GAO complements the standard. No conformance is claimed.
Zero trust: A security principle: no trust is granted automatically based on network location or ownership. GAO applies the same idea to authority: technical access gives no right to act.
Separation of duties: An internal-control principle: the same actor should not both execute and approve consequential actions. GAO applies it to execution, review and approval, and adds independent escalation.