What is deterministic AI governance?

Most AI governance tools are probabilistic. They observe agent behaviour, score it against a learned model of what normal looks like, and raise something when the score crosses a threshold. That is a legitimate and useful capability — it is how you find the problems you did not know to write a rule for. It is not, however, an authorization decision.

The failure modes are the important row. A probabilistic system fails unpredictably, and you cannot enumerate in advance the cases it will get wrong. A deterministic system fails only where your rules have a gap — which is a problem you can find by review, close by writing a rule, and prove you have closed.

The argument is short. If the thing deciding whether an agent may move money is itself a model, you have added a second system that can be wrong in unpredictable ways in order to govern the first. You have not reduced your exposure; you have doubled the number of components whose behaviour you cannot fully characterise, and made the second one load-bearing.

Segregation of Duties makes this concrete. Whether the agent that raised a purchase order is the same agent now approving it is a fact. You look it up. There is no confidence interval on it, no threshold to tune, and no scenario in which the right answer depends on how the request was phrased. Scoring that question with a classifier would be a strictly worse way of answering it, and would turn a control an auditor can test into a signal they cannot.

This is also why governance has to sit outside the agent's execution loop. An agent behaving unpredictably cannot be the component that decides whether its own behaviour is acceptable. Forrester makes this the defining property of the agent control plane category: oversight has to remain possible precisely when the agent is doing something you did not expect.

The practical payoff shows up months later, in a room with someone asking questions.

• The decision can be replayed. An auditor can take an action from March, run it against the policy that was in force in March, and get the same answer the system gave at the time. A scored decision cannot be replayed, because the scoring model has moved on.
• The reason is a citation, not a narrative. "Blocked by SoD rule AP-04" is a control. "Flagged with 0.87 confidence by the anomaly model" is the beginning of an investigation.
• Coverage is provable. Because the rules are enumerable, you can demonstrate which controls exist and which actions they cover. There is no equivalent statement for a detector.
• There is no tuning argument. Nobody has to defend a threshold, explain why it was set where it was, or account for what changed when it moved.

Regulators are increasingly explicit about this. The EU AI Act's record-keeping and human oversight obligations assume that a decision was made and can be evidenced, not that a system formed an impression.

A common objection is that deterministic governance cannot cope with agents, precisely because agents are non-deterministic. The objection confuses two different layers.

The agent stays as flexible as you want it. It reasons, plans, and chooses freely; nothing about deterministic governance constrains how it thinks. What is deterministic is the authorization decision applied to whatever it chooses to do. The agent may propose anything; the control plane rules on it consistently. That is the same arrangement every enterprise already runs for its people, who are also non-deterministic and are also governed by rules rather than by predictions about their behaviour.

This is what makes agentic AI viable in a regulated workflow at all. Robotic process automation gave you audit-grade certainty and no flexibility. Ungoverned agents give you flexibility and no certainty. Deterministic enforcement on a flexible agent gives you both: the agent adapts, and the boundary holds.