Bounded authority
The first governance question is not which model to use. It is what the system is permitted to do. A bounded agent has a narrow task, a fixed set of tools and an explicit list of approved actions. Everything outside that list is unavailable to it, not merely discouraged by an instruction.
Canada's 2026 guide on agentic artificial intelligence makes the same point for public-sector use: actions should be bounded and accountability should remain with people.
Citations as a working requirement
If an output cannot show its source, a reviewer has to redo the work to check it, which removes the benefit. Citations should be part of the acceptance criteria, not a presentation flourish, and they should point to a passage a person can open.
Abstention matters as much as citation. A system that says it cannot answer with the evidence available is more useful than one that answers everything with even confidence.
Testing that survives change
Evaluation is not a launch activity. Models change, prompts change, sources change and the process itself changes. A governed workflow keeps a test set drawn from real cases and re-runs it whenever any of those change, comparing results against the criteria agreed during design.
The NIST AI Risk Management Framework is a useful structure for organizing this work. It is voluntary guidance, not a certification, and no vendor can be certified against it.
Escalation and access
Escalation paths should be specific: which conditions escalate, to whom, within what time, and what happens if nobody responds. Vague escalation is the same as no escalation.
Access is the other half. Retrieval must respect the permissions of the person asking, and content arriving from outside the environment must be treated as untrusted input, with defences against prompt injection applied before it reaches any tool-using step.
Operating cost is a governance concern
Processing cost, storage and third-party usage all scale with adoption. A workflow that is affordable in a pilot can become expensive at volume, and cost per completed task is a legitimate acceptance measure alongside accuracy and effort.
Privacy options without blanket claims
Deployment can be designed for a client-controlled cloud tenancy, an on-premises or isolated environment, or an approved hybrid where specific processing is permitted outside the environment. Each pattern has real trade-offs in capacity, maintenance and control.
What is not defensible is a blanket sovereignty claim. Sovereignty is a specific combination of ownership, location, access, processing terms and operating control, confirmed for a given engagement. Local hosting on its own does not eliminate security risk, and redaction reduces exposure without guaranteeing anonymity.