A machine-readable model of the governance patterns OutTheBox has currently published: their categories, which live pack each ships in, how patterns depend on, feed, encompass, or are commonly confused with each other, and the structured registry schema those patterns operate against. It supports machine discovery, navigation, and integration. It does not contain the decision logic, implementation guidance, worked examples, or Agent 365 templates delivered in the paid packs, and using it does not require purchasing a pack; the packs provide implementation assets beyond this public semantic model, not access to it.
This document replaces, in place at the same v1 path, the first draft published 2026-09-06 on the same day. No external consumer is known to have fetched that draft yet, so it is treated as pre-release and superseded here rather than preserved at a separate v2 path. From this point forward, the versioned path should be treated as stable: a future structural change of this scale would warrant a new /v2/ path instead of overwriting /v1/ again.
A deprecated term is retained for at least one further minor version after its replacement ships, marked deprecated:true with a supersededBy pointer, before removal in a future major version.
Whether an agent should exist, how it is identified, and what happens across its working life.
Whether an agent, and the infrastructure decisions behind it, are actually ready to go live.
How much autonomy an agent has, who can change that, and what triggers a change.
What happens once one agent starts handing work to another.
Whether a failure can be caught, reported, and learned from.
Whether an agent still behaves the way it did when it was approved.
Whether every agent touching a piece of data agrees on what it means.
Whether a change to an agent, or to what it relies on, gets reviewed before it takes effect.
Whether a use case should be built at all, and whether a capability you did not build yourself is actually governed.
Whether an agent's access is owned, current, and actually revocable.
Whether agentic spend is bounded, owned, and reconciled against what was planned.
Whether every agent actually running has been counted.
Prompt Injection & Untrusted-Input Governance
Whether an agent acting on content it did not generate can be trusted.
Whether an agent that writes and ships code is governed the same way a human contributor would be.
Governance patterns for AI agents that author and ship code changes.
Governance patterns for bounding, owning, and reconciling agentic spend.
Governance patterns for an agent's identity, ownership, and credential lifecycle.
Governance patterns for an agent's lifecycle transitions: promotion, demotion, deprecation, retirement.
Governance patterns for discovering and reconciling ungoverned or duplicate agents.
Governance patterns for reviewing and approving changes to an agent or what it relies on.
Governance patterns for shared data definitions and meaning across agents.
Governance patterns for AI agents that score or assess educational work.
Governance patterns for AI agents involved in candidate evaluation and recruitment decisions.
Governance patterns confirming operational readiness immediately before go-live.
Governance patterns for incident response, review, and regulatory compliance operations.
Governance patterns for delegation and coordination between multiple agents.
Governance patterns for monitoring whether an agent's behaviour has drifted from its approved baseline.
Governance patterns for an agent's autonomy level and escalation behaviour.
Governance patterns applied before an agent is built, scoping risk and authorisation.
Governance patterns applied to infrastructure and architecture decisions before deployment.
Governance patterns confirming an agent is ready to move from pilot to production.
Governance patterns for agents acting on content they did not generate.
Governance patterns for AI capability introduced via a third-party vendor tool.
Worker Monitoring & Performance Evaluation
Governance patterns for AI agents that monitor or evaluate worker performance.
Agent Tiering / Governance Tier Classification
Agent Registry with Decision-Tier Metadata and Revocation
Aggregates several other patterns into one checklist-style gate; does not itself read or write a single registry field.
Medium confidence: narrative also implies a decision record this schema doesn't yet capture beyond the tier change itself.
Medium confidence: narrative centres on the deprecation process and notification, not solely the status field.
Architecture Decision Gate for Infrastructure Choices
Assesses whether a process or practice meets a bar across the board, not a single field's value.
Medium confidence: general security review may cover more than the automated security-test-result field captures.
Insufficient evidence in the pattern's own narrative to assign specific registry fields with confidence; treated as an evidence-evaluation pattern pending further specification, not assumed to touch the Agent record.
Field captures the environment label; the pattern's actual check (segregation enforced) has no dedicated field yet.
Aggregate checklist confirming five prior gates passed; not a field-level read or write itself.
Medium confidence: the regression signal itself isn't a distinct field, only its outcome (oversight tier changing) is captured.
Approval Authority Matrix by Autonomy Level
The matrix lookup itself has no field; its output, a named approver, maps to Decision fields.
Describes an immutable transition log; these are the closest existing fields, not a purpose-built audit-trail record.
Multi-Agent Interaction / Composition Governance
Reconciliation check across multiple systems' logs; no single field represents this.
Medium confidence: response process captured only partially by the incident record's root-cause field.
Kill-Switch Verification & Response-Time Target
Verifies a response-time target is met in testing; not a single ongoing field's value.
Whistleblower/Escalation Channel for AI Concerns
Only a .dmn decision table exists for this pattern (no narrative file was found to confirm field-level data use); treated as a process control until a narrative source can be reviewed.
Observability Minimum Standard Definition
Token & Cost Consumption Observability Baseline
Medium confidence: matches an owned, versioned definition reasonably well but doesn't confirm the definition is actually agreed/shared.
Confirms a shared data vocabulary is actually being used consistently; not a single field's value.
Change Impact Classification by Autonomy Tier
Underlying Model Drift Re-Approval Trigger
Medium confidence: the emergency-path-specific criteria and retrospective requirement have no dedicated fields.
Use-Case Risk Triage / Pre-Build Classification
Runs before an agent record exists; its outcome later seeds agent.tier at registration, but there is no agent to read or write yet at the point this pattern itself runs.
Build Authorization & Guardrail Definition Gate
Medium confidence: authorises a build to proceed; maps to a decision record rather than a purpose-built guardrail field.
Vendor AI Terms & Data-Handling Review Gate
Agent Identity Ownership & Sponsor Assignment
Orphaned Agent Credential Detection & Decommissioning
Static Credential / Long-Lived Key Elimination Requirement
Identity Ownership Single-Source-of-Truth Requirement
Fleet Budget Ceiling and Circuit Breaker
No-Code / Citizen-Developer Agent Registration Gate
Medium confidence: registration event fits agent creation fields; the no-code/citizen-developer distinction itself isn't captured.
Duplicate / Redundant Agent Consolidation Review
Decommissioned Agent Residual Footprint Cleanup
Medium confidence: narrative doesn't confirm which downstream systems are actually updated.
Untrusted-Content Trust Boundary Declaration
High-Impact Action Confirmation Gate for Untrusted-Derived Instructions
Confirmation-before-execution maps to a decision record; the specific 'high-impact action type' has no dedicated field.
Baseline Prompt & Behavior Deviation Monitoring
Agent-Authored Commit Test Coverage Gate
Dependency & Package Provenance Verification Gate
Pipeline Execution Credential Scoping Gate
Security Testing Gate for Agent-Authored Code
The tiered promotion-authority definition itself has no field; only the resulting sign-off is captured.
Agent-Initiated Rollback & Remediation Boundary
The source pattern requires the target pattern's outcome to already exist or have occurred before the source pattern can be meaningfully evaluated.
The source pattern's outcome is a direct input to the target pattern. Formal inverse of dependsOn: if B dependsOn A, then A feeds B.
Deprecated alias of feeds. Source data showed upstreamOf used to express the same fact as feeds (general sequential precedence) with no consistent semantic distinction between the two; consolidated in this revision. Retained only so URLs/consumers built against the prior release do not break.
The source pattern is a checklist-style or aggregate pattern that contains the target pattern as one of its constituent parts.
Conceptually the inverse of encompasses is 'is part of'; not separately populated as its own edge in this release.
The two patterns are commonly confused with each other and address a genuinely different governance question; recorded to prevent misapplication.
Stored once per pair; consumers should treat it as bidirectional given symmetric=true, rather than expecting both directions to be physically present.
A weaker, mutual association between two patterns that does not amount to a dependency, containment, or a commonly-confused pair, for example two patterns that are frequently reviewed together.
Not one of the five relationship types requested; retained because roughly a tenth of the source graph's edges are genuine mutual associations that do not fit dependsOn, feeds, encompasses, or distinctFrom without distorting their meaning. Flagged for confirmation, see ambiguity list.
One record per governed AI agent in a buyer's own environment. The record every pattern in this library reads from or writes to when it operates at agent scope.
Named individual accountable for this agent.
Business sponsor who signed off on this agent.
Entry identifier in the governance-grade agent registry.
Count of recorded human overrides or corrections.
This agent's own historical token/cost consumption baseline.
Currently approved underlying model or prompt version.
Behavioural baseline for time from trigger to action.
Reference to the definition of which data categories this agent may access.
Reference to the agent's granted entitlements or permissions record.
Reference to the definition of which tools/actions this agent may invoke.
Reference to the trust classification of content sources this agent consumes.
Reference to the recorded baseline behaviour this agent is monitored against for drift.
Reference to the definition of what counts as drift for this agent.
Whether this agent currently has adequate monitoring/observability coverage.
Timestamp of the last confirmed healthy observability signal from this agent.
Timestamp this agent's compliance attestation was last completed.
One record per pattern evaluation against a governed subject: what was decided, on what evidence, and when, sufficient to reconstruct and audit the decision later.
Stable identifier for this decision record.
Version of the pattern's decision logic used.
Which agent this decision concerns, where applicable.
The pattern's decision-table result for this evaluation.
Short human-readable rationale for the outcome.
Pointer to the evidence the decision was based on, for later audit.
Pointer to a snapshot of the inputs evaluated, for reproducibility.
Version of the governing policy in force at decision time.
Actor that made or triggered this decision.
When this decision's validity ends, if bounded.
The decision this one supersedes, if any.
The decision that later superseded this one, if any.
Pointer to a human approval record, where the outcome required sign-off.
One record per environment an agent has been deployed into (pilot, production, and so on).
Environment name, e.g. pilot, staging, production.
When this deployment went or is due to go live.
Reference to this deployment's documented rollback plan.
Reference to the acceptance criteria this deployment must satisfy before go-live.
An infrastructure or hosting decision an agent's deployment depends on.
Whether this infrastructure is owned, rented, or shared.
Jurisdiction the component is hosted in, where sovereignty matters.
Provider the component routes model calls through, where applicable.
An identity credential an agent holds or has held.
Named individual accountable for this credential.
Timestamp this credential was last rotated.
Time-to-live configured for this credential's granted scope.
A third-party vendor whose tool has introduced an AI or agentic capability into the buyer's environment.
Governance tier assigned to the vendor-introduced capability.
When the vendor's AI terms and data-handling were last reviewed.
Reference to the documented AI/agentic capabilities disclosed by this vendor.
A data entity or definition an agent reads, writes, or reasons over.
The domain or team responsible for this asset's definition.
Version of the shared definition currently in force.
Reference to this data asset's recorded lineage/provenance chain.
Most recent computed data quality score for this asset.
Timestamp of the last data quality check run against this asset.
Sensitivity/classification level assigned to this data asset (e.g. public, internal, restricted).
When the incident was closed, if resolved.
Owner assigned to this incident's corrective action.
A recorded change to an agent or to something it relies on.
When the change was approved, if approved.
Outcome of automated or manual validation run against this change.
Test coverage percentage recorded for this change.
Verification status of this change's declared dependency provenance.
Outcome of security testing run against this change.
Scope of remediation an agent is authorised to apply autonomously for this change.
Named individual who approved this change.
A recorded instance of one agent delegating work to another.
Position of this hop in a delegation chain, where chains are tracked.
Whether this specific pairing has been reviewed and approved as a unit.