How to Choose an AI Agent Governance Framework: Define Boundaries First

A governance guide published on DEV Community by MAREF architect 11-Shao argues that organizations must define their governance boundaries before selecting an AI Agent framework, not the other way around. The guide breaks Agent governance into four layers: identity and permissions, behavioral norms, audit and traceability, and policy evolution, warning that most teams focus only on the first layer. It distinguishes between two framework types — embedded governance, which intercepts Agent actions in real time, and bypass governance, which operates as an external service — recommending each for controlled and open environments respectively. Five evaluation criteria are outlined, including native support for human-in-the-loop approvals, separation of policy from code, causal completeness of audit logs, multi-Agent isolation, and a defined failsafe mechanism. The author notes that MAREF uses LangGraph for its core decision pipeline due to its state-machine model and interrupt mechanism, while supplementing it with an external governance layer for untrusted environments.