Cognous Keeps Your AI in Check

You've probably gotten an email that was supposed to feel personal, but obviously wasn't. Something about it just felt off. Automated. And somewhere in the back of your mind, you wondered: who approved this? Honestly? The answer is probably no one. Organizations are leaning harder on AI agents to actually do work. Agents are making database queries, writing letters, accessing email lists, but where does the access end? Without solid guardrails, tone-deaf emails are no longer an embarrassing edge case, they're a real risk. Nobody wants to be the team that let an agent send 1,000 tone-deaf emails to its best clients before anyone noticed. This series is about the tooling that keeps that from happening, and about actually building it, not just reading about it. What actually needs to happen The email itself might be perfectly fine. Correct grammar, on-brand, even genuinely well-written. But the problem is that the email didn't need to be sent. The agent just did it anyway, without any guidance from the team. So the fix isn't a better read of what the agent said. It's governance around what the agent is allowed to do, three capabilities, specifically: - Authorize: Decide in advance what an agent is allowed to do. - Enforce: Apply that decision the moment the agent tries to act, before the action executes, not after. - Prove: Turn every run into a record you can produce on demand, not one you have to reconstruct from memory. Application logs are a day late and a dollar short: the emails are already sent. Looking at logs is reactive. You need a stack that sits in front of your agents and proactively approves or denies actions. Introducing Cognous Cognous builds infrastructure for governing AI agents. Its first release, the Open Control Stack, is fully open source: four small projects that sit beside your AI agents to keep them in check, together covering Authorize, Enforce, and Prove. The four projects are Declare, Control, Replay, Evidence. Declare, the Agent Action Manifest. Written once, before the agent ever runs. The manifest provides or denies access. The agent is attempting to complete a task, but the manifest keeps it in check: - Pull top customers: default_action: allow . A CRM read, flagged to leave a reliance record of what data it used. - Draft a reply: default_action: allow , review_mode: draft_first. The agent prepares content; it doesn't finish the job. - Pull contract details: default_action: block . Off-limits for this agent, full stop. - Send the email: default_action: escalate . Requires a named authority scope and human sign-off before it's eligible to execute. The point is that the manifest lets you say reading customer data is fine, reading contracts is not, drafting is fine, but sending the email needs a person: four different rules for four different actions, declared before any of them happen, instead of one blanket policy applied to "the agent" as if every action carried the same risk. Control, the Agent Control Plane. Runs live, alongside the agent. Every time the agent tries to do something, the Control Plane checks it against what was declared, records the attempt, and either allows it, blocks it, or escalates it for approval, deterministically, every time. Every one of those outcomes gets written down, not just the bad ones. Replay, the Agent Replay Bundle. Not a process, an export. When the run ends, everything the Control Plane recorded (what was proposed, what was decided, what was escalated, what it relied on) gets packaged into a single portable file. No more digging through the logs of a dozen systems to reconstruct one run. Every read, every draft, every escalation, everything that was allowed or held back: it's all in one place. Evidence, the Agent Governance Evidence Pack. Assembled later, across many runs. This is where you get to show your work: not "trust us, we have controls," but "here's proof: 40 sends needed sign-off this month, and here's what happened to each one." Walking the scenario through the stack The manifest declares that sending an email requires authority and escalates rather than executing automatically, decided before the agent ever runs a single task. Mid-run, the Control Plane checks each of the agent's proposals against the manifest as they happen: pulling top customers and drafting a reply go through, pulling contract details is blocked outright, and the proposed send doesn't execute, it escalates and gets held for a person to review. Every one of those outcomes gets recorded as it happens, not just the one that got stopped. When the run ends, every step (the reads, the draft, the block, the held send, and the outcome) gets packaged into a replay bundle. Over time, those bundles roll up into an evidence pack: not "we think our agent behaves," but "here's the record of every send this month that needed sign-off, and what happened to it." A thousand cringey emails to customers drops to zero. There are no questions about why, no furious Slack thread trying to piece it together. And if anyone does wonder, the stack's replay bundle provides the paper trail. See it yourself The Open Control Stack, Cognous's first release, is fully open source, and everything above (the manifest fields, the allow/block/escalate decisions, all of it) comes straight from the actual code, not a slide deck. If you want to see AI agent governance in action instead of taking our word for it, the manifest, control plane, replay bundle, and evidence pack repos are all live on GitHub. Clone one, run the examples, watch a proposed action get authorized, blocked, or escalated in real time. You can learn more about Cognous at cogno.us. This is the first post in a series on AI agent governance. Next up, we build the manifest from this exact scenario: the real schema, the real validation rules, and what runtime authorization for AI agents actually looks like as working code. From there we'll get into the AI agent control plane that enforces it and how a single run turns into replayable AI agent evidence you can hand to an auditor. More posts coming soon. Top comments (0)