Your LLM Agents Are Missing a Crucial Governance Layer — AgenticRei's Deontic Policies Fill the Void
New framework enforces obligations, dispensations, and conflict resolution for autonomous AI agents at runtime.
A new paper from UMBC researchers introduces AgenticRei, a runtime governance framework for agentic AI systems powered by large language models. The framework addresses a critical gap: current policy engines (e.g., XACML, Rego, Cedar) only handle permit/prohibit constraints but fail to capture the full enterprise governance structure needed for autonomous agents. AgenticRei uses a deontic policy language built on the Rei framework, expressed in OWL, and evaluated by a high-performance logic engine entirely outside the LLM. It supports obligations (e.g., "notify the CISO after certain actions"), dispensations (waive obligations under specific conditions), and meta-policy conflict resolution—all at runtime. The same pipeline governs both tool invocations and agent-to-agent messages, and it composes with industry-standard frameworks like A2AS.
The authors demonstrate that deontic policies can represent governance constraints around security and privacy that current production engines cannot express. Examples include dynamic policy hierarchies, reasoning over domain ontologies (healthcare, cybersecurity), and handling standing obligations. The paper will be presented at the 2026 IEEE Symposium on Agentic Services. As autonomous AI agents become more capable and autonomous, AgenticRei offers a principled way to ensure they remain compliant with organizational rules without relying on the LLM's fragile reasoning for governance.
- AgenticRei supports obligations, dispensations, and conflict resolution beyond the permit/prohibit of XACML, Rego, and Cedar.
- Policies are expressed in OWL and evaluated by an external logic engine in the control flow of LLM agents.
- The framework governs both tool calls and inter-agent messages, and integrates with the A2AS standard for multi-agent coordination.
Why It Matters
As autonomous AI agents proliferate, deontic runtime governance ensures compliance without sacrificing capability—critical for enterprise security and privacy.