# I built a deterministic execution-governance layer for AI agents. Where does it break? > Source: > Published: 2026-09-07 17:37:52+00:00 Autonomous AI agents can increasingly call tools, invoke APIs, and take actions in external systems. That raises an implementation question: **Can execution itself be governed deterministically before an agent’s action is allowed to proceed?** I built an open-source runtime framework to investigate that question: **Execution Governance AI (EGA) V9**. Rather than replacing the LLM or agent framework, EGA V9 introduces a separate execution-governance layer for verifying workflows, evaluating trust state, and triggering fail-closed containment when predefined governance conditions are violated. The implementation and reproducible evidence are public: **GitHub:** **Paper / methodology:** Within the evaluated threat model and experimental conditions, the reported evaluation detected **100% of the injected attacks, with 0% false positives and 0% false negatives**. Those numbers are not a claim that every autonomous-agent attack can be stopped. They describe the reported evaluation within its defined scope. What I am more interested in now is the implementation itself: **If you were trying to break this execution-governance boundary, what would you test first?** Reproduction attempts, adversarial cases, implementation criticism, and failures are all useful. **What am I missing?**