HIOP Governed Agent Operations

HIOP gives AI agents a deterministic authority boundary before they cause real-world effects—allowing, denying, or holding actions for approval while producing tamper-evident evidence receipts.

Comment

AI agents are rapidly gaining the ability to reason, discover tools, operate cloud infrastructure, manipulate data, and trigger real-world effects. But greater intelligence should not automatically mean greater authority.

HIOP Governed Agent Operations was built around one principle:

Nothing an AI agent learns increases what it is authorized to cause.

We wanted to demonstrate an agent architecture where Google AI can be highly capable while a separate authority system determines what the agent is actually permitted to do.

What it does

HIOP Governed Agent Operations places an independent Effect Authority boundary between AI reasoning and consequential execution.

The live system follows this lifecycle:

REQUEST → AI REASONING → AUTHORITY → EXECUTION → EVIDENCE

It demonstrates three governed outcomes:

  • ALLOW — an authorized and bounded action is permitted.
  • DENY — an unauthorized action is blocked before execution.
  • APPROVAL — a sensitive action is held until bounded human authorization is provided.

Gemini can reason about the requested action, but the AI model is not the authority.

Every authority decision produces an evidence receipt containing the agent, resource, policy, decision, execution state, model information, timestamps, trace ID, and a SHA-256 evidence hash.

For approval-required actions, HIOP can issue a bounded approval token tied to a specific trace, resource, policy, effect, nonce, and expiration.

How we built it

The live system runs on Google Cloud.

Browser → Cloud Run → Vertex AI → HIOP Effect Authority → Pub/Sub → Evidence

The project uses:

  • Google Cloud Run
  • Vertex AI
  • Gemini 3.5 Flash
  • Google Gen AI SDK
  • Google Cloud Pub/Sub
  • Google Cloud Storage
  • Google Cloud Logging
  • Gemma 4 26B A4B IT
  • Veo 3.1 Fast
  • Lyria 2
  • Node.js / Express
  • SHA-256 evidence hashing

Gemini provides AI reasoning while HIOP independently evaluates whether the requested effect is authorized.

Google Cloud Pub/Sub records authority and evidence events, creating observable cloud evidence of the governed workflow.

We also integrated additional Google AI models into the project.

Gemma 4 provides an independent secondary risk critique without receiving authority to execute.

Veo 3.1 Fast generates a visual governed-workflow proof asset.

Lyria 2 generates an audio governed-workflow proof asset.

These integrations were tested against live Google Cloud services rather than represented as conceptual integrations.

Challenges we ran into

The biggest challenge was separating intelligence from authority.

The easiest architecture would have been to ask an AI model whether an action should execute and then trust its response. We deliberately avoided that design.

Instead, the model can reason, recommend, and understand context while HIOP independently determines whether an effect is authorized.

We also had to integrate several different Google AI systems with different APIs, model locations, asynchronous generation behavior, and output formats.

For example, Lyria required correctly handling its generated audio response before storing the resulting WAV asset in Google Cloud Storage, while Veo required asynchronous video generation and retrieval.

We tested each integration independently and only counted a model after receiving a successful live result.

Accomplishments that we're proud of

We built more than a chatbot or agent demonstration.

The deployed system proves a governed AI-agent architecture where:

  1. An agent requests an effect.
  2. Google AI reasons about the request.
  3. HIOP independently evaluates authority.
  4. Authorized effects can proceed.
  5. Unauthorized effects fail closed.
  6. Sensitive effects can be held for bounded human approval.
  7. Pub/Sub records authority and evidence events.
  8. A cryptographically hashed evidence receipt records what happened.

Our live deployment successfully demonstrated all three authority paths:

ALLOW → PERMITTED

An approved analytics export was authorized and permitted.

DENY → BLOCKED

An attempt to delete a primary customer dataset and its recovery snapshots was denied and blocked.

APPROVAL → HELD

A production signing-key rotation was held pending bounded approval.

The approval workflow also generated a time-limited authorization token scoped to the specific resource and effect.

We additionally achieved successful live results from Gemma 4, Lyria 2, and Veo 3.1 Fast, including generation of a Lyria WAV asset and a Veo video asset stored in Google Cloud Storage.

What we learned

The most important lesson is that AI capability and operational authority should be separate systems.

A more capable model does not have to mean a more dangerous agent.

Models can continue becoming better at reasoning, planning, discovering tools, and understanding environments while an independent authority boundary controls what effects they may actually cause.

We also learned that evidence should be part of execution itself rather than something reconstructed later from application logs.

A governed system should be able to answer:

Who requested the action?

What resource was targeted?

What authority existed?

What decision was made?

Was the effect permitted, blocked, or held?

What evidence proves what happened?

What's next for HIOP Governed Agent Operations

The next step is extending the same governed-effect architecture beyond this cloud demonstration.

The authority boundary can apply to AI agents interacting with enterprise systems, scientific instruments, robots, vehicles, industrial infrastructure, spacecraft, and other consequential real-world assets.

We also want to expand multi-agent workflows where specialized AI models can reason, critique, plan, and collaborate while none of those capabilities independently grants additional authority.

The long-term goal is simple:

Let AI become dramatically more capable without automatically making it more powerful over consequential systems.

HIOP is building the authority and evidence infrastructure between intelligent agents and the effects they want to cause.

Built With

Share this project:

Updates

Submission history