Loop Engineering, Chapter 5: Sovereign Agentic Loops and Execution Governance

This is Part 5 of a series walking through my book Loop Engineering: Scaling and Governing Agentic AI. In the previous chapter, we moved the loop onto operated infrastructure. This one opens the governance section with the security question that infrastructure does not answer.

A well-monitored agent can be monitored doing exactly the wrong thing, because the wrong thing was suggested to it by a document it read, a row it queried, or a webhook it received. The question this chapter answers is narrower and harder than “how do we run agents reliably?” It is “how do we let an agent act on the world without letting the world hijack the agent?” The answer is not a smarter prompt or a more careful model. It is an architecture that refuses to treat the model's reasoning as authority.

That refusal is the decoupling principle. The central security flaw in agentic systems is treating a model's output as an executable command. The model is a confused deputy — capable, well-intentioned, and trivially talked into things by whatever text lands in its context. So the model must only ever propose, in a typed, structured form, and a separate deterministic component must decide whether the proposal is permitted. Reasoning and execution become two different stages with a hard boundary between them, and that boundary is where prompt injection goes to die.

Three layers that make it real

The chapter builds out the architecture the book calls a sovereign agentic loop, and three pieces do most of the work. The obfuscation membrane limits what identity-sensitive data the model ever sees while preserving the structural relationships it needs to reason — the model works over safe, pseudonymized structure, and real values are restored only after a decision is approved. Deterministic evaluation uses a policy engine like Open Policy Agent to check the agent's typed intent against explicit rules and live system telemetry, so permission is granted by code, not by vibes. And the cryptographic evidence chain writes every intent, context, evaluation, and executed action to a tamper-evident ledger, so the whole run can be replayed and audited deterministically after the fact.

The chapter includes a real Open Policy Agent rule and a hash-chained evidence record so the architecture is concrete rather than aspirational. The formal models — the state-space constraints, the membrane as a projection, the evaluation as a logical conjunction — are kept light here and worked out fully in the book's mathematical appendix, for readers who want the derivation.

Tomorrow: deterministic governance keeps the machine in bounds, but some decisions still need a person. Chapter 6 is about designing the human into the loop without fooling yourself that you have.