Every term the method depends on — the 6 Pipes, the mechanisms that enforce them, and the regulation they answer to. Defined plainly, cross-linked to the framework and the cases, and queryable by AI where it gets technical.
Agents run on least-privilege service accounts; no agent inherits human access. Destructive actions are blocked at the keyring, not by instruction — so a misbehaving or prompt-injected agent can't reach what it was never granted. Prevents an oversized blast radius.
Every call, path and output is logged to an append-only ledger and is traceable — and reversible — in under 30 seconds. Prevents the "we don't know why it did that" audit failure. The trail is built to survive a regulator, not satisfy a dashboard.
High-stakes actions block until a human authorization token clears. The agent cannot execute irreversible financial or legal tasks alone. Prevents legally binding action without oversight — gates designed to satisfy the EU AI Act without killing velocity.
Cost, velocity and error telemetry with automatic suspension on breach. Prevents runaway loops and cost spirals — the agent runs free inside a boundary it cannot cross, and stops itself before damage rather than after.
Legacy systems are wrapped behind API gateways; the core is never touched directly. The agent works with insulated, hashed data feeds — not the systems of record. Prevents direct AI reach into core databases. AI that can't integrate with legacy never ships.
Every incident and human override updates the ADR library. The system's rules evolve from real failures instead of rotting — institutional memory, not patching. Prevents silent recurrence of the same failure.
The four guarantees that decide whether an agent touches production: can you constrain it, attribute it, gate it, and stop it? These are Pipes 1–4 — the Non-Negotiables. Pipes 5–6 make a governed agent survive a real enterprise.
A record of why every significant architectural choice was made. The ADR library is your proof of rigor for a regulator and your institutional memory when the team turns over. The Learning Loop (Pipe 6) feeds it; auditors read it.
The wrapper around each agent that carries its constrained identity, action ledger, authorization gates and kill thresholds together — the runtime expression of the pipes. Used in production at Najm to hold every agent to SAMA-grade governance.
Risk-based classification of AI systems. High-risk (Annex III) obligations — risk management, logging, human oversight, transparency — apply from 2 August 2026. Penalties can reach €35M or 6% of global revenue. Operative but contested: subject to pending Digital Omnibus revisions — verify before citing.
Special-category data — health, biometric, genetic — requires explicit consent or substantial public interest. In AI systems this surfaces as a consent-verification layer mapped to data governance. A live constraint at De Lijn's GDPR guardrails.
Financial-services requirements in Saudi Arabia — among the strictest in the Gulf. Operating vision AI inside a SAMA-regulated environment means an agent reaching the wrong database is a breach, not a bug. Proven at Najm Insurance.
Operational-resilience obligations for EU financial entities, in force since January 2025. Shapes how AI systems in finance must handle failure, continuity and third-party risk — resilience as a regulatory requirement, not a nice-to-have.
A security posture where no actor is trusted by default and every access is verified. For agents it is the philosophical root of Constrained Identities: the agent earns each privilege explicitly, never inherits one.
A 30-day sprint from regulatory mapping to a production-ready, governed deployment: Foundations (days 1–10), Wiring (11–20), Readiness (21–30). The governance checklist is the operational artifact that closes it out.
Roughly 70% of enterprise AI pilots die before production. The root cause is always a governance gap — not a model gap, not a data gap. The models work; nobody built the system around them.
The open-source layer that enforces the pipes in your agent runtime — constrained identities, a read-only ledger, authorization gates and kill thresholds, as code. aiplumber.dev is the method; Kleiber is the installable proof.