Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps they find only after a production incident (Gartner, May 2026). The cause it names is binary control: "Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure," says Shiva Varma, Senior Director Analyst at Gartner.

Gartner's research note for infrastructure and operations leaders, Implement Gartner's Agentic Governance Framework for I&O in 6 Agile Phases, turns that diagnosis into three imperatives: keep enforcement outside the model, give every agent scoped access and an accountable owner, and apply progressive controls that adjust with risk, which Gartner calls "the dimmer switch." Each imperative maps to a concrete mechanism in Modulo.

Enforcement lives outside the context window

Gartner's first imperative is to decouple reasoning from execution. Guardrails run as deterministic policy-as-code outside the context window, so a model is never trusted to enforce its own safety policy. We made the same case in why safety can't live in your agent definition.

Modulo enforces at three boundaries the model cannot edit.

Ingestion edge. Guardrails check a run's input before it is persisted. Detection is deterministic (regex or json_schema), and the actions are observe, warn, block, and redact. Webhook payloads are checked a second time at the trigger boundary, before deduplication.
Inside the agent loop. For sandbox_agent nodes, every tool call is reported to Modulo before it executes. A block stops the call from running, and a redact masks its arguments before the tool sees them.
Output seams. Every node output validates against its output_schema, then passes through deterministic gates with pass thresholds before any human review.

Guardrail configuration is policy-as-code in the literal sense: versioned, hashed YAML that you propose, diff, and apply through a pull request, pinned into each run's snapshot with drift detection. A change to a safety control is reviewed and audited before it takes effect.

Scoped access and an accountable owner

Gartner's second imperative covers non-human identity and ownership: every agent gets tightly scoped credentials, and every agent has a named owner accountable for what it does.

A Modulo pipeline node declares a capability_scope that narrows what its agent can reach: allowed_connectors, allowed_tools, and context_scope for the run-context keys it may read. Credentials outside the scope are never decrypted for that node. Credentials inside it decrypt once at run start into a run-scoped context and never enter agent state, checkpoints, traces, or logs. A node that reaches for anything outside its scope fails with a typed scope.violation error.

Pipelines carry an owning team, and human_only gates route review to that team, so every decision has an accountable reviewer on record.

Controls that adjust with risk

Gartner's third imperative is progressive control: permissions that tighten, or escalate to a human, as risk shifts, without a hard shutdown that breaks work already in flight. For the highest autonomy tier, Gartner lists continuous monitoring, enforced guardrails, rapid rollback, circuit breakers that halt an agent on threshold violations, and clear ownership.

Modulo's controls are graduated.

Autonomy levels. Each pipeline runs at manual_approval, notify_on_complete, or fully_autonomous. A context-setter agent can recommend a different level for a single run based on what that run touches, and every applied level is recorded as a run.autonomy_level_applied event.
Escalation. When a blocking guardrail's required capability disappears mid-run, the node routes to human review (awaiting_human), so the run neither fails open nor aborts silently.
Budgets and circuit breakers. A per-agent token budget stops a run at its limit. A pipeline circuit breaker trips when rolling monthly spend crosses its threshold and pauses that pipeline's triggers until an admin resets it, while every other pipeline keeps running.
Compensation. When a guardrail blocks a run after earlier nodes have already acted, connectors that support it undo their side effects: the GitHub connector closes the pull request, and the Linear connector unassigns or archives the issue.
Org-wide pause. An admin-only trigger pause stops new runs across the organization, and every toggle writes an audit event.

The six phases, mapped

Gartner's roadmap runs in six phases, from read-only agents through supervised execution to bounded autonomy and multi-agent coordination. The table shows where each phase's controls land in Modulo today.

Gartner phase	Modulo today
1. Situational awareness and strategic alignment	Guardrail policy as versioned, PR-gated YAML; `modulo apply` for declarative configuration
2. Foundational visibility and read-only agents	`capability_scope` connector and tool allowlists; MCP tool-scope checks; the immutable audit log
3. Risk-tiered HITL and supervised execution	Atomic HITL gates, `human_only` review, team-scoped claims
4. Bounded autonomy and closed-loop remediation	Deterministic gates, autonomy levels, per-run cost tracking, circuit breakers, correction runs
5. Scaled multi-agent coordination	Pipelines as explicit graphs with router nodes; lifecycle maps across SDLC stages
6. Continuous policy adaptation	Immutable feedback records attached to correction runs; reviewed guardrail changes