VOCE AI Governance Institute · Europe 2026 · v1.0

Give your agents the means to act. Keep control.

Define the tasks your AI agents can perform, the data they can access and the decisions that remain yours. The VOCE reference connects those choices to a concrete architecture, helping you prepare a controlled deployment that can evolve.

Choose the level of autonomy →

Understand with a diagram

Open architectureVendor-neutralMachine-readableEuropean regulatory overlay5 October 2026

Machine-readable reference → · Agent Conformance →

Eight principles before the first agent acts.

Identity before action

Every executing agent or workload receives an attributable identity distinct from the human, model or service that initiated it.

Least authority

Tools, data scopes and transaction limits are granted per task and remain revocable.

Contracted interfaces

APIs and inter-agent messages are typed, versioned, validated and observable.

Traceable delegation

The institution can reconstruct who delegated which authority, to which agent, for what purpose and duration.

Observable execution

Model calls, retrieval, tool use, handoffs, approvals, failures, costs and actions form one traceable execution record.

Human authority

Material workflows identify an accountable owner, escalation path and executable stop mechanism.

Reversibility

A model, tool or supplier can be restricted or replaced without rebuilding the institution around it.

Regulatory mapping

European obligations are applied to the actual role, sector and risk classification of the system.

The ten-layer agent control stack.

API and tool contracts

OpenAPI 3.2.x and JSON Schema make capabilities explicit. Material write operations define schema, errors, idempotency, versioning, rate limits and transaction ceilings.

MCP

MCP 2026-07-28 provides the model-to-tool and context layer. Its stateless core improves ordinary HTTP scaling; authorization remains an institutional control, never a side effect of interoperability.

A2A

A2A 1.0 handles agent-to-agent discovery and task exchange across vendors. AgentCards, handoffs, cancellation, provenance and cross-agent data policy become governance objects.

Workload identity

SPIFFE/SPIRE can give software actors short-lived cryptographic identities. Human identity and software identity remain distinguishable throughout delegation.

Authorization

OAuth security practice plus policy-as-code separates authentication from permission. The decision is explicit: principal, action, resource and context, with default deny and step-up approval.

Data, memory and RAG

Provenance, version, access rights, deletion, retention, memory expiry and regional routing follow information from source system through retrieval and agent memory.

Observability and audit

OpenTelemetry-style traces record agent, workflow, model, retrieval, tool calls, approvals, latency, cost and exceptions while keeping sensitive content under a separate telemetry policy.

Continuous assurance

Task evaluation, permission tests, prompt-injection tests, red teaming, regression, incident replay and tested kill switches follow every material system change.

Economic authority

Budget is a permission. Institutions govern cost per completed task, retry budgets, model routing, anomaly thresholds and supplier concentration.

European regulatory overlay

AI Act, GDPR, DORA and NIS2 are mapped only where the organisation, use case and legal role make them applicable. Compliance evidence is attached to the system architecture.

Five operating levels, five different control burdens.

A0 · Assistant

Generation or retrieval without external action authority. Minimum: session identity, data boundary, source provenance and output review.

A1 · Tool-connected agent

Approved read or low-impact tools. Add tool inventory, per-tool authorization, traces, limits and revocation.

A2 · Delegated action agent

Business actions under bounded authority. Add workload identity, policy decision point, transaction limits, approval gates, idempotency and rollback.

A3 · Multi-agent operating system

Agents coordinate models and tools across systems. Add MCP/A2A governance, delegation chain, shared observability, routing policy and continuous evaluation.

A4 · Critical agent network

Material regulated, financial, clinical, infrastructure or public-service consequences. Add board owner, independent assurance, incident exercises, exit plan, evidence pack and tested emergency stop.

Europe changes the evidence burden.

The EU AI Act does not turn every agent into a high-risk system. It does make role and classification explicit. For systems that fall within high-risk obligations, the legal architecture includes logging, transparency to deployers, human oversight and deployer duties. Article 50 transparency obligations have applied since 2 August 2026 for relevant interactive and generative systems. GPAI provider obligations have applied since 2 August 2025, with Commission enforcement powers applying from 2 August 2026.

Sector overlays remain decisive. A financial institution subject to DORA remains responsible for ICT third-party risk even when an agent, cloud provider or model vendor performs the technical work. Critical and important functions therefore require dependency registers, contractual controls, resilience and exit thinking alongside AI governance.

RoleProvider, deployer, importer, distributor, GPAI provider or downstream integrator?

RiskProhibited, high-risk, transparency-regulated, GPAI or other use?

SectorFinancial services, healthcare, employment, public services, critical infrastructure or general enterprise?

EvidenceWhich logs, instructions, tests, human-oversight records, supplier records and incidents must be retained?

The board should be able to ask for one evidence pack.

01Agent, model and tool inventory.

02Identity and delegation map.

03Permission and transaction-limit matrix.

04API, MCP and A2A contract inventory.

05Data, memory and residency map.

06Human approval, escalation and stop map.

07Observability and audit schema.

08Evaluation, red-team and regression results.

09Supplier, version and concentration register.

10Cost-per-task and budget controls.

11EU regulatory role and applicability memo.

12Kill-switch, rollback and exit test evidence.

Primary technical and European references.

Model Context Protocol · 2026-07-28 specification↗ A2A Protocol · 1.0 specification↗ SPIFFE · workload identity standard↗ IETF · RFC 9700 OAuth 2.0 Security BCP↗ OpenAPI Initiative · OpenAPI Specification↗ OpenTelemetry · semantic conventions↗ European Union · AI Act consolidated text↗ European Commission · Article 50 transparency guidelines↗ European Commission · GPAI provider guidelines↗ European Union · DORA↗

VOCE Agent Infrastructure Reference is a VOCE public reference architecture. It is not an EU harmonised standard, legal opinion, certification scheme or substitute for sector-specific professional review.

VOCE · Orchestration

The score is written before the orchestra accelerates.

Agentic systems distribute execution across models, APIs, identities and institutions. VOCE treats the architecture as a score: each actor keeps a defined register, entrance, authority and stop condition. The purpose is not aesthetic. It is operational accountability.

Return to AI Governance