The agent is no longer just an application.
Once an AI agent can act across business systems, it starts to look less like a feature and more like a worker. It needs a job description. It needs a manager. It needs scoped credentials. It needs an audit history that survives model changes, vendor changes, and employee turnover.
The old control surface was a software inventory. The new one is a workforce roster. That is the shift ARX is built around.
It binds identity, access, supervision, evaluation, records, and termination into one governance layer before agents touch production systems.
Five primitives make agents accountable.
Every governed agent starts with onboarding: a named role, owner, manager, purpose, allowed systems, and acceptable actions. Supervision then enforces policy at runtime instead of relying on the agent to remember policy inside its prompt.
Evaluation compares behavior to the declared job. Records preserve what happened, why it happened, who approved it, and which credentials were used. Termination ends access, halts runtime, and seals the personnel record.
The buyer is not only security.
CISOs need proof that agents cannot quietly accumulate access. CEOs, CHROs, and CFOs need confidence that digital labor can be scaled without inventing a shadow workforce. Procurement needs a review packet that explains how the agent is hired, supervised, and removed.
That is why ARX speaks in operating terms. Security evidence matters because it validates the operating model.