The part of AI agent governance I kept getting stuck on

When I started building NullRun, I thought the main problem was controlling what an AI agent can do. After working on it for months, I think the harder problem is who actually has the authority to decide whether an action runs.

An agent can decide:

“I should refund this customer.”

But should the agent itself be the final authority to execute the refund?

Or:

“I should delete this database record.”

“I should deploy this change.”

“I should call this external API.”

The agent can request the action. The application can expose the tool.
But neither should automatically mean the action is authorized.

That's the gap I'm trying to solve with NullRun.
The agent sends an execution request to NullRun, and an external policy layer makes the runtime decision:

• allow -> execute

• require approval -> wait for a human decision

• block -> don't execute

The important part is that the policy isn't just sitting in documentation or in a dashboard.
It is enforced at the point where the action is about to happen.

This also changes how I think about “AI governance”.
A lot of governance work is about policies, monitoring, logs, evaluations, and compliance evidence.

Those are useful.
But eventually you still need an answer to a very simple runtime question:

“Should this specific action execute right now?”
That's what I'm building toward with NullRun: an enforcement layer between AI agents and production systems.

I'm curious how other teams handle this today.

If your agent can call production tools, where does the final execution authority actually live?

Inside the agent?
Inside application code?
In middleware?
Or somewhere else?