Yes for the rules, no for the evidence. The bounds an agent must meet, such as role scope, limits, approvals and the record, should be identical whichever model sits underneath, because they are enforced at the action, not inside the model. But each agent must prove itself on its own model. Evidence earned on one model does not transfer to another.
Why should the rules be the same?
Your business has one refund policy, one approval matrix and one set of customers. It would be odd for a refund to be allowed when one model proposes it and refused when another does. Rules that vary by model also make audits harder: the auditor has to learn several control designs instead of one.
So govern at the layer every agent passes through: the moment it tries to act. The model proposes; the platform checks the proposal against the same bounds regardless of where it came from. That is the principle in govern the action, not the model.
Why can't the evidence be the same?
Models differ in what they get right and wrong. One may handle long contracts well and miscount line items. Another may be the reverse. An agent's test results describe the combination of brief, sources, bounds and model. Change the model and you have a different agent, even if nothing else moved.
This is also why a single "autonomy level" per agent or per vendor falls short. It describes a setting, not proof. Our answer on whether autonomy levels are the right way to govern AI agents explains the gap.
Who decides, where is it enforced, and what is recorded?
| Element | Same across models? | Who decides | Where enforced | What is recorded |
|---|---|---|---|---|
| Role scope | Yes | Process owner | Platform, at each action | Scope version in each verdict |
| Customer limits | Yes | Process owner | Platform, at each action | Limit that applied |
| Approval routes | Yes | Process owner, risk | Platform routing | Approver and decision |
| Platform floor | Yes | Platform | Platform | Withheld verdicts |
| Test evidence | No, per model | Process owner signs off | Certification | Results by model version |
| Depth granted | No, per model | Follows the evidence | Platform, at each action | Depth and certificate in force |
The model and its version should appear in every filed verdict. Without it, you cannot tell later which model produced a decision under review.
A worked example
Take an insurer running two claims agents: one on a large general-purpose model for complex correspondence, one on a smaller, cheaper model for first notification of loss. Both follow the same claims bounds: no payments, no coverage decisions, reserve changes held for a handler above 5,000.
Testing on the insurer's own claims shows the smaller model extracts dates and policy numbers well but misses exclusions in long policy wordings. Its agent is certified at depth 3 for logging claims and depth 1 for policy interpretation. The larger model's agent earns depth 2 for drafting coverage summaries. Same rules, different depth, because the evidence differs.
When the insurer later moves the first agent to a newer model, the bounds stay as they are and the agent is tested again before it keeps its depth.
What about agents from vendors on models you don't control?
Apply the same rules at your action layer, and ask the vendor to tell you which model the agent uses and when it changes. If they will not, treat every vendor release as a model change and retest. Our answer on how to govern AI agents supplied by vendors covers the contract terms.
Which controls make the answer hold?
- One action layer. Every agent, on every model, passes through the same checks.
- Model recorded in the verdict. So decisions can be tied to the model that made them.
- Certification per agent and model. A model change triggers retesting.
- Board oversight of authority, not technology. Directors should see what each agent may do and on what evidence, not which model it uses; see boards should govern agent authority, not agent technology.
- A management framework. The NIST AI RMF Govern function for AI agents helps structure the policies above the controls.
The topic guide, agent governance is a bound, not a model, sets out why the bound is the unit of control.
Questions people ask
Do some models need tighter rules than others?
The rules stay the same; the depth differs. A weaker model earns less depth on the same evidence, which has the effect of tighter control without a separate rulebook.
Can one agent use several models?
Yes, for different steps. Record which model handled each step, and test the agent as a whole on your cases, since the combination is what acts.
Does open-weight versus hosted change the answer?
It changes who controls updates and where data goes, which matters for security and privacy reviews. It does not change the action-level rules.