The CASE Framework: A Multi-Disciplinary Control Architecture for Governing Enterprise Agentic AI

The CASE Framework: A Multi-Disciplinary Control Architecture for Governing Enterprise Agentic AI

Summary

This paper argues that the governance of enterprise agentic AI is not a single problem but four distinct problems, each requiring a different governing science. The authors propose the CASE framework, which assigns a specific discipline to each scale of agency: Control theory for the individual agent, complex Adaptive systems theory for agent collectives, Supervisory cybernetics for human-agent teams, and Engineering operations for automated fleets.

The paper's central claim is that each scale of agency already has a governing science, developed and hardened over decades in other domains. The authors argue that current governance approaches fail because they stretch a single discipline—typically DevSecOps built for deterministic automation—across all scales of agency, which is a category confusion between automation and agency. Classical automation's behavior is enumerable at design time, so certifying the artifact certifies the behavior. However, agents are stochastic policies over open action spaces, so certifying the artifact no longer certifies the behavior.

The framework formalizes each layer with specific equations and conditions. For Layer 1 (Control theory), the agent is modeled as a discrete-time controlled system with observability, controllability, and stability as governance requirements. For Layer 2 (Complex adaptive systems), collective risk decomposes into individual risks plus interaction terms, with the branching factor k as the operative control variable (design target: k < 1). For Layer 3 (Supervisory cybernetics), the Law of Requisite Variety is formalized as an inequality: Vhuman × G ≥ Vagents, where G is engineered amplification gain. For Layer 4 (Engineering operations), error budgets are extended from availability to decision quality, with autonomy itself becoming a controlled variable modulated by remaining budget.

A key contribution is the derivation of cross-layer coupling conditions, including the zero-touch deployment paradox: The better an organization's Layer 4, the faster it outruns a static Layer 3: deployment excellence mechanically manufactures the variety that oversight must absorb. The paper also provides a mechanism inventory tracing more than twenty enterprise controls to their classical constructs, such as receding-horizon planning to model predictive control, context trimming to anti-windup compensation, and escalation bypass to Beer's algedonic channel.

The paper presents three empirical studies validating the framework. Study 1 analyzes 62 documented agentic AI failures and finds that 82% are multi-layer trajectories, with the coupling running downward from the control layer. Study 2 codes 22 agent-operations tools and finds that none offers full Layer 2 (emergence) coverage, with only 14% offering even partial coverage. Study 3 scores 35 public enterprise deployments and finds all fall in the lowest maturity band (L0), with a universal zero at Layer 2. The authors name this mismatch—risk realized at the emergence layer against capability barely offered and practice absent—the Emergence Gap.

The paper introduces a five-level maturity model with a non-compensatory bottleneck-weighted index: MCASE = α·mmin + (1−α)·m̄, with α = 0.6. This design ensures that an organization with a missing layer cannot score beyond the low end of the L1 band. The instrument yields a capital allocation rule: fund the binding layer first, because only that investment moves the minimum term.

The paper concludes with strategic implications. For executives, it converts governance into an engineering program with a capital allocation rule. For regulators, it operationalizes EU AI Act Article 14 requirements: an organization that cannot exhibit its variety budget and amplification chain cannot demonstrate effective oversight, whatever its committee structure. The authors state: We have eighty years of science for governing autonomous systems. The work of this decade is not to invent its replacement but to operationalize it, layer by layer, at the scale agentic AI now demands.

Improvements to AI Systems Based on the CASE Framework

1. Add a Layer-2 Emergence Governor to Multi-Agent Orchestrators

• Improvement: Implement a runtime monitor that tracks the branching factor k (number of new tasks/agents spawned per decision) and caps it below 1.0 via dynamic throttling, task merging, or rollback.

• Capability: The AI system can prevent runaway collective behavior (e.g., cascading tool calls, recursive sub-agent spawning) before it causes system-wide failure, even when individual agents are functioning correctly.

2. Build a Variety Budget Dashboard for Human Oversight

• Improvement: Instrument the agent stack to compute Vagents (state/action variety per time window) and display it against Vhuman × G (human capacity times amplification gain). When the inequality fails, the system automatically escalates to a human with pre-computed context summaries and suggested interventions.

• Capability: The AI system can self-identify when it is outrunning human oversight and proactively request help, rather than silently operating beyond supervisory capacity.

3. Introduce a Decision-Quality Error Budget (DQEB) Controller

• Improvement: Extend SRE-style error budgets to include decision accuracy, calibration, and safety-critical misclassification rates. The system modulates its own autonomy level (e.g., from full autonomy to human-in-the-loop) based on remaining DQEB, similar to how a cruise control adjusts speed on a slope.

• Capability: The AI can degrade gracefully under uncertainty or data drift—reducing its own action space or requiring confirmation—before it exhausts its allowable error margin.

4. Implement Cross-Layer Coupling Alarms

• Improvement: Add a monitor that detects when Layer 4 (deployment/ops) speed exceeds Layer 3 (oversight) absorption rate. When the zero-touch deployment paradox condition is detected (e.g., release frequency > oversight review rate), the system automatically inserts a human approval gate or slows deployment cadence.

• Capability: The AI system prevents the mechanical manufacturing of ungovernable variety—stopping the loop where faster ops outpaces oversight, which is the root cause of 82% of documented failures.

5. Add a Non-Compensatory Maturity Self-Assessment

• Improvement: Embed a lightweight, runtime-accessible version of the M CASE index (with α=0.6) that scores the current deployment across all four layers. If any layer scores below a threshold, the system refuses to expand its action space or accept new tasks.

• Capability: The AI can refuse to operate in a mode where a critical governance layer is missing (e.g., no emergence monitoring), preventing the Emergence Gap where risk is realized at Layer 2 but capability is absent.

6. Enable Receding-Horizon Governance (MPC for Oversight)

• Improvement: Replace static policy checks with a model predictive control loop that forecasts the next N steps of agent behavior, evaluates them against Layer 1–4 constraints (stability, variety, error budget), and pre-emptively adjusts the agent's objective function or action constraints.

• Capability: The AI can anticipate and prevent violations (e.g., a planned sequence of actions that would exceed the variety budget or destabilize a collective) rather than reacting after the fact.

7. Add an Algedonic Channel for Emergency Escalation

• Improvement: Implement a high-priority, low-latency signal path (analogous to Beer's algedonic channel) that bypasses normal logging and review queues when a Layer 2 or Layer 3 threshold is breached. This channel triggers immediate human intervention with a pre-formatted incident summary.

• Capability: The AI can trigger urgent human attention for emergent, non-obvious failures (e.g., subtle interaction effects between agents) that would otherwise be buried in standard telemetry.

8. Support Anti-Windup for Context Trimming

• Improvement: Apply anti-windup compensation from control theory to the agent's context window. When context grows beyond a setpoint, the system actively discards or compresses low-information tokens—not just truncating, but using a model of what matters for the current objective to avoid over-correction or memory saturation.

• Capability: The AI maintains stable decision-making under long-horizon tasks without performance degradation from context bloat, mirroring how control systems avoid integrator windup.

What the Improved AI System Can Do:

• Operate safely in open, stochastic environments without requiring exhaustive pre-certification.

• Self-regulate its own autonomy based on real-time governance metrics (variety, error budget, emergence risk).

• Prevent cascading failures in multi-agent collectives by capping branching and detecting interaction risks.

• Provide regulators and executives with an auditable, quantitative proof of oversight (variety budget, amplification chain) rather than static policy documents.

• Gracefully degrade or halt when any governance layer is missing, avoiding the Emergence Gap that currently plagues enterprise deployments.

Enterprises are deploying autonomous AI agents faster than they can govern them, and prevailing approaches stretch a single discipline, typically DevSecOps built for deterministic automation, across every scale of agency. We argue that agentic AI governance is four problems, not one, each with a mature governing science. The CASE framework assigns Control theory to the individual agent (intent as setpoint, guardrails as feedback, evaluation as observation), complex Adaptive systems theory to agent collectives (where emergence makes single-agent assurance non-compositional), Supervisory cybernetics to human-agent teams (where the Law of Requisite Variety shows unaided human oversight fails structurally), and Engineering operations to fleets (extending error budgets to decision quality so autonomy becomes a controlled variable). We formalize each layer, derive cross-layer coupling conditions, including a zero-touch deployment paradox where excellence at one-layer strains the others, and trace twenty-plus enterprise controls to their classical constructs. Three empirical studies validate the thesis: 82 percent of documented production agent failures are multi-layer trajectories; none of 22 ecosystem tools offers full Layer 2 (emergence) coverage; and all 35 scored public deployments fall in the lowest maturity band. We name this mismatch, risk realized at the emergence layer against capability barely offered and practice absent, the Emergence Gap. A five-level maturity model with a non-compensatory bottleneck-weighted index and assessment instrument operationalizes CASE as a scientific rather than process maturity model, grounded in production enterprise agentic platforms. As EU AI Act Article 14 makes effective human oversight a legal requirement, only architectures satisfying requisite variety can make oversight real rather than ceremonial.