AWS Executive in Residence Matthias Patzak: AI Agent Governance Should Be Built at the Platform Layer, Not Fed to Models as Context
Based on his consulting experience serving clients in industries such as automotive and banking, AWS Executive in Residence Matthias Patzak argues that providing governance documents as context to AI agents is not best practice; instead, enterprises should build governance as platform infrastructure for agent deployment, where the platform sets boundaries and an orchestrating agent supervises multi-agent collaboration.
In a recent interview with AI Business, AWS Executive in Residence Matthias Patzak offered a specific architectural judgment on enterprise AI agent governance: feeding governance rules to models as document context is not best practice; the truly effective approach is to build governance at the platform layer as infrastructure for agent deployment. This distinction stems from his practical consulting experience serving clients in the automotive, banking, and other industries.
Patzak observed that organizations with vague governance rules also have poor AI agent governance. He noted a counterintuitive phenomenon: the financial services industry is actually the most mature in scaling AI, precisely because it has extensive written-down governance rules. These rules can be provided directly to agents as context—but Patzak explicitly stated this is not best practice. While agents do need to know which rules they must follow, the correct approach is to treat governance as infrastructure, a container for agent deployment, setting boundaries at the platform level rather than relying on document snippets within context windows. He considers manufacturing, automotive, and financial services companies to be the most mature in agent governance today.
At the level of multi-agent collaboration, Patzak believes the current best practice is to deploy an orchestration agent to supervise the overall process. He explained that one cannot assume a single agent will never make mistakes; therefore, second and third agents are needed to take on different roles. Role-specific agents require deep expertise but have limited context windows, necessitating an orchestration agent to coordinate the big picture. However, he emphasized that this architecture is currently built by organizations and developers as independent software components and has not yet formed a mature product.