OpenAI

Trust & Governance Plane

OpenAI agent·gpt-4o
Connected
T3 · Admin API
Aggregate·Sentry pulls usage and audit records from the vendor's admin API.

Logs every agent action, keeps it forensically separable from human actions, and human-gates mutations.

Performance by version

Avg latency
2.4s−8%
Tokens / wk
540k−10%
Cost / wk
$81−10%
Quality
98%
Success
99.2%+0%

v3 · Memoise + batch · Jun 2026 – Memoise identity lookups; batch low-risk approvals (deltas vs v2)

Objectives & ROI

Ungated mutationsMet
0goal 0
Audit coverageMet
100%goal 100%
Agents ready for L3On track
1goal 3
SLA-penalty breachesMet
$0goal $0

Data flow

Dashed tiles are the markdown / JSON context we author around the harness.

Integration logic – MD files

  • MDmutation-audit.md

    Separate agent vs human mutations and flag any missing a gate

    Audit logServiceNow
  • MDpolicy-gate.md

    Evaluate an action against policy and route the approval

    OPAServiceNow
  • MDidentity-resolution.md

    Resolve the acting principal for every logged action

    OktaAudit log
  • MDsiem-anomaly-scan.md

    Scan security events for anomalous agent behaviour

    Splunk
  • MDautonomy-promotion.md

    Check the criteria to promote an agent from L2 to L3

    OPA

Harness

Owned IP

The model is rented and swappable. This is the part we own and port: the MCP tools, the markdown / JSON context wrapped around them, and the systems they connect.

OpenAIRuns in its own harnessOpenAI Assistants APIConfigured & maintainedClient OpenAI org · Sentry-managed assistantSentry registers & governs it – it is not rebuilt here.
MCP tools5
  • audit_log_write

    Append every agent & human action

  • servicenow_approval

    Create & route human-approval requests

  • splunk_query

    Query Splunk security events

  • opa_eval

    Evaluate an action against OPA policy

  • okta_lookup

    Resolve the acting principal via Okta

Context files3
  • MDgovernance/audit-rules.md

    What is logged & how actors are separated

  • JSONgovernance/gates.json

    Which actions require a human gate

  • MDgovernance/policies.md

    Criteria to promote autonomy L2 → L3

Connected systems5
Audit logServiceNowSplunk SIEMOPAOkta

Access & scope

Who accesses it
  • Compliance teamvia Dashboard
  • Every other agentvia MCP (logging)
Auth
Privileged service identity; append-only, signed audit trail
Data scope
Writes audit; reads actions across agents; gates mutations
Model – rented & swappable
gpt-4olivegpt-4o-miniclaude-sonnet-4-6open-weight

Swap freely – the harness above doesn't change.