SHRIKEObservability vs action governance
Observability records what an AI agent did: logs, traces, dashboards and alerts assembled after each step completes. Action governance decides what an agent may do, in the path of the action, before it runs. The two answer different questions at different moments, and a record cannot refuse an action that has already executed.
In control terms the difference is detective versus preventive, and the useful test is not how fast you find out but whether finding out changes the outcome. A file write inside a tracked repository is well served by a record, because the record plus version history is a real undo. A credential that has left the host is disclosed from the moment it left, and no alerting speed undoes that. Sorting actions by whether they can be undone is what decides which ones need a decision beforehand rather than a description afterwards.
A second property is easy to miss. A monitoring layer is only trustworthy while an absence of entries means an absence of events, and a control that stops working also stops producing them, so a broken recording path and a quiet week look identical. Recording permitted actions as well as refused ones is what makes that difference visible. The two layers compose rather than compete: a decision, carrying the control that made it and the reason, is better input to an audit log than raw output is.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Watch an agent get refused in the playground, where every tool call is scanned for real, or read what is action governance.