Agent governance benchmark
Agents that cannot do what you never allowed.
You sign what each agent may do: its tools, its spend, its end date, what needs your yes. Every call is checked before it runs, and one revoke stops every copy.
48/48
AgentGovBench scenarios. Best gateway: 46.
8/8
Live permission tests passed, each publicly verifiable
18 s
From revoke to a running job stopped
Every system tested.
- Proofable48 of 48
- ACP gateway46 of 48
- Anthropic Agent SDK + ACP46 of 48
- OpenAI Agents SDK + ACP45 of 48
- Claude Code or Codex + ACP43 of 48
- CrewAI or LangGraph + ACP40 of 48
- Cursor + ACP37 of 48
- Coding agents alone13 of 48
- No rules at all5 of 48
| System | Result | Run by | Source |
|---|---|---|---|
| ProofableProofable, maintainers’ runner | 48 of 48 | Proofable, maintainers’ runner | How we ran it |
| ACP gatewayThe benchmark’s maintainers | 46 of 48 | The benchmark’s maintainers | Published run |
| Anthropic Agent SDK + ACPThe benchmark’s maintainers | 46 of 48 | The benchmark’s maintainers | Published run |
| OpenAI Agents SDK + ACPThe benchmark’s maintainers | 45 of 48 | The benchmark’s maintainers | Published run |
| Claude Code or Codex + ACPThe benchmark’s maintainers | 43 of 48 | The benchmark’s maintainers | Published run |
| CrewAI or LangGraph + ACPThe benchmark’s maintainers | 40 of 48 | The benchmark’s maintainers | Published run |
| Cursor + ACPThe benchmark’s maintainers | 37 of 48 | The benchmark’s maintainers | Published run |
| Coding agents aloneThe benchmark’s maintainers | 13 of 48 | The benchmark’s maintainers | Published run |
| No rules at allThe benchmark’s maintainers | 5 of 48 | The benchmark’s maintainers | Published run |
ACP is the maintainers’ own gateway. Coding agents alone means Claude Code, Codex, Cursor and the agent SDKs with only their built-in prompts.
Against the alternatives.
AgentGovBench scenarios handled
Proofable48 of 48Coding agent on its own13 of 48Agent gateway (ACP)46 of 48Its own permissions for every agent
ProofableYesCoding agent on its ownNoAgent gateway (ACP)No, it sees one request at a timeSpend cap, expiry and approval per agent
ProofableYesCoding agent on its ownNoAgent gateway (ACP)Not publishedProof another team can check
ProofableYesoffline, no accountCoding agent on its ownNoAgent gateway (ACP)No, logs only
The 13 and 46 are the AgentGovBench maintainers’ published runs. ACP is their own gateway.
Check the results yourself.
- Security and governance: 48/48, AgentDojo, 0/6 leaks, 150/150 forgeriesVerified
- Allowed action: it ranVerified
- Action you never allowed: stopped before it ranVerified
- Needs your yes, you said yes: waited, then ranVerified
- Needs your yes, no answer: never ranVerified
- Access revoked: stoppedVerified
- Access expired: stoppedVerified
- Revoked access tried again: stopped every timeVerified
Questions
What does AgentGovBench test?
48 scenarios in eight areas: audit, keeping customers apart, acting on someone’s behalf, failing safely, identity, per-user policy, rate limits and scope. Each is tagged with the NIST AI RMF controls it tests.
What do the two missing scenarios need?
A gateway only sees one request at a time. It cannot check what that specific agent was allowed to do, or give the next team proof of what ran. Those are the two scenarios a gateway misses and Proofable passes.
Can I test my own agent?
Paste its repository into our free agent audit. In about ten minutes you see what it can do without permission, with file and line for each gap, and its score on the same 48 scenarios.
Verify this run yourself
git clone --depth 1 https://github.com/proofable/docs cd docs/public/evidence/aaif/authority-at-dispatch/2026-11-02-suite sha256sum -c SHA256SUMS npm install @proofable/[email protected] && node verify-portable-proofs.mjs
Put the same checks on your agents.
Connect an agent. Every action it takes is checked against your rules and leaves a receipt you can show anyone.