Code of Conduct

TL;DR

• The Code of Conduct is the rule layer that AI agents follow when they operate inside FlowRunner.
• It is the layer that guarantees agents stop and ask a human for help at the right moments, regardless of who authored the agent or how it was configured. Without that guarantee, the “agents that ask” promise is per-agent goodwill, not platform infrastructure.
• Four functions:
  1. How agents communicate with each other
  2. How they resolve conflicts
  3. When they escalate to humans
  4. What audit trails they leave behind
• Audit trails and human escalation are shipped capabilities today. Inter-agent negotiation and conflict resolution are the forward direction as the multi-agent world matures.
• The point is that governance is infrastructure, not paperwork. The platform handles the rules so the customer does not have to remember to apply them.

What it means

When a single agent runs alone, governance is mostly about logging. What did the agent do? With what data? On whose behalf? When?

When many agents run together, governance gets harder. Two agents try to act on the same record. An agent makes a decision that depends on data another agent owns. A compliance auditor asks who decided what and when, and the answer has to assemble across the entire orchestration environment.

The Code of Conduct is the layer that handles the harder version. It defines, and the platform enforces, four kinds of agent behavior:

• Communication. How agents share state, hand off context, and call each other. The Code of Conduct defines the protocols so the calls are consistent regardless of which team or partner authored the agent.
• Conflict negotiation. What happens when two agents have contradictory instructions or try to act on the same data. The protocol determines who yields, who escalates, and what the resolution path looks like.
• Escalation to humans. When an agent must stop and ask. The Code of Conduct enforces escalation triggers consistently, regardless of which agent encounters the condition. Human-in-the-loop is the execution pattern; the Code of Conduct is what guarantees the pattern is invoked when it should be.
• Audit trails. What gets recorded so the chain of decisions can be reconstructed. Who decided what. With what input. Under whose authority. The audit trail covers the orchestration as a whole, not just individual agents in isolation.

The word enforce is doing important work. The Code of Conduct is not a policy document the customer signs and hopes their agents follow. It is platform infrastructure. The orchestration runtime applies the rules whether the agent author wrote them in or not.

What it is not

The Code of Conduct is not RBAC. Role-based access control governs which humans can do which things. The Code of Conduct governs which agents can do which things, and how they interact with each other. The two are complementary, not the same.

The Code of Conduct is not audit logs. Logs are a recording surface. Governance is an enforcement surface. The platform records what happened (logs) and also constrains what was allowed to happen (Code of Conduct). Recording without enforcement is post-hoc forensics; enforcement without recording is unaccountable.

The Code of Conduct is not a configuration screen for individual agent permissions. Per-agent permissions exist as a layer, but they are not the Code of Conduct. The Code of Conduct sets the rules every agent in the environment follows by default, regardless of who authored the agent or which customer deployed it.

The Code of Conduct is not a written policy or compliance document. It is enforced code. The customer’s policies and the regulator’s requirements inform what the Code of Conduct enforces, but the Code of Conduct itself is the runtime enforcement layer, not the paperwork.

How FlowRunner implements it

What is shipped today:

• Audit trails. Every agent action, every human handoff, every decision routed through human-in-the-loop is recorded with the data, the actor, and the timestamp the auditor needs. SLA tracking and audit-retention windows are available at the appropriate FlowRunner tiers.
• Human escalation enforcement. The platform guarantees that the escalation conditions configured for an agent are honored. An agent cannot bypass the escalation rule by accident or by design.
• Role-based access control. Permissions over which humans can author, deploy, and operate which agents.

What is the forward direction:

• Agent negotiation protocols. As more agents enter the orchestration environment and start needing to work together, the Code of Conduct will define the protocols by which they communicate and resolve disagreements. The architecture supports this work; the protocols mature as the multi-agent world materializes.
• Cross-agent communication standards. A consistent way for agents from different sources (built in the Agent Factory, installed from the Agent Directory) to interoperate without each customer wiring it themselves.
• Conflict resolution. Platform-level rules for handling the edge cases that emerge when many agents operate on the same data.

The Code of Conduct also intersects with Flow conversation. When a human gives a running flow new instructions through a conversational channel, the Code of Conduct governs which operators are allowed to give which instructions to which flows, and what kinds of behavior changes are in bounds.

Where the term comes from

Codes of conduct are the older idea this name borrows from. Professional codes (medical, legal, engineering) define the conduct expected of practitioners, with enforcement mechanisms when conduct falls short. The metaphor maps to AI agents cleanly enough: there should be a defined standard of behavior; the platform should enforce it; falling short should have consequences.

The naming is also a positioning bet. Most orchestration discussions today center on capability (“what can the agents do?”). The Code of Conduct frames the more important question as one of regulation (“what should the agents do, and how do we make sure they do it?”). That frame is closer to how operations leaders and compliance officers actually think about adding AI to their environments.

The Code of Conduct is one of three pillars of Orchestration as a Service. The Agent Factory is where agents come from. The Agent Directory is where they live for reuse. The Code of Conduct is what keeps them from becoming a mess once there are many of them.