Maureen Doyle-Spare is an enterprise governance architect and independent researcher in AI governance at Doyle-Spare Research. Her work focuses on the governance of autonomous and multi-agent AI systems, particularly the runtime reasoning layer where agents resolve operational meaning before acting.

She originated a connected body of agentic AI governance research spanning the Semantic Control Plane (SCP), Semantic Deviation Index (SDI), Agentic Workflow Drift (AWD), Agentic Workflow Subversion (AWS), the Agentic 3 C's Framework, and the Semantic Layer Integrity Attack (SLIA) threat class.

Her research develops a pre-execution governance architecture for autonomous systems, combining deterministic runtime measurement, semantic authorization, execution gating, and reconstructable evidence. The work extends from enterprise governance architecture into cybersecurity, life sciences, systemic risk, runtime assurance, and the economics of autonomous execution.

Alongside the conceptual research, Doyle-Spare has developed executable specifications and a working Python implementation of the Semantic Deviation Index, translating reasoning-layer governance from research architecture into an implementable control model.

Her research has also informed a continuing body of practitioner submissions to NIST initiatives concerning AI risk management, agent identity and authorization, AI evaluation, critical infrastructure, and the governance of autonomous systems.

Agentic AI introduces a governance problem that is distinct from traditional model risk.

A model can perform correctly while an autonomous system acts on operational meaning that no institution authorized. In fragmented enterprise environments, agents must resolve definitions, policies, context, and system state before they can act. That resolution occurs at the reasoning layer.

Doyle-Spare's research moves governance to that point.

The architecture establishes an authorized Reasoning Baseline, captures the agent's Runtime Semantic State, measures Runtime Semantic Divergence (RSD) through the Semantic Deviation Index, and applies a Deterministic Gate before execution authority is emitted.

The objective is not simply to evaluate whether an AI system produced an acceptable output. It is to establish whether the meaning under which the system exercised authority remained within what the institution authorized.

This creates a distinct runtime control surface between interpretation and execution.

• Agentic AI Systems Governance: A Runtime Reference Architecture for the Reasoning Layer and the Semantic Control Plane — the capstone reference architecture.
• The Semantic Deviation Index (SDI): A Runtime Measurement Standard for the Governance of Agentic AI — deterministic runtime measurement of semantic divergence.
• The Agentic 3 C's Framework — Context, Control, and Coordination for autonomous systems governance.
• Agentic Workflow Drift and Agentic Workflow Subversion — the foundational reasoning-layer risk taxonomy.
• Agentic AI Cyber Subversion: The Semantic Layer Integrity Attack as a New Threat Class Against the Reasoning Layer — reasoning-layer cybersecurity and semantic integrity.
• Agentic Workflow Drift in Life Sciences: Extending the Reasoning-Layer Risk Taxonomy to GxP-Regulated Pharmaceutical and Biotechnology Operations — application of the taxonomy to GxP environments.
• The Economics of Agentic AI: Runtime Governance as a Distinct Determinant of Enterprise AI Cost — Preventable Computation, Token Liability, Economic Blast Radius, and runtime governance economics.
• Agentic AI Semantic Deviation Index: Reference Specification and Working Python Implementation — open-source specification, implementation, and conformance work. Zenodo DOI.

Doyle-Spare's research introduces a connected set of constructs for governing the reasoning layer, measuring runtime semantic divergence, establishing pre-execution authority, preserving decision evidence, controlling propagation, and quantifying the economics of autonomous execution.

• Semantic Audit Trail: the reconstructable institutional record aggregating per-decision evidence of the baseline in force, the meaning resolved, the divergence measured, and the Gate decision taken.

• Runtime Semantic State Record (RSSR): the per-execution evidence object preserving the Reasoning Baseline, Runtime Semantic State, SDI computation, Gate decision, and operational context for supervisory reconstruction.

• Verification of Runtime Semantic Resolution (V-RSR): the runtime verification activity confirming an agent's Runtime Semantic State was evaluated against the authorized Reasoning Baseline before execution authority was emitted.

• Runtime Governance Applicability Test (RGAT): the test that classifies a deployment as governable, governance-constrained, or non-governable according to whether it exposes the runtime representations governance requires.

• Runtime Semantic Divergence (RSD): the single-decision condition in which an agent's runtime interpretation departs from the authorized Reasoning Baseline.

• Adjacent Governance Surface (AGS): the Semantic Control Plane's positioning as a governance surface operating alongside model governance, information security, and workflow orchestration without replacing any of them.

• Runtime Semantic State: the evidentiary representation of the operational meaning an agent has assembled at the moment of decision, evaluated against the Reasoning Baseline.

• Reasoning Baseline: the organization's authorized definitional reference for a term, maintained under change control and resolvable at runtime.

• Operational Interpretation: the resolved meaning of a term under which an agent exercises execution authority for a specific decision.

• Pre-Execution Assurance Protocol: the five-step runtime sequence the Semantic Control Plane runs for every governed decision before execution authority is emitted, from Reasoning Baseline resolution through evidence capture.

• Semantic Authorization: the governance determination that an agent's Operational Interpretation remains within the authorized Reasoning Baseline before Authorization Emission forms execution authority.

• Preventable Computation: additional reasoning, tool use, execution, review, audit, or remediation that would not occur if an institutionally available runtime control held an unauthorized or materially divergent trajectory at the earliest governable checkpoint.

• Token Liability: the inference-cost component of Preventable Computation, representing token expenditure attributable to a trajectory a runtime control could have held before further execution.

• Economic Blast Radius: the incremental downstream cost of compute, coordination, review, audit, remediation, and latency attributable to an unauthorized interpretation after it enters execution, the economic counterpart of the Agentic Blast Radius.

• Governance Cost Stack: the taxonomy of cost domains agentic governance acts on, from inference and additional reasoning through propagation, review, audit, remediation, and cross-cutting governance latency.

• Governed Semantic Reuse: the controlled reuse of previously authorized semantic artifacts under matching runtime conditions instead of reconstructing the same interpretation through repeated inference.

• Externalized Institutional Knowledge: governed institutional meaning maintained outside the inference context and supplied selectively at runtime according to decision class and authorization requirements.

• Institutionally Available Control: a runtime control the institution could have applied at the governable checkpoint under the specified baseline workflow and control environment, assessed against that environment instead of whether the control was deployed at the time.

• Systemic Semantic Contagion (SSC): the cross-institutional condition in which an unauthorized operational interpretation arises simultaneously across multiple institutions through shared semantic infrastructure.

• Semantic Concentration Risk (SCR): the exposure supervisors may quantify to shared runtime semantic-resolution infrastructure across the regulated population.

• Semantic Control Plane (SCP): the runtime governance architecture for the reasoning layer, establishing a runtime trust boundary between interpretation and execution and composed of the Ontology, Semantic Layer, and Knowledge Graph.

• Reasoning Layer: the runtime surface where an agentic system resolves the operational meaning of a term before it acts, above model inference and below execution.

• Semantic Deviation Index (SDI): a deterministic, exact-rational runtime standard that measures how far an agent's interpretation has moved from authorized institutional meaning.

• Deterministic Gate: the pre-execution enforcement mechanism that consumes the SDI result and produces Semantic Authorization under governed threshold and policy rules before Authorization Emission and downstream Execution Authority.

• Component Scores (I, P, C): the three bounded divergences the SDI decomposes into: Intent Mismatch, Path Deviation, and Control Bypass Probability.

• Threshold Zones: the four bands into which the SDI composite is classified: Normal, Warning, Intervention, and Breach, each mapped to a Gate decision.

• Governance Thresholds: the institution-calibrated zone boundaries against which the index is judged, set according to institutional risk appetite instead of universal semantic-truth thresholds.

• Agentic Workflow Drift (AWD): cumulative semantic divergence across an agentic workflow, including unapproved synthesized working logic created when an agent reconciles conflicting definitions.

• Agentic Workflow Subversion (AWS): the enterprise risk surface created when unauthorized operational logic propagates across agents, workflows, or systems as authoritative meaning.

• The Agentic 3 C's Framework: Context, Control, and Coordination, the governance framework that constrains autonomous operational drift across enterprise and high-assurance systems.

• Agentic Blast Radius: the governance construct that bounds and evidences the scope of propagated operational impact across connected agents and workflows.

• Semantic Layer Integrity Attack (SLIA): the adversarial threat class targeting the meaning layer that agents reason over.

• Definitional Divergence: the condition in which enterprise systems each define the same control term differently, providing the plain-language entry point to Runtime Semantic Divergence.

• Invisible Failure: the condition in which every control fires correctly yet the institution is still wrong because the controls evaluated against a definition that had already shifted from what was authorized.

• Authority Decay: the progressive divergence of agent-resolved meaning from its authorized starting point across successive autonomous steps.

• Reconciliation Gap: the distance between the definition the institution authorized and the definition an agent synthesizes when coordinating across systems that define the same term differently.

• Governance Latency: the structural lag between the speed at which an agent executes and the institution's ability to validate that the execution rested on authorized meaning.

• Reasoning Layer Risk: the risk category arising from the reasoning layer as a distinct governance surface where meaning is resolved before execution and no existing risk category directly observes it.

• Control Inheritance Assumption: the implicit doctrine that testing System A and System B validates their integration, which agentic systems can break by synthesizing meaning at the integration surface.

• Epistemic Stability: the operational stability of authorized meaning across the semantic, reasoning, and execution layers, holding when divergence at each layer stays within the institution's authorized tolerance.

• Semantic Substrate Validation: a pre-execution checkpoint confirming that key control terms resolve consistently against a governed baseline across all contributing systems before consequential execution authority is emitted.

• Two Questions of Control: the supervisory test for agentic control effectiveness: did the control fire, and did it evaluate the agent's reasoning against an authorized definition.

• Human-in-the-Loop Protocol: the exception path invoked when the Gate holds or a protocol failure requires institutional human authority, using preserved decision state instead of post-hoc reconstruction.

• Semantic Spoofing and Definitional Tampering: reasoning-layer counterparts to spoofing and tampering: falsified meaning presented as authoritative and unauthorized modification of the working operational definition the architecture derives across systems.

• Authorized Ambiguity: the condition in which the Reasoning Baseline resolves to a set of operationally valid variants, against which the applicable variant for the decision context is evaluated.

Doyle-Spare has maintained a documented practitioner record of submissions to NIST initiatives addressing agentic AI governance, reasoning-layer assurance, AI evaluation, critical infrastructure, and agent identity and authorization.

The record is ongoing.

• August 5, 2026 — AI RMF / TACIP: NIST AI RMF Profile on Trustworthy AI in Critical Infrastructure, August 3, 2026 discussion draft
• May 12, 2026 — TEVV: NIST AI Standards Zero Drafts Pilot Project, Test, Evaluation, Verification and Validation pilot topic
• April 16, 2026 — AI RMF Playbook: NIST AI Risk Management Framework Playbook, MEASURE function, including MEASURE 3.2, 3.1, 1.1, and 2.5
• April 16, 2026 — AI RMF Critical Infrastructure Profile: Trustworthy AI in Critical Infrastructure Profile submission aligned to the April 7, 2026 concept note
• March 30, 2026 — CAISI: NIST AI 800-2 ipd, Practices for Automated Benchmark Evaluations of Language Models
• March 30, 2026 — AI RMF Playbook: NIST AI Risk Management Framework feedback covering MANAGE 2.4, MEASURE 3.1, GOVERN 1.2, MAP 2.2, and the Financial Services Sector Profile
• March 30, 2026 — COSAiS: NISTIR 8605D, Control Overlays for Securing AI Systems, including agentic AI and single-agent and multi-agent environments
• March 30, 2026 — AI RMF Engage: NIST AI Risk Management Framework 1.0 provisions and published NIST crosswalk documents
• March 30, 2026, 10:22 AM ET — NCCoE: Concept Paper: Accelerating the Adoption of Software and AI Agent Identity and Authorization

ORCID 0009-0009-6655-1394 · ResearchGate · SSRN author page · LinkedIn · Substack · Thinkers360

Doyle-Spare Research, USA · maureen@maureendoylespare.com