Governance
What agents can do on your pipelines, and who approves it
Agents reach only what you expose. On a Novuz-delivered pipeline, that is up to five operations: run, check status, retrieve lineage, inspect outputs and rerun a failed step. Each works under your identity provider, approvals and audit logging, the same controls a person works under.
Code
Can an agent change what the converted code does?
No. The operations exposed to agents run, inspect and rerun pipelines; none of them edits the converted logic. Changes to the code go through conversion, the resolver and an engineer’s approval, like any other change. The conversion is not agentic; the access is.
Approvals
Do agents need human approval to run or rerun pipeline steps?
You decide, per operation. A sensible default: let agents check status, retrieve lineage and inspect outputs freely, and require an approval for a run or a rerun on regulated pipelines. The platform’s own steps (discovery, conversion, validation and deployment) can be gated on a human approval through the same APIs.
Liability
Who is liable when an agent reruns a step and breaks a regulated report?
The same party that is liable when a person reruns it: the pipeline’s owner. That is why reruns of regulated steps should require an approval and leave a log. Contract terms on liability are set in each agreement, not on this page. The controls that matter are:
- the approval, before the rerun;
- the audit log of who or what triggered it;
- a rerun that gives the same result on the same inputs.
Testing
How do we test whether a converted pipeline is safe for an agent to rerun?
Three checks, all run in the First Domain, before any agent touches production.
- Idempotence: run the step twice on the same inputs and confirm the second run changes nothing it should not.
- Reconciliation after a rerun: compare the outputs with the reconciled baseline, object by object.
- Permissions: confirm the agent’s identity can reach only the operations you exposed.
Regulated logic
Is “agentic migration” safe for regulated logic?
Not on its own. A language model’s output can change from run to run, so every converted object needs testing before anyone relies on it. Use fixed rules for the conversion, a named engineer for every exception, and agents for the approved operations afterwards.
Next question
Where to read next
Where should we start with agents on migrated pipelines?
FAQ
Frequently asked questions
Can an agent change what the converted code does?
No. The operations exposed to agents run, inspect and rerun pipelines; none of them edits the converted logic. Changes to the code go through conversion, the resolver and an engineer’s approval.
Do agents need human approval to run or rerun pipeline steps?
You decide, per operation. Let agents check status, retrieve lineage and inspect outputs freely, and require an approval for a run or a rerun on regulated pipelines.
Last reviewed:
Find out what your logic debt is costing you.
Every object counted, lineage, dead code and a fixed price in three business days. $3,000, credited.
Not sure which door? The scorecard takes ten minutes and tells you.