Agentic Substrate: What an AI System Must Provide to Execute Autonomous Tasks Under Governance Constraints

The peer-reviewed multi-agent literature has demonstrated that agentic systems can reason, coordinate, and use tools at a level sufficient for many production task classes. AutoGen, MetaGPT, ChatDev, ReAct, Reflexion, and Toolformer between them describe agent architectures whose capability is no longer the bottleneck for autonomous task execution. The bottleneck is governability: capability alone does not produce execution that humans can authorize, audit, and refuse. Whether governance is even expressible in a given deployment depends not on the protocol the team specifies, but on the substrate the protocol must run over. This paper specifies the agentic substrate as a governance surface. It treats the substrate as a designed layer with named primitives — agent anatomy (memory, reasoning, tool access), orchestration topology (single-agent, multi-agent, swarm), governance integration (admission hooks, evidence channels, manifest propagation, HITL escalation), and runtime isolation (process boundaries, capability tokens, sandboxed tools, scoped credentials) — each carrying explicit governance contracts. The contracts are substrate-independent: any compliant implementation must honor them regardless of whether the underlying composition runs on LangGraph, AutoGen, CrewAI, the Model Context Protocol, the OpenAI Agents SDK, or a bespoke stack. Four claims structure the paper. Agent anatomy is a governance surface, not a capability surface: memory, reasoning, and tools each carry governance obligations that determine whether the agent is governable at all. Orchestration topology determines authority distribution: single-agent, multi-agent, and swarm orchestrations each impose a different authority structure on the Governance Layer / Orchestrator / Executor split, and substrate selection determines which is implementable. Governance integration is substrate-layer, not protocol-layer: protocol specifies what the gates do; the substrate specifies how they are invoked, and only substrate-side enforcement is structural. Runtime isolation is the blast-radius contract: process isolation, capability tokens, sandboxes, and credential scoping define the upper bound on harm an admission failure can produce. Paper Seven is the seventh paper in the Mission-Ready AI decalogy and the second of three Application-layer depth papers. It operationalizes Skipjack §6 ("What Skipjack Requires of the Harness Substrate") and Paper Six §6.1 (the five operating-model contracts) into a substrate specification. Rights envelope: Citation permitted with full attribution. No reproduction, redistribution, or derivative works without written permission. AI/ML training use disallowed. See the citation policy at https://nonsequitur.tech/pubs/citation-policy/ for the full rights envelope. Canonical site URL: https://nonsequitur.tech/white-papers/agentic-substrate/ Public archive: yks-pubs/papers/agentic-substrate-v1-preprint.pdf