Nominal Controls Are Not Controls: Rollback, Sign-off, and Oversight for Meta-Agent Systems

As autonomous AI systems begin to instantiate, supervise, and terminate other AI systems, a governance problem emerges: how does a human deployer retain meaningful control when consequential actions sit several delegation-hops from any human decision? This position paper develops a governance framework for meta-agents—AI systems that build, optimize, supervise, or retire other agents at runtime or design time. We address three practical problems: (1) design criteria separating actionable rollback and halt controls from nominal ones that exist in documentation but fail in production incidents, (2) a staged sign-off architecture answering who signs off before a discovered or self-modified agent ships, and (3) oversight requirements for hierarchical agent systems. We argue meta-agent governance is an organizational design problem with a technical substrate and propose concrete mechanisms: a control-plane architecture combining broadcast halt signals with lease-based credential revocation, giving halt latency independent of hierarchy depth and of any agent's cooperation—making shutdown propagation a structural property of the system rather than a behavioral property of any agent—staged gate review scaled to risk, and role-based accountability that maintains human oversight across layers of delegation. The mechanisms are grounded in management science and cybernetics, illustrated by an agentic procure-to-pay exception-resolution system under active development, and stress-tested in a discrete-event simulation of halt-latency scaling with hierarchy depth; production measurement of halt latency, sign-off throughput, and oversight-depth limits remains priority future work.