Three Vocabularies: Federal Mandates, Standards Bodies, and the Doctrine

Take the eight federal AI documents that matter most to a program office. Take five agentic-governance publications from three standards organizations. Take the full published text of the Governed Autonomy Doctrine. Count words. Not sentiment, not themes: occurrences per ten thousand words.

The result is not two camps. It is an axis with three positions on it, and on almost every term that matters for governing an agent the standards bodies sit in the middle.

What the mandates talk about

The federal corpus is M-25-21, M-25-22 and M-26-04, Executive Order 14179 and Executive Order 14409, NIST AI 600-1, the GSAR 552.239-7001 proposed rule, and the CISA and partners guidance on agentic AI services. About 58,000 words.

Their heavy words are the words of a program that has to be defended in front of an inspector general: observability and monitoring (23 per 10,000 words), bias (22), privacy (17), procurement and acquisition (15), risk assessment and management (11), compliance (9.3). Policy runs at 22.

What they barely say: runtime (1.0), delegation (1.2), multi-agent (1.0), agent identity (0.3), least agency (zero, in 58,000 words).

The mandates govern systems. An AI system is inventoried, assessed, procured, monitored, and if it is high-impact, reviewed. The thing that acts inside the system is not a first-class object in any of the eight documents.

What the standards bodies talk about

The second corpus is OWASP’s Top 10 for Agentic Applications, two World Economic Forum reports on agentic AI in government and trusted adoption of agents, and two Cloud Security Alliance publications on agentic governance against NIST standards and the state of the agentic market. Five publications, three organizations, about 61,000 words. Deliberately no individual commentators, no vendor marketing.

This corpus is where the agent becomes an object. Agentic runs at 74 per 10,000 words, higher than either of the other two. Autonomy runs at 25. Delegation at 12, enforcement at 12, prompt injection at 12, multi-agent at 8.8, agent identity at 6.1.

It has not left the federal vocabulary behind. Policy runs at 22, the same rate as the mandates. Observability and monitoring runs at 32, higher than the mandates. Compliance at 6.9. This is writing that still expects to be read by someone who has to file something.

Least agency appears at 0.3. OWASP used the term publicly in December 2025, expanding on least privilege and excessive agency. The mandates have not picked it up at all.

What the doctrine talks about

The doctrine’s heavy words are the words of an architecture: autonomy (110, a count that includes its own name), runtime (36), policy (34), agentic (34), enforcement (32), mission (25), delegation (22), audit (16), agent identity (12), least agency (11).

What it barely says: privacy (zero), procurement (0.7), bias (1.7), risk assessment and management (3.1), compliance (5.1). Those are not accidents. The doctrine is written to be mechanism-agnostic and regime-agnostic, so it does not restate the risk catalog NIST AI 600-1 already carries or the acquisition clauses M-25-22 already carries. A federal reader will not know that from the text, and the absence reads as a gap until somebody explains it.

The gradient

Put the three columns side by side and most rows run in one direction:

Term	Federal mandates	Standards bodies	Doctrine
agent identity	0.3	6.1	11.9
runtime	1.0	4.6	36.0
delegation	1.2	11.9	21.7
multi-agent	1.0	8.8	12.2
enforcement	2.7	11.8	31.9
autonomy	4.3	25.2	109.8
least agency	0.0	0.3	10.9
bias	21.9	3.1	1.7
privacy	17.1	2.5	0.0
procurement and acquisition	14.6	1.5	0.7
risk assessment and management	11.3	5.9	3.1

Rates are per 10,000 words.

This matters more than a two-way gap would. A gap invites the reading that the doctrine is an outlier with private vocabulary. A gradient says something different: the standards bodies are already moving along this axis, and the doctrine is further along the same line rather than off it. The federal mandates are the lagging end, which is the expected position for instruments that have to survive notice and comment.

Where it runs the other way, and where it runs neither way

Three rows do not follow the pattern, and they are the interesting ones.

Observability and monitoring peaks in the middle: 23 in the mandates, 32 in the standards writing, 13 in the doctrine. The doctrine says least about the thing federal guidance is most specific about, because it points at Plane 4 rather than restating a logging architecture. As of v3.6 that plane requires a reconstructable, tamper-evident transaction record governed as a data asset. That is the same requirement the federal logging guidance is converging on from the other direction, in different words.

Prompt injection also peaks in the middle, at 12 against 1.7 in the mandates and 4.8 in the doctrine. The standards bodies own the threat catalog. The mandates have barely registered the most-documented failure mode in agentic systems.

Mission is the one term the doctrine shares with neither: 2.4 in the mandates, 1.5 in the standards writing, 25 in the doctrine. Federal writing calls this scope, or use case, or intended purpose. The doctrine makes it the unit of authority, which is a substantive claim and not a synonym.

Policy is flat across all three at 22, 22 and 34. Everyone has agreed there is a policy. They disagree about when it is evaluated.

What a federal program should do with this

Treat the three columns as a translation table and a maturity signal, not a choice.

• When a document says monitoring, check which end of the gradient it sits on. Observation after the fact and interception before the action commits are both called monitoring. Only the second is what the doctrine calls runtime enforcement.
• When a document says AI system inventory, ask whether the agents inside the system are inventoried as identities with owners and revocation paths, or whether only the system is.
• When a solicitation cites standards-body guidance, expect agent-level vocabulary in it that the governing mandate does not contain. That is not a conflict. It is the standards body being further along the same axis.
• When the doctrine is silent on bias and privacy, do not read that as permission. Those requirements arrive through M-26-04 and NIST AI 600-1 and they apply to an agent exactly as they apply to any other AI system.

Method

Counts are case-insensitive, word-bounded regular-expression matches over the raw text of each document. PDFs were extracted to text; the doctrine was taken from its published llms-full.txt at v3.6. Rates are per 10,000 words including stopwords, so the three corpora are comparable despite different lengths.

Grouped terms: “human oversight” includes “human in the loop” and “human review”; “observability” includes “monitoring”, “logging” and “telemetry”; “override” includes “shut down” and “kill switch”; “risk assessment” includes “risk management”. The doctrine’s “autonomy” count includes its own name.

The standards-body corpus is restricted to publications issued by an organization. Individual commentary and vendor material were excluded, which keeps the comparison to bodies that publish under institutional review. One candidate publication was dropped because its own file metadata marks it a draft.

The term list was chosen to cover the doctrine’s vocabulary and the mandates’ vocabulary in roughly equal measure. It is not exhaustive, and a different list would move the numbers. Computed 15 September 2026.