Built for the MCN guide on responsible agentic AI.
In 2026 the ministère de la Cybersécurité et du Numérique published its Guide sur l'utilisation responsable de l'intelligence artificielle agentique for public bodies. Its rule is simple: the more an agent can act, the higher the bar for supervision, traceability, stop capability and cost control. Mili meets that bar by construction, and ships the templates for the parts only your organisation can do.
What the guide asks, what Mili does
| Guide requirement | In Mili | Evidence |
|---|---|---|
| Sensitive actions require prior human validation (§3, §9) | A deterministic approval window (Authorize / Deny, argument preview, fail-closed timeout) gates external messages, spending, deletions, official data and personal information. The agent has no tool to approve itself; chat-channel confirmations are verified by code, never by the model. | hitl.prompt, hitl.decision |
| The agent can never widen its permissions, edit its rules, erase its logs or bypass validation (§9) | Tools run in an isolated workspace with no path to the agent's data directory; the audit log is hash-chained and mirrored to the management console; policies pushed by the console are locked. | Verifiable chain |
| Logs reconstruct the request, sources, tools, steps, results, validations, errors, incidents and costs (§9) | Dedicated audit categories for human validations and multi-agent hand-offs, sources consulted on every document search, cost per execution by task type. | data.consult, tool.call, cost.turn, mcp.* |
| Stop capability: who can suspend, how accesses are blocked, logs preserved, people notified, manual fallback (§9, §12) | Suspension by the operator or the console cancels running executions, blocks every tool, scheduled task and peer-agent call, switches the interface to read-only, pauses log pruning, survives restarts and notifies the owner and supervisor. A console-imposed suspension cannot be lifted locally. | agent.suspend, agent.resume |
| Escalation defined in advance: contradictory sources, missing information, ambiguity, high uncertainty, cost, unexpected behaviour (§9) | An escalate tool with the guide's triggers. In a live session a person answers Proceed or Stop; in an unattended one the agent stops and the escalation waits in a queue for the supervisor. | hitl.escalate |
| Cost ceilings per period and per execution, alert thresholds, automatic stop, cost by task type (§10) | Period budget on the billing key, per-execution ceiling in tokens and money, 50 / 80 / 95 % alerts, and a cost record per execution covering language model, vision, video, speech, image generation and embeddings — gateway-reported, or labelled as an estimate. | cost.turn, cost.budget_threshold |
| Documented autonomy level, permitted and forbidden actions (§8, Annex C) | Four declared levels — assist (read-only), propose, act with approval, autonomous — plus forbidden and allowed tool lists, enforced both in what the model is told it can do and in what the dispatcher lets through. Lockable by policy. | gate.autonomy_block |
| Agent registry, versions, data inventory, personal information assessment (§8, §11, §12) | An exportable agent record: owner, purpose, state, connected systems, credential names, data sources with declared classification, a version fingerprint that changes whenever anything behaviour-influencing changes, and a heuristic scan of personal-information indicators (counts only) to support the privacy assessment. | Agent record (Markdown) |
| Multi-agent systems: orchestration, roles, hand-offs, validations logged (§11) | Every sub-agent spawn and every inbound or outbound peer call is recorded with trace lineage; peer identity is signed; per-contact guard rails apply. | subagent.*, mcp.* |
Traceability isn't a promise — it's a trace
Here is a real run: Direction receives a request for a weekly briefing, delegates to Sales, Finance and HR, each calling its own tools (Salesforce, HubSpot, Zendesk, QuickBooks, Stripe, BambooHR, Google Drive), then assembles the report and files it to the Drive. The conversation trace records every prompt, every inter-agent hand-off and every tool call — exactly what the guide requires at §9 (logging) and §11 (multi-agent systems).
The part only you can do — with the templates to do it
Deciding whether an agent is justified, naming the accountable people, authorising the pilot and the move to production, the privacy assessment, the manual-fallback test and the periodic review belong to the organisation. These French-language templates are pre-filled with Mili's controls and the evidence it produces.
- 00 — Lisez-moi
- How to use the kit; what Mili does on its own, what remains yours.
- 01 — Correspondance Annexe C
- The guide's minimum checklist, line by line: Mili control, evidence to attach, your remaining task.
- 02 — Fiche de cas d'usage
- Use-case screening (is an agent justified?) and pilot preparation, mapped to Mili settings.
- 03 — Rôles et responsabilités
- Owner, technology lead, operational supervision; who can do what in Mili; minimal user training.
- 04 — Suspension, incident, retour manuel
- Who suspends and how, evidence preservation, notifications, manual fallback, incident record, and the 12-step stop-mechanism test.
- 05 — Gouvernance des coûts
- Billing model, cost units, consumption factors, thresholds and ceilings with the configuration keys.
- 06 — Registre et versions
- Registry entry, version fingerprint, change log, retirement.
- 07 — Passage en production et revue périodique
- Production readiness checklist and the post-deployment review, each question pointing to where to look in Mili.
The kit is not legal advice. The MCN guide and the frameworks it cites prevail.
Deploying in a public body?
We will walk your security, privacy and audit leads through the controls and the evidence.