A working AI governance framework: a registry, risk tiers, a review process, and what changes once an AI agent can act on its own.