Back in October of last year, a Congressional bill demanded that the Department of Defense come up with a plan to manage the security companies -- to investigate individual backgrounds and inculcate rules of engagement and enforce compliance. Until then, according to a Pentagon official with knowledge of the process who asked not to be named because the Pentagon plan is still being finalized, the department had been at work, for many months, on doctrine dealing in a general way with all types of private contractors in Iraq but not specifically addressing the huge sector of gunmen. It seems that only the October bill drove the Pentagon to formally account for the most vital, and potentially most troubling, part of its outsourcing. Congress gave the department six months to produce its plan. Nine months have passed. The Pentagon has now promised the document any day; there's no telling whether it will change anything -- what guidelines it will give, what level of commitment will be behind them. When I asked the Pentagon official about who would enforce the rules in Iraq, I was told that the country's new sovereignty would be ''the context.'' It was hard not to think that the infant government of Iraq would be left mostly on its own to control the thousands of private gunmen that the American-led occupation has introduced to the country. It was hard not to think that the companies would be left to govern themselves.