{"brand":"EnterpriseAgentStack","domain":"EnterpriseAgentStack.com","category":"Enterprise Agent Reference Architecture","corePrinciple":"The model proposes. The runtime decides. The evidence proves.","groups":[{"id":"A","name":"Business and behavior","description":"Defines business objectives, permitted autonomy, and runtime orchestration framework.","color":"border-blue-500/30 bg-blue-500/5 text-blue-700 dark:text-blue-300","badgeColor":"bg-blue-100 text-blue-800 dark:bg-blue-900/50 dark:text-blue-300","layers":["agent-applications","agent-framework-runtime"]},{"id":"B","name":"Intelligence and capabilities","description":"Models, tool capabilities, permission-aware context retrieval, and managed memory.","color":"border-emerald-500/30 bg-emerald-500/5 text-emerald-700 dark:text-emerald-300","badgeColor":"bg-emerald-100 text-emerald-800 dark:bg-emerald-900/50 dark:text-emerald-300","layers":["models-intelligence","tools-mcp-capabilities","context-knowledge","agent-memory"]},{"id":"C","name":"Identity and control","description":"Workload identity, delegated authority, pre-action runtime policy, human approval, and budgets.","color":"border-amber-500/30 bg-amber-500/5 text-amber-700 dark:text-amber-300","badgeColor":"bg-amber-100 text-amber-800 dark:bg-amber-900/50 dark:text-amber-300","layers":["agent-identity-ownership","authority-delegation","runtime-policy-enforcement","human-approval","runtime-budget-governance"]},{"id":"D","name":"Reliability and evidence","description":"Episode tracing, continuous evaluation, decision receipts, and audit trails.","color":"border-purple-500/30 bg-purple-500/5 text-purple-700 dark:text-purple-300","badgeColor":"bg-purple-100 text-purple-800 dark:bg-purple-900/50 dark:text-purple-300","layers":["agent-observability","agent-evaluation","evidence-audit"]},{"id":"E","name":"Infrastructure","description":"Cloud, VPC, on-premises, edge, and physical execution operations with SRE controls.","color":"border-slate-500/30 bg-slate-500/5 text-slate-700 dark:text-slate-300","badgeColor":"bg-slate-100 text-slate-800 dark:bg-slate-800 dark:text-slate-300","layers":["deployment-operations"]}],"layers":[{"id":"layer-1","slug":"agent-applications","number":1,"groupId":"A","groupName":"Business and behavior","title":"Agent Applications and Workflows","headline":"Start With the Business Objective, Not the Model","definition":"The application layer defines what the agent is expected to accomplish, who owns the outcome, how much autonomy is permitted, and which consequences are acceptable.","purpose":"Defines business intent, success criteria, and user interaction surfaces for autonomous workflows.","whyItExists":"Without explicit application boundaries, agents drift into unconstrained tasks with unclear ownership and undefined success criteria.","enterpriseOwner":"Business owner and product team","minimumRequirements":["Business objective & unique Objective ID","Quantifiable success criteria","Named accountable business owner","User population & identity context","Defined permitted autonomy level","Risk classification rating","Required human involvement triggers","Permitted financial & operational consequences","Outcome verification mechanism","Named incident responder"],"requiredInterfaces":{"inputs":["Business Objective Request","User Identity","Target Systems Context"],"outputs":["Objective ID","Boundary Constraints","Approved Purpose Record"]},"commonFailures":["Teams start with a model and tools but cannot clearly state what success or acceptable autonomy means.","Unclear ownership leaves incident response without an accountable executive when agent actions fail.","Inability to measure outcome quality vs completed API calls."],"controlQuestions":["What specific business outcome is this agent authorized to achieve?","Who is the accountable executive if the agent takes an incorrect financial action?","What is the maximum acceptable Blast Radius for a single execution loop?"],"evidenceProduced":["Objective Record","Ownership Attestation Record","Risk Classification Manifest","Success Criteria Definition","Outcome Verification Record"],"buyingQuestions":["Can business users adjust permitted autonomy levels without rewriting code?","How are risk classifications mapped to organizational policy frameworks?"],"maturityCriteria":[{"stage":"Stage 0","description":"Ad-hoc prompts without formal objective tracking."},{"stage":"Stage 1","description":"Defined use cases with standard workflow triggers."},{"stage":"Stage 2","description":"Centralized use case tracking with basic risk tagging."},{"stage":"Stage 3","description":"Formal business ownership and permitted autonomy contracts."},{"stage":"Stage 4","description":"Pre-action autonomy boundary enforcement per objective."},{"stage":"Stage 5","description":"Continuous outcome verification and automated risk adaptation."}],"buildVsBuy":{"buildWhen":["Core domain workflow logic is proprietary and competitive differentiator."],"buyWhen":["Standard horizontal workflow patterns (customer service, document routing, email drafting)."],"standardizeOn":["Objective IDs","Risk Classification Schemas","Permitted Autonomy Taxonomies"]},"relatedLayers":["agent-framework-runtime","agent-identity-ownership","authority-delegation"],"relatedProducts":[{"name":"EnterpriseACP","role":"Register agents & assign business ownership","status":"Available"}],"assessmentQuestions":[{"question":"Does every production agent have a named business owner and technical owner?","options":["Yes","Most","Some","No","Unknown"]}]},{"id":"layer-2","slug":"agent-framework-runtime","number":2,"groupId":"A","groupName":"Business and behavior","title":"Agent Framework and Runtime","headline":"Control How the Agent Plans, Retries, Recovers, and Delegates","definition":"The runtime environment that orchestrates planning, step decomposition, execution loops, state management, error handling, and delegation.","purpose":"Manages step execution, memory hydration, tool execution loops, retry strategies, and sub-agent delegation.","whyItExists":"Agents enter infinite retries, goal drift, replanning loops, and lost approval state without bounded runtime controls.","enterpriseOwner":"AI platform team","minimumRequirements":["Unique Objective IDs passed through all execution spans","Bounded loop iterations & max retry counts","Maximum planning depth constraints","Explicit termination conditions (success/fail/timeout)","Recoverable state checkpoints","Deterministic boundary handlers","Graceful failure & fallback paths","Safe fallback modes","Delegation tracking records"],"requiredInterfaces":{"inputs":["Proposed Action Plan","Objective Context","State History"],"outputs":["Step Execution Event","Delegation Request","Termination Receipt"]},"commonFailures":["Infinite retry loops consuming massive API costs on broken tools.","Goal drift where sub-plans diverge from the original business objective.","Loss of approval state when resuming execution after a human pause."],"controlQuestions":["Can the runtime enforce hard limits on planning recursion depth?","How does the runtime handle state restoration after an unhandled exception?","What prevents child agents from inheriting unconstrained delegator authority?"],"evidenceProduced":["Agent Episode Log","Plan Revision History","Retry Event Record","Delegation Event Manifest","Termination & Recovery Record"],"buyingQuestions":["Does the framework support serverless or long-running durable execution?","Is state persistence decoupled from LLM context memory?"],"maturityCriteria":[{"stage":"Stage 0","description":"Basic loop script running locally."},{"stage":"Stage 1","description":"Standard framework (LangChain/CrewAI/LlamaIndex) in shared cloud."},{"stage":"Stage 2","description":"Traced runtime execution with retry caps."},{"stage":"Stage 3","description":"Durable state checkpointing and bounded planning depth."},{"stage":"Stage 4","description":"Runtime policy evaluation before every planning cycle."},{"stage":"Stage 5","description":"Self-healing, deterministic state recovery with audit receipts."}],"buildVsBuy":{"buildWhen":["Custom state machine execution or strict embedded performance needs exist."],"buyWhen":["Standard multi-agent orchestration frameworks meet compliance criteria."],"standardizeOn":["Trace Context Propagation","Proposed Action Schema","Termination Events"]},"relatedLayers":["agent-applications","models-intelligence","tools-mcp-capabilities","runtime-policy-enforcement"],"relatedProducts":[{"name":"Enterprise Hypervisor","role":"Governed execution runtime controller","status":"Available"}],"assessmentQuestions":[{"question":"Can the runtime stop or throttle an execution loop automatically when unexpected behavior occurs?","options":["Yes across all actions","Yes for selected tools","Approval only","Detection after execution","No"]}]},{"id":"layer-3","slug":"models-intelligence","number":3,"groupId":"B","groupName":"Intelligence and capabilities","title":"Models and Intelligence","headline":"Use the Right Model for the Objective, Data, Risk, Cost, and Environment","definition":"The layer providing reasoning, language generation, embeddings, reranking, and multimodal perception capabilities across commercial and open-weight models.","purpose":"Routes prompts and context to appropriate models based on task complexity, data sensitivity, latency, and cost rules.","whyItExists":"Sending sensitive enterprise data to unapproved external endpoints or using high-cost models for simple formatting tasks destroys security and margin.","enterpriseOwner":"Model governance and AI platform team","minimumRequirements":["Enterprise model registry with version pinning","Dynamic model routing engine","Private VPC & on-premise model hosting options","Embedding & reranker model governance","Multimodal capabilities control","Automatic failover & fallback routing","License & compliance auditing","Model revocation switch"],"requiredInterfaces":{"inputs":["Model Request Payload","Sensitivity Classification","Cost Boundary"],"outputs":["Model Response","Usage Metrics Record","Selected Model Metadata"]},"commonFailures":["Data leakage by sending PII to public, non-compliant third-party models.","Service outage when a single provider API experiences degradation with no fallback.","Silent prompt injection exploiting model vulnerabilities."],"controlQuestions":["Which model version is approved for processing customer PII or financial data?","Is there an automatic fallback path if the primary LLM rate limits or fails?","Can model access be revoked instantly across all running agents?"],"evidenceProduced":["Model Selection Record","Model Version & Weights Manifest","Routing Decision Log","Model Evaluation Reference","Token & Cost Record"],"buyingQuestions":["Does the model gateway support zero-data-retention agreements automatically?","How does the platform handle semantic fallback and latency optimization?"],"maturityCriteria":[{"stage":"Stage 0","description":"Hardcoded API keys to single external provider."},{"stage":"Stage 1","description":"Centralized API gateway with basic key rotation."},{"stage":"Stage 2","description":"Model routing by cost and task type."},{"stage":"Stage 3","description":"Model registry with risk-tier data mapping."},{"stage":"Stage 4","description":"Pre-request data redaction and dynamic fallback."},{"stage":"Stage 5","description":"Continuous model evaluation and runtime revocation."}],"buildVsBuy":{"buildWhen":["Proprietary fine-tuning infrastructure or edge model weights."],"buyWhen":["Universal model gateways, LLM routers, and managed inference providers."],"standardizeOn":["Model Gateway API","Prompt-Response Telemetry","Token Accounting"]},"relatedLayers":["agent-framework-runtime","tools-mcp-capabilities","context-knowledge","runtime-budget-governance"],"relatedProducts":[{"name":"LocalModels","role":"Local and enterprise model gateway","status":"Available"},{"name":"OpenModels","role":"Package & distribute open model artifacts","status":"In development"}],"assessmentQuestions":[{"question":"Which model providers or hosting environments are approved for your agent workloads?","options":["Private VPC / On-Prem only","Approved Enterprise SaaS with No-Data-Retention","Any Cloud API","Unrestricted","Unknown"]}]},{"id":"layer-4","slug":"tools-mcp-capabilities","number":4,"groupId":"B","groupName":"Intelligence and capabilities","title":"Tools and Capabilities","headline":"Define What Every Tool Can Do Before an Agent Uses It","definition":"The capability interface layer (APIs, SaaS connectors, Model Context Protocol MCP tools, SQL queries, system commands) that allows agents to take actions.","purpose":"Schema validation, read/write classification, resource scoping, transaction limits, idempotency enforcement, and side-effect controls.","whyItExists":"A tool is not merely a function call; it is a path to an enterprise consequence. Uncontrolled tool access leads to accidental deletions, unauthorized transfers, and infrastructure damage.","enterpriseOwner":"Platform engineering and application owners","minimumRequirements":["Unique Tool Identity & ownership registry","Strict input/output JSON schema validation","Read vs Write vs Destructive classification","Resource scope & transaction rate limits","Idempotency keys & transaction boundaries","Reversibility & rollback capability classification","Human approval requirement triggers","Verification method definition"],"requiredInterfaces":{"inputs":["Tool Call Request Payload","Authority Token","Transaction Parameters"],"outputs":["Execution Receipt","Side-Effect Record","Verification Outcome"]},"commonFailures":["Agent calling a write endpoint with unvalidated parameters causing database corruption.","Tool execution failing silently while reporting success to the LLM.","Unbounded API rate limit exhaustion during tool retries."],"controlQuestions":["Are tool capabilities classified by read/write and financial/operational impact?","Can a tool execution be stopped before hitting production databases?","Does every tool call generate a cryptographically signed execution receipt?"],"evidenceProduced":["Tool Manifest & Schema Definition","Tool Capability Grant","Tool Call Request Log","Execution Receipt","Side-Effect Verification Log"],"buyingQuestions":["How does the tool gateway mediate MCP (Model Context Protocol) servers safely?","Is parameter-level authorization enforced at the gateway?"],"maturityCriteria":[{"stage":"Stage 0","description":"Raw API calls inside prompt handlers."},{"stage":"Stage 1","description":"Standardized tool functions with basic JSON schemas."},{"stage":"Stage 2","description":"Read/write classification with rate limits."},{"stage":"Stage 3","description":"Tool registry with parameter-level RBAC."},{"stage":"Stage 4","description":"Pre-action tool interception and approval mediation."},{"stage":"Stage 5","description":"Signed execution receipts and verified side-effect rollbacks."}],"buildVsBuy":{"buildWhen":["Internal legacy system connectors or unique hardware integrations."],"buyWhen":["Standard MCP gateway solutions and SaaS tool management suites."],"standardizeOn":["MCP Tool Schemas","Tool Execution Receipts","Read/Write Taxonomy"]},"relatedLayers":["agent-framework-runtime","models-intelligence","authority-delegation","runtime-policy-enforcement"],"relatedProducts":[{"name":"AgentPlugin","role":"Define, register, mediate & verify tool operations","status":"Available"}],"assessmentQuestions":[{"question":"Can agents perform write actions on production systems?","options":["No (Read-only)","Limited reversible writes","Material business writes","Financial / Physical actions","Unknown"]}]},{"id":"layer-5","slug":"context-knowledge","number":5,"groupId":"B","groupName":"Intelligence and capabilities","title":"Context and Knowledge","headline":"Give Agents the Right Context, Under the Right Permissions, at the Right Time","definition":"The data retrieval, RAG, vector, graph, and document context layer that feeds relevant knowledge to the agent runtime.","purpose":"Enforces permission-correct retrieval, source identity verification, freshness limits, provenance tracking, and effective-time boundaries.","whyItExists":"Relevant context is not automatically authorized context. Agents frequently leak confidential HR, legal, or financial documents because vector search bypasses traditional ACLs.","enterpriseOwner":"Data, knowledge, and security teams","minimumRequirements":["Source Identity & Access Control ACL preservation in search","Data classification tagging (Public, Internal, Confidential, Restricted)","Freshness & TTL effective-date validation","Provenance tracking for all retrieved chunks","Permission checks evaluated against the original requesting user","Purpose-limited retrieval scopes","Context snapshot generation for reproducible audits"],"requiredInterfaces":{"inputs":["Context Query","Requester User Identity","Purpose Scope"],"outputs":["Context Bundle","Permission Decision Receipt","Provenance Map"]},"commonFailures":["Agent retrieves salary records because vector search indexed files without ACL metadata.","Outdated policy documents retrieved due to missing effective-date filters.","Inability to prove what documents the agent saw before making a critical decision."],"controlQuestions":["Are user permissions enforced at retrieval time or does the RAG pipeline search everything?","Can you reconstruct the exact context bundle provided to an agent 30 days ago?","How are conflicting or stale documents filtered out before hitting the model context window?"],"evidenceProduced":["Context Bundle Record","Source References & Lineage Map","Permission Verification Decision","Retrieval Rationale Log","Context Snapshot Hash"],"buyingQuestions":["Does the context platform maintain real-time sync with source IAM permissions?","How are vector embeddings re-indexed when source document permissions change?"],"maturityCriteria":[{"stage":"Stage 0","description":"Naive chunking into an unauthenticated vector database."},{"stage":"Stage 1","description":"Vector store with basic metadata filtering."},{"stage":"Stage 2","description":"Context retrieval logged with query terms."},{"stage":"Stage 3","description":"Source ACL enforcement integrated into RAG pipelines."},{"stage":"Stage 4","description":"Context snapshots captured per episode with data classification rules."},{"stage":"Stage 5","description":"Deterministic context provenance with mathematical permission proofs."}],"buildVsBuy":{"buildWhen":["Highly customized enterprise graph algorithms or proprietary data formats."],"buyWhen":["Enterprise search, permission-aware RAG, and knowledge graph platforms."],"standardizeOn":["Context Bundle Schema","Source Provenance Format","ACL Metadata Tags"]},"relatedLayers":["models-intelligence","agent-memory","authority-delegation","evidence-audit"],"relatedProducts":[{"name":"EnterpriseContextGraph","role":"Preserve permission-correct context & lineage","status":"Available"},{"name":"EnterpriseContextServer","role":"Deliver authorized context for approved objectives","status":"Available"}],"assessmentQuestions":[{"question":"Are original user permissions enforced when agents retrieve enterprise data?","options":["Always","Usually","Sometimes","Rarely","No permissions applied"]}]},{"id":"layer-6","slug":"agent-memory","number":6,"groupId":"B","groupName":"Intelligence and capabilities","title":"Agent Memory","headline":"Control What Agents Remember, Reuse, Share, and Forget","definition":"The persistent state, working memory, session memory, and shared organizational memory systems used by agents across conversations and tasks.","purpose":"Manages memory types, origin tagging, validation state, decay, expiration, deletion, and cross-agent memory contamination controls.","whyItExists":"A generated conclusion should not silently become trusted enterprise memory. Hallucinated facts stored in long-term memory permanently corrupt future agent runs.","enterpriseOwner":"AI platform and data governance team","minimumRequirements":["Explicit memory type classification (Session, User, Workflow, Shared)","Memory origin & provenance tracking","Human or algorithmic validation state before memory promotion","Expiration TTL and memory decay schedules","Explicit reuse & cross-agent sharing permissions","Instant memory deletion & revocation capabilities","Contamination controls preventing hallucinated memory drift"],"requiredInterfaces":{"inputs":["Memory Write Candidate","Validation Proof","Scope Tags"],"outputs":["Memory Store Receipt","Hydrated Memory Context","Deletion Event"]},"commonFailures":["An agent hallucinates a customer discount, stores it in long-term memory, and honors it for months.","Unsanitized user inputs in session memory cause cross-session prompt injection.","Inability to delete user PII from agent memory upon GDPR/CCPA request."],"controlQuestions":["Is generated agent output validated before being written to long-term memory?","Can memory records be purged instantly by user ID or topic?","What controls prevent memory contamination between different tenant organizations?"],"evidenceProduced":["Memory Record Manifest","Memory Validation Attestation","Retrieval Rationale Log","Memory Expiration Event","Purge & Deletion Event Receipt"],"buyingQuestions":["Does the memory store support vector + key-value + graph memory primitives?","How are memory updates audited for regulatory compliance?"],"maturityCriteria":[{"stage":"Stage 0","description":"Session context strings passed in raw prompts."},{"stage":"Stage 1","description":"Basic key-value store for user conversation history."},{"stage":"Stage 2","description":"Vector memory store without validation gating."},{"stage":"Stage 3","description":"Classified memory tiers with defined retention TTLs."},{"stage":"Stage 4","description":"Pre-memory validation rules preventing unverified fact persistence."},{"stage":"Stage 5","description":"Audited memory graph with automated contamination sweepers and instant revocation."}],"buildVsBuy":{"buildWhen":["Highly unique domain memory decay models or low-latency local cache."],"buyWhen":["Managed agent memory services and state persistence infrastructure."],"standardizeOn":["Memory Provenance Schema","Memory Purge API","Validation States"]},"relatedLayers":["context-knowledge","agent-identity-ownership","evidence-audit"],"relatedProducts":[{"name":"EnterpriseContextGraph","role":"Store & govern persistent memory lineage","status":"Available"}],"assessmentQuestions":[{"question":"How are findings or conclusions generated by an agent stored into long-term memory?","options":["Only after validation","With limited controls","Automatically","Memory not used","Unknown"]}]},{"id":"layer-7","slug":"agent-identity-ownership","number":7,"groupId":"C","groupName":"Identity and control","title":"Agent Identity and Ownership","headline":"Give Every Production Agent an Identity, Purpose, and Owner","definition":"The workload identity, machine identity, registration, and organizational ownership layer for all autonomous agents.","purpose":"Assigns verifiable SPIFFE/OAuth workload identity, logical IDs, environmental scopes, approved purpose definitions, and named business/technical/security owners.","whyItExists":"An agent should not reach production without a defined identity, accountable owner, approved purpose, risk classification, approved environment, and revocation path.","enterpriseOwner":"IAM and security team","minimumRequirements":["Centralized Enterprise Agent Registry","Logical ID, Workload Identity (mTLS/SPIFFE/OIDC), & Instance ID","Version identity and code deployment tracking","Environmental isolation scoping (Dev, Staging, Prod)","Named Business Owner, Technical Owner, and Security Owner","Approved Purpose Definition contract","Risk classification rating (Low, Med, High, Critical)","Instant agent revocation path"],"requiredInterfaces":{"inputs":["Agent Registration Request","Ownership Attestation"],"outputs":["Agent Passport","Workload Identity Token","Revocation Credential"]},"commonFailures":["Rogue agents created by shadow IT running under developer personal credentials.","Security teams cannot identify which team owns an agent causing suspicious API spikes.","Inability to disable a compromise-suspected agent without bringing down entire cloud services."],"controlQuestions":["Is there a single central inventory listing every active agent across the organization?","Does each production instance run under its own unique non-human workload identity?","Can an agent be suspended in under 5 seconds across all environments?"],"evidenceProduced":["Agent Passport","Ownership Attestation Record","Approved Purpose Record","Risk Rating Certificate","Lifecycle & Revocation Event"],"buyingQuestions":["Does the agent registry integrate directly with enterprise IAM (Okta, Entra ID, Ping)?","How are machine identity certificates issued and rotated for short-lived agent workers?"],"maturityCriteria":[{"stage":"Stage 0","description":"Agents run under personal developer API keys."},{"stage":"Stage 1","description":"Shared service accounts used across multiple agents."},{"stage":"Stage 2","description":"Spreadsheet inventory of active AI projects."},{"stage":"Stage 3","description":"Centralized agent registry with unique workload identities."},{"stage":"Stage 4","description":"Identity-bound runtime policy enforcement and automated certificate rotation."},{"stage":"Stage 5","description":"Cryptographic agent passports with continuous zero-trust identity verification."}],"buildVsBuy":{"buildWhen":["Never - leverage enterprise IAM extensions or specialized agent registries."],"buyWhen":["Enterprise Agent Registries, Non-Human Identity management platforms."],"standardizeOn":["Agent Passport Schema","Workload Identity Standard (SPIFFE/OIDC)","Agent Registry API"]},"relatedLayers":["agent-applications","authority-delegation","runtime-policy-enforcement","evidence-audit"],"relatedProducts":[{"name":"EnterpriseACP","role":"Register agents, assign ownership & manage lifecycle","status":"Available"}],"assessmentQuestions":[{"question":"Is there a central registry or inventory listing every AI agent deployed in the organization?","options":["Complete inventory","Partial inventory","Platform-specific registries","Spreadsheet","None"]}]},{"id":"layer-8","slug":"authority-delegation","number":8,"groupId":"C","groupName":"Identity and control","title":"Authority and Delegation","headline":"Define What Each Agent May Do—and What It May Delegate","definition":"The permission model governing what actions, resources, spending, and delegations an agent is authorized to execute.","purpose":"Enforces authority scoping across 12 dimensions: capability, resource, purpose, environment, time, amount, customer, region, risk, approval, delegation, and budget.","whyItExists":"Credentials become a substitute for permission when systems confuse raw technical capability with explicit business authorization.","enterpriseOwner":"Security, risk, and business owners","minimumRequirements":["Explicit Capability Grants (least privilege principle)","Resource-level scoping & customer/tenant boundary limits","Time-bound & amount-bounded authority leases","Strict delegation rules for sub-agent worker spawning","Mathematical Delegation Formula: Effective Delegated Authority = Delegator ∩ Recipient ∩ Objective ∩ Policy ∩ Runtime","Cascading revocation propagation across delegated agent chains"],"requiredInterfaces":{"inputs":["Authority Request","Delegator Passport","Objective Scope"],"outputs":["Signed Authority Manifest","Delegated Lease Token","Revocation Tree"]},"commonFailures":["An agent with database read credentials delegates unrestricted write commands to a child worker.","Authority remains valid indefinitely after an underlying business project ends.","Inability to trace authority grants back to human delegation events."],"controlQuestions":["What is the mathematical upper bound on authority an agent can pass to a child sub-agent?","Are authority leases time-bound with mandatory periodic re-attestation?","Can you revoke a delegator agent and instantly terminate all sub-agent authority downstream?"],"evidenceProduced":["Authority Grant Certificate","Capability Grant Manifest","Delegation Chain Record","Signed Authority Manifest","Runtime Lease Expiration Receipt"],"buyingQuestions":["How does the authority model integrate with fine-grained authorization (ReBAC/ABAC)?","Does the platform prevent authority amplification during multi-agent orchestration?"],"maturityCriteria":[{"stage":"Stage 0","description":"All-or-nothing service account tokens."},{"stage":"Stage 1","description":"Coarse API role-based access control."},{"stage":"Stage 2","description":"Attribute-based tool scopes defined in code."},{"stage":"Stage 3","description":"Centralized authority manifests with explicit delegation limits."},{"stage":"Stage 4","description":"Short-lived runtime authority leases with automated re-authorization."},{"stage":"Stage 5","description":"Real-time cryptographic delegation proofs with instant cascading revocation."}],"buildVsBuy":{"buildWhen":["Highly customized internal authorization matrix engines."],"buyWhen":["Modern authorization engines (OpenFGA, Cedar, Zanzibar) with agent extensions."],"standardizeOn":["Authority Manifest Format","Delegation Chain Headers","Authority Lease API"]},"relatedLayers":["agent-identity-ownership","runtime-policy-enforcement","human-approval"],"relatedProducts":[{"name":"Enterprise Hypervisor","role":"Evaluate & enforce delegated authority at runtime","status":"Available"}],"assessmentQuestions":[{"question":"Can agents delegate work and authority to other sub-agents?","options":["No delegation allowed","Yes with limited authority transfer","Yes without authority transfer","Unbounded delegation","Unknown"]}]},{"id":"layer-9","slug":"runtime-policy-enforcement","number":9,"groupId":"C","groupName":"Identity and control","title":"Policy and Runtime Enforcement","headline":"Evaluate Policy Before Consequential Actions Occur","definition":"The real-time Policy Decision Point (PDP) and Policy Enforcement Point (PEP) executing pre-action authorization rules before tool calls or external effects execute.","purpose":"Evaluates policy-as-code against current identity, authority, context, tool, model, budget, and approval state to issue Allow, Deny, Require Approval, Degrade, Throttle, Replan, Escalate, or Terminate decisions.","whyItExists":"Policies describe what should happen but cannot stop what is happening if they run only after execution or exist solely as static PDF compliance documents.","enterpriseOwner":"Security, compliance, and architecture teams","minimumRequirements":["Policy-as-code engine (OPA/Rego/Cedar)","Pre-action Policy Enforcement Point PEP","Policy Decision Point PDP evaluating contextual state","Multi-input evaluation (Identity + Authority + Context + Tool + Model + Budget + Approval)","Real-time decision spectrum (Allow, Deny, Approval, Degrade, Throttle, Replan, Terminate)","Sub-10ms decision latency","Signed Policy Decision Records for every evaluation"],"requiredInterfaces":{"inputs":["Proposed Action","Agent Passport","Runtime Context State"],"outputs":["Policy Decision (Allow/Deny/Approval)","Policy Decision Record","Enforcement Instruction"]},"commonFailures":["Post-action logging alerts security 2 hours AFTER an unauthorized wire transfer occurred.","Policy rules hardcoded into python files unable to be updated during an active security breach.","Inconsistent policy decisions across different cloud regions or agent frameworks."],"controlQuestions":["Does policy evaluation execute BEFORE consequential tool calls hit external APIs?","Can security teams update runtime policy rules globally without re-deploying agent code?","What happens when policy evaluation times out or encounters an error (Fail Closed vs Fail Open)?"],"evidenceProduced":["Policy Decision Record","Enforcement Action Receipt","Decision Rationale Log","Runtime Context Snapshot","Policy Version Manifest"],"buyingQuestions":["Can the policy engine evaluate complex graph and temporal conditions in real time?","Does the PEP support inline sidecar/proxy insertion for any framework?"],"maturityCriteria":[{"stage":"Stage 0","description":"Hardcoded if/else statements in agent prompt code."},{"stage":"Stage 1","description":"Basic input guardrails for prompt toxicity."},{"stage":"Stage 2","description":"Centralized API gateway rate limiting."},{"stage":"Stage 3","description":"Policy-as-code PDP/PEP enforcing pre-action controls."},{"stage":"Stage 4","description":"Context-aware dynamic policy with risk degradation and throttling."},{"stage":"Stage 5","description":"Formal verification of policy logic with deterministic decision receipts."}],"buildVsBuy":{"buildWhen":["Simple internal custom PEP middleware wrappers."],"buyWhen":["Enterprise Policy Decision engines, Agent Hypervisors, Guardrail gateways."],"standardizeOn":["Policy Decision Record Schema","PEP Sidecar Interface","Policy-as-Code Syntax"]},"relatedLayers":["authority-delegation","human-approval","runtime-budget-governance","evidence-audit"],"relatedProducts":[{"name":"Enterprise Hypervisor","role":"Pre-action policy evaluation & decision runtime","status":"Available"}],"assessmentQuestions":[{"question":"Can policy evaluation stop a tool call before it executes in production systems?","options":["Yes across all material actions","Yes for selected tools","Approval required first","Detection occurs after execution","No runtime enforcement"]}]},{"id":"layer-10","slug":"human-approval","number":10,"groupId":"C","groupName":"Identity and control","title":"Human Escalation and Approval","headline":"Put People in the Decisions That Need Them","definition":"The human-in-the-loop workflow, escalation protocol, and approval management system for high-risk or irreversible agent actions.","purpose":"Routes risk-based approval requests with structured evidence objects, expected effects, reversibility options, and budget impacts to human reviewers.","whyItExists":"Universal human approval slows agents to zero utility, while no human approval leads to catastrophic automated errors. Involvement must be risk-proportional.","enterpriseOwner":"Business and risk owners","minimumRequirements":["Risk-proportional approval trigger matrix","Structured Approval Request Object (Action, Agent, Objective, Evidence, Risk, Budget, Effect)","Multi-channel reviewer routing (Slack, Teams, Mobile App, Web Portal)","Approval expiration TTL & fallback escalation paths","Post-approval state change verification (preventing TOCTOU attacks)","Signed Human Approval Receipts"],"requiredInterfaces":{"inputs":["Approval Request Object","Target Approver Role"],"outputs":["Approval Decision (Approved/Rejected/Modified)","Approval Receipt","Condition Constraints"]},"commonFailures":["Approval spam causing human reviewers to blind-approve all requests without reading evidence.","Time-of-check to time-of-use (TOCTOU) vulnerability where agent state changes between approval and execution.","Approval queues stalling time-critical workflows due to missing escalation rotas."],"controlQuestions":["What specific financial or data thresholds trigger mandatory human approval?","Does the approver see the exact context and evidence bundle the agent used to propose the action?","What verifies that the agent action executed after approval matched the approved specification exactly?"],"evidenceProduced":["Approval Request Manifest","Evidence Viewed Log","Human Approval Decision Receipt","Approval Condition Record","Post-Approval Execution Verification"],"buyingQuestions":["Can human approvers modify parameters or downgrade authority directly within the approval UI?","Does the system provide SLA tracking and auto-escalation for pending approvals?"],"maturityCriteria":[{"stage":"Stage 0","description":"Manual copy-pasting of agent output into chat."},{"stage":"Stage 1","description":"Hardcoded email alerts for every execution."},{"stage":"Stage 2","description":"Slack/Teams buttons for selected write actions."},{"stage":"Stage 3","description":"Risk-rated approval matrix with rich evidence objects."},{"stage":"Stage 4","description":"TOCTOU-protected post-approval change checks and delegation escalation."},{"stage":"Stage 5","description":"Adaptive human-in-the-loop routing based on real-time agent confidence scores."}],"buildVsBuy":{"buildWhen":["Internal custom ticketing or workflow UI integrations."],"buyWhen":["Enterprise Human-in-the-loop platforms, Decision Hypervisors."],"standardizeOn":["Approval Request Schema","Human Decision Receipt","Escalation Event Headers"]},"relatedLayers":["runtime-policy-enforcement","authority-delegation","evidence-audit"],"relatedProducts":[{"name":"Decision Hypervisor","role":"Control high-impact decisions, rules & evidence","status":"Available"}],"assessmentQuestions":[{"question":"Which agent actions require human approval before execution?","options":["Material / Financial / Regulated actions","All write actions","High cost actions","Random sampling","No human approval required"]}]},{"id":"layer-11","slug":"runtime-budget-governance","number":11,"groupId":"C","groupName":"Identity and control","title":"Runtime Budget Governance","headline":"Control Agent Cost While the Work Is Still Running","definition":"The financial guardrails, cost reservation, token cap, API spend, and compute budget management system active during agent execution.","purpose":"Monitors spend across 11 dimensions: objective budget, model cost, tokens, tool cost, retrieval cost, compute, duration, rows scanned, retries, replanning, and delegation depth.","whyItExists":"An unmonitored agent entering an unconstrained loop can burn tens of thousands of dollars in LLM tokens and API fees in minutes.","enterpriseOwner":"FinOps, platform, and business owner","minimumRequirements":["Pre-execution cost reservation & soft/hard spending caps","Multi-dimension tracking (Tokens, Model $, Tool $, Compute, Time, Retries)","Real-time runtime responses (Continue, Degrade Model, Reduce Context, Limit Scope, Require Approval, Terminate)","Objective-level & Agent-level budget allocation","FinOps cost allocation tagging by business unit and objective ID","Reconciliation & prevented spend reporting"],"requiredInterfaces":{"inputs":["Budget Allocation","Estimated Action Cost","Current Spend Telemetry"],"outputs":["Budget Authorization Decision","Cost Reservation Receipt","Intervention Event"]},"commonFailures":["Surprise $50k cloud bill caused by recursive sub-agent planning loop over a weekend.","Agent running out of budget mid-transaction leaving external systems in an inconsistent state.","FinOps unable to attribute AI costs to specific business units or customer projects."],"controlQuestions":["What is the maximum monetary budget allowed for a single agent run?","Can the runtime automatically switch an agent to a cheaper model when budget approaches 80%?","Is cost calculated and reserved BEFORE making high-cost API or inference calls?"],"evidenceProduced":["Budget Allocation Record","Cost Reservation Receipt","Token & Spend Consumption Log","Budget Threshold Alert","Prevented Spend Audit Report"],"buyingQuestions":["Does the budget engine support multi-cloud, multi-provider token and API pricing tables?","Can FinOps teams set spending policies per business unit without redeploying code?"],"maturityCriteria":[{"stage":"Stage 0","description":"No cost tracking until monthly API bills arrive."},{"stage":"Stage 1","description":"Basic daily API spending alerts."},{"stage":"Stage 2","description":"Token counting logged to observability dashboards."},{"stage":"Stage 3","description":"Bounded token caps per execution loop with automated cutoff."},{"stage":"Stage 4","description":"Real-time pre-execution budget reservations and model degradation."},{"stage":"Stage 5","description":"Predictive FinOps budget enforcement with automated reconciliation."}],"buildVsBuy":{"buildWhen":["Simple internal token counter utility hooks."],"buyWhen":["AI FinOps platforms, Runtime Budget Managers, AI Gateways."],"standardizeOn":["Budget Reservation API","Spend Telemetry Headers","FinOps Tagging Format"]},"relatedLayers":["models-intelligence","runtime-policy-enforcement","agent-observability"],"relatedProducts":[{"name":"Enterprise Hypervisor","role":"Enforce pre-execution budget reservations & caps","status":"Available"}],"assessmentQuestions":[{"question":"Can a running agent workflow be throttled, degraded, or terminated when cost exceeds a threshold?","options":["Yes (Real-time enforcement)","For model tokens only","Alerts only (No enforcement)","No budget controls","Unknown"]}]},{"id":"layer-12","slug":"agent-observability","number":12,"groupId":"D","groupName":"Reliability and evidence","title":"Agent Observability","headline":"Observe Complete Agent Episodes, Not Isolated API Calls","definition":"The telemetry, tracing, trajectory monitoring, and episode recording infrastructure designed specifically for multi-step agent reasoning and tool usage.","purpose":"Captures full agent trajectories (objective, requester, agent identity, user identity, context, plans, model calls, tool calls, delegations, policy decisions, budget events, approvals, side-effects, outcomes).","whyItExists":"Agent failures often emerge across a sequence of choices. Traditional APM tools showing isolated HTTP requests miss the reasoning trajectory and root cause of goal drift.","enterpriseOwner":"SRE and AI platform team","minimumRequirements":["OpenTelemetry-compliant Agent Trajectory Tracing (Traces, Spans, Events)","Complete Agent Episode recording linking all sub-agent spans","Context, plan, model, tool, policy, budget, and outcome telemetry link","Real-time trajectory anomaly detection & latency profiling","Side-effect execution tracking","Searchable episode trajectory index"],"requiredInterfaces":{"inputs":["Span Event Telemetry","Agent Passport Header","State Transition Payload"],"outputs":["Episode Trace Record","Trajectory Graph","Anomaly Alert"]},"commonFailures":["Security incidents cannot be investigated because logs show LLM responses but not tool parameters.","SREs unable to debug why an agent got stuck in a 10-step loop.","High latency impossible to diagnose between model generation, vector search, and API calls."],"controlQuestions":["Can your engineering team replay and visualize the complete 15-step trajectory of a failed run?","Are OpenTelemetry trace IDs propagated across multi-agent delegation boundaries?","How quickly can SREs query all agent episodes that called a specific database tool yesterday?"],"evidenceProduced":["Agent Episode Record","Trajectory Trace Graph","Span Event Timeline","Tool Execution Telemetry","Cost & Latency Breakdown Report"],"buyingQuestions":["Does the observability platform support specialized LLM/Agent spans (GenAI OpenTelemetry semantic conventions)?","Can telemetry data be exported to enterprise SIEM/Datadog/Splunk instances?"],"maturityCriteria":[{"stage":"Stage 0","description":"Console.log statements in cloud run scripts."},{"stage":"Stage 1","description":"Centralized log aggregator collecting text outputs."},{"stage":"Stage 2","description":"Basic LLM trace tool (LangSmith, Phoenix) tracking prompt-response."},{"stage":"Stage 3","description":"OpenTelemetry-compliant episode tracing linking tools, policy, and model calls."},{"stage":"Stage 4","description":"Real-time trajectory monitoring with automated anomaly alerts."},{"stage":"Stage 5","description":"Full episode replayability with deterministic causality analysis."}],"buildVsBuy":{"buildWhen":["OpenTelemetry collector configurations and custom dashboarding."],"buyWhen":["Specialized Agent Observability suites, Datadog/Dynatrace GenAI modules."],"standardizeOn":["OpenTelemetry Semantic Conventions for GenAI","Episode ID Propagation"]},"relatedLayers":["agent-framework-runtime","agent-evaluation","evidence-audit"],"relatedProducts":[{"name":"HeadlessAnalytics","role":"Analyze complete episodes, evaluations & failures","status":"Available"}],"assessmentQuestions":[{"question":"Can your organization reconstruct a complete agent episode trajectory from objective to outcome?","options":["Yes complete trajectory","Partially","Only model API calls","Only basic text logs","No logs available"]}]},{"id":"layer-13","slug":"agent-evaluation","number":13,"groupId":"D","groupName":"Reliability and evidence","title":"Evaluation","headline":"Evaluate the Entire Path From Objective to Outcome","definition":"The continuous testing, benchmark, trajectory evaluation, and quality assurance framework running across development, pre-deployment, shadow, and production environments.","purpose":"Measures objective interpretation, context selection, plan quality, model behavior, tool arguments, recovery efficiency, policy adherence, cost efficiency, and outcome correctness.","whyItExists":"A successful LLM HTTP 200 run is easily mistaken for a correct business outcome. Without continuous evaluation, regression errors compound silently across system updates.","enterpriseOwner":"AI quality and domain owners","minimumRequirements":["14 Evaluation Types (Objective, Context, Plan, Model, Tool, Arguments, Recovery, Delegation, Policy, Cost, Output, Side-effect, Outcome, Control-effectiveness)","7 Evaluation Stages (Dev, Pre-deploy, Shadow, Limited Prod, Continuous Prod, Post-incident, Post-component change)","Curated golden dataset benchmarks","Automated regression testing pipelines","Control-effectiveness testing","Release decision gate integration"],"requiredInterfaces":{"inputs":["Completed Episode Trace","Golden Reference Dataset","Evaluation Criteria"],"outputs":["Evaluation Scorecard","Failure Analysis Report","Release Decision Gate"]},"commonFailures":["Updating a system prompt breaks 30% of downstream tool call parameters unnoticed.","Agent passes unit tests on simple synthetic data but fails catastrophically on messy enterprise inputs.","Evaluating only final text output while ignoring incorrect database writes caused along the way."],"controlQuestions":["Are evaluations run continuously against live production sampling or only before release?","Do you evaluate whether tool execution side-effects were correct or only if the API returned 200 OK?","What automated test blocks deployment if an agent's policy adherence score drops below 98%?"],"evidenceProduced":["Evaluation Dataset Record","Test Suite Scorecard","Control-Effectiveness Report","Regression Failure Analysis","Release Decision Certificate"],"buyingQuestions":["Does the evaluation framework support LLM-as-a-judge, programmatic assertion, and human feedback loops?","How are production evaluation samples selected without violating user privacy rules?"],"maturityCriteria":[{"stage":"Stage 0","description":"Manual eyeballing of sample responses."},{"stage":"Stage 1","description":"Static test prompt list run before releases."},{"stage":"Stage 2","description":"Automated LLM-as-a-judge evaluation of text outputs."},{"stage":"Stage 3","description":"Trajectory-level evaluation checking plan quality and tool correctness."},{"stage":"Stage 4","description":"Continuous production sampling with automated regression blocks."},{"stage":"Stage 5","description":"Formal control-effectiveness testing with automated dataset generation."}],"buildVsBuy":{"buildWhen":["Domain-specific evaluation scoring algorithms and assertion frameworks."],"buyWhen":["Managed AI evaluation platforms, Evals-as-a-Service suites."],"standardizeOn":["Evaluation Scorecard Format","Golden Dataset Standards","Test Result Schema"]},"relatedLayers":["agent-observability","evidence-audit","deployment-operations"],"relatedProducts":[{"name":"EnterpriseVerification","role":"Verify execution, controls, side-effects & outcomes","status":"Available"}],"assessmentQuestions":[{"question":"Are agents evaluated continuously in production or only during development?","options":["Continuously in production","Periodically","Pre-deployment only","Informally","No formal evaluation"]}]},{"id":"layer-14","slug":"evidence-audit","number":14,"groupId":"D","groupName":"Reliability and evidence","title":"Audit and Decision-Grade Evidence","headline":"Preserve Evidence That Explains What Happened and Why","definition":"The immutable audit, Decision Receipt, Evidence Manifest, and cryptographic record-keeping layer for regulatory, legal, and compliance accountability.","purpose":"Answers 12 material audit questions: What happened? Which identity acted? Which authority applied? Which objective? Which context? Which model? Which tool? Which policy? Which approval? What runtime decision? What side-effect? Was outcome verified?","whyItExists":"Logs show events, but Decision-Grade Evidence connects identity, authority, context, policy, approval, execution, side-effects, and outcome into an indisputable legal proof.","enterpriseOwner":"Risk, compliance, and security team","minimumRequirements":["Cryptographically signed Decision Receipts for all consequential decisions","Evidence Event & Evidence Manifest generation","Complete Execution Record linking Context Bundle + Policy Decision + Outcome Verification","Tamper-evident, immutable storage (WORM / Ledger)","Trace-linked evidence correlation","Audit export formats (JSON-LD, PDF, CSV)","Legal & regulatory compliance mapping (EU AI Act, SOC2, HIPAA, ISO 42001)"],"requiredInterfaces":{"inputs":["Episode Events","Policy Receipts","Verification Records"],"outputs":["Evidence Manifest","Decision Receipt","Compliance Audit Package"]},"commonFailures":["Inability to defend an agent decision during a regulatory inquiry because raw logs were rotated out after 30 days.","Logs missing the exact prompt context or user permissions present when a disputed action took place.","Audit logs stored in editable text files vulnerable to internal tampering."],"controlQuestions":["Can your organization generate a cryptographically verifiable Decision Receipt for any financial transaction executed by an agent?","Does the audit trail prove that the human approval was granted BEFORE the tool action executed?","How are audit records preserved during incident investigations and legal holds?"],"evidenceProduced":["Evidence Event","Evidence Manifest","Decision Receipt","Execution Record","Outcome Verification Record"],"buyingQuestions":["Does the evidence system support WORM (Write Once Read Many) immutable enterprise storage?","Are evidence artifacts formatted to satisfy EU AI Act conformity assessment requirements?"],"maturityCriteria":[{"stage":"Stage 0","description":"Ephemeral debug console logs."},{"stage":"Stage 1","description":"Standard cloud watch text log retention."},{"stage":"Stage 2","description":"Structured JSON log files stored in cloud buckets."},{"stage":"Stage 3","description":"Decision receipts linking identity, policy, and tool execution."},{"stage":"Stage 4","description":"Immutable WORM evidence manifests with tamper-evident checksums."},{"stage":"Stage 5","description":"Cryptographically certified Decision Receipts with mathematical proof of outcome verification."}],"buildVsBuy":{"buildWhen":["Internal compliance report generation scripts."],"buyWhen":["Enterprise AI Audit Ledger, Evidence & Control Plane platforms."],"standardizeOn":["Decision Receipt Schema","Evidence Manifest Format","WORM Storage Protocols"]},"relatedLayers":["agent-identity-ownership","runtime-policy-enforcement","human-approval","agent-observability"],"relatedProducts":[{"name":"EnterpriseContextGraph","role":"Preserve evidence lineage & decision records","status":"Available"},{"name":"EnterpriseVerification","role":"Generate decision receipts & verified outcome records","status":"Available"}],"assessmentQuestions":[{"question":"Does every material agent action produce a durable, audit-grade Decision Receipt?","options":["Yes (Decision-grade evidence)","Partial receipts","Standard logs only","No evidence preserved","Unknown"]}]},{"id":"layer-15","slug":"deployment-operations","number":15,"groupId":"E","groupName":"Infrastructure","title":"Deployment and Operations","headline":"Run the Same Controls Across Cloud, Private, On-Prem, Edge, and Physical Systems","definition":"The deployment, environment isolation, containerization, SRE, kill-switch, and lifecycle infrastructure across SaaS, Public Cloud, Customer VPC, On-Premises, Air-Gapped, Edge, Kubernetes, and Physical/Robotic runtimes.","purpose":"Enforces environment isolation, signed deployments, version pinning, shadow mode, canary rollouts, rollback, instant kill-switches, credential rotation, and disaster recovery.","whyItExists":"Agent code deployed directly to cloud environments without deployment boundaries or instant kill-switches risks un-revokable runaway background jobs.","enterpriseOwner":"Cloud, platform, and SRE teams","minimumRequirements":["Multi-environment support (SaaS, VPC, On-prem, Air-gapped, Edge, Kubernetes)","Environment isolation boundaries (Dev vs Staging vs Prod)","Cryptographically signed code & container deployments","Version pinning for code, prompts, models, and dependencies","Shadow mode execution testing & canary deployment gates","Global Instant Kill Switch & Revocation Propagation","Automated rollback capabilities","Credential rotation & secret management"],"requiredInterfaces":{"inputs":["Deployment Package","Environment Configuration","Kill-Switch Signal"],"outputs":["Deployment Manifest","Health Status Telemetry","Revocation Confirmation"]},"commonFailures":["Deploying an updated prompt directly to production without canary testing breaks live customer sessions.","SREs unable to kill a malfunctioning background agent worker without killing the entire Kubernetes cluster.","Secrets hardcoded in agent environment variables exposed in crash dumps."],"controlQuestions":["Can an operator hit a single kill-switch to pause all active instances of a specific agent globally in under 1 second?","Are deployments cryptographically signed to prevent unauthorized code modifications in production?","Does the infrastructure support air-gapped deployment for highly classified or regulated workloads?"],"evidenceProduced":["Deployment Manifest","Environment Approval Record","Version Pinning Certificate","Rollback Execution Log","Kill-Switch Activation Receipt"],"buyingQuestions":["Does the platform support Docker/Kubernetes/Coolify deployment artifacts out of the box?","How does the control plane operate across hybrid-cloud and air-gapped environments?"],"maturityCriteria":[{"stage":"Stage 0","description":"Manual script execution on developer laptops."},{"stage":"Stage 1","description":"Basic CI/CD pipeline building single Docker container."},{"stage":"Stage 2","description":"Staging and Production environment separation."},{"stage":"Stage 3","description":"Signed container deployments with automated rollback triggers."},{"stage":"Stage 4","description":"Global kill-switch with shadow mode testing and secret rotation."},{"stage":"Stage 5","description":"Unified multi-cloud/edge control plane with continuous fault injection testing."}],"buildVsBuy":{"buildWhen":["Internal CI/CD deployment pipelines and Kubernetes manifests."],"buyWhen":["Enterprise Agent Deployment Control Planes, Hybrid-cloud agent runtimes."],"standardizeOn":["Deployment Manifest Schema","Kill-Switch API","Health Check Standards"]},"relatedLayers":["agent-framework-runtime","agent-identity-ownership","evidence-audit"],"relatedProducts":[{"name":"EON Robotics","role":"Apply governed execution to physical & edge environments","status":"Design partner"}],"assessmentQuestions":[{"question":"Does the organization have an instant kill-switch to suspend a running agent globally?","options":["Yes (<5 second global kill-switch)","Manual server termination","Credential revocation only","No kill-switch","Unknown"]}]}],"maturityModel":[{"stage":0,"name":"Experimenting","tagline":"Prompts, models, tools, and local demos.","characteristics":["Local scripts","Hardcoded API keys","No registry","Raw LLM outputs","Manual testing"],"coreRisk":"Capability grows faster than ownership and control."},{"stage":1,"name":"Connected","tagline":"Enterprise data and shared deployment.","characteristics":["RAG vector databases","API tool integrations","Shared cloud hosting","Basic auth tokens","Log outputs"],"coreRisk":"Agents gain enterprise reach without complete visibility."},{"stage":2,"name":"Observable","tagline":"Traces, logs, evaluations, and cost visibility.","characteristics":["OpenTelemetry traces","LLM prompt logging","Cost dashboards","Pre-release eval datasets","Run history"],"coreRisk":"The organization can see failures but may not stop them before execution."},{"stage":3,"name":"Governed","tagline":"Identity, ownership, permissions, and approvals.","characteristics":["Agent registry","Named owners","Workload identity","Parameter RBAC","Human approval workflows"],"coreRisk":"Governance may remain static while runtime conditions change."},{"stage":4,"name":"Controlled","tagline":"Pre-action enforcement, budgets, revocation, and safe degradation.","characteristics":["Pre-action PEP sidecars","Runtime budget reservations","Delegation caps","Global kill-switches","Circuit breakers"],"coreRisk":"Controls require evidence, testing, and operational maturity."},{"stage":5,"name":"Assured","tagline":"Decision-grade evidence, replay, continuous evaluation, and outcome verification.","characteristics":["Decision Receipts","Immutable WORM evidence","Episode replayability","Continuous eval in prod","Formal verification"],"coreRisk":"Requires ongoing maintenance and strict compliance synchronization."}],"portfolioMapping":[{"name":"EnterpriseACP","category":"Agent population and authority","description":"Register agents, assign ownership, define authority, manage lifecycle, and revoke access.","status":"Available"},{"name":"Enterprise Hypervisor","category":"Governed execution","description":"Evaluate whether a specific action may occur now under current identity, policy, context, budget, and approval conditions.","status":"Available"},{"name":"Decision Hypervisor","category":"Decision authorization","description":"Control high-impact decisions, decision objects, review rules, evidence requirements, and outcome conditions.","status":"Available"},{"name":"EnterpriseContextGraph","category":"Context and evidence","description":"Preserve permission-correct, time-correct context, lineage, decisions, policies, and evidence.","status":"Available"},{"name":"EnterpriseContextServer","category":"Context delivery","description":"Deliver the authorized context required for the approved objective.","status":"Available"},{"name":"AgentPlugin","category":"Tools and capabilities","description":"Define, register, mediate, and verify agent capabilities and tool operations.","status":"Available"},{"name":"LocalModels","category":"Models","description":"Discover, evaluate, deploy, route, and govern models under enterprise control.","status":"Available"},{"name":"OpenModels","category":"Model packaging","description":"Package model artifacts, manifests, provenance, and reproducible distributions.","status":"In development"},{"name":"HeadlessAnalytics","category":"Analytics and observability","description":"Analyze complete agent episodes, evaluations, costs, interventions, failures, and evidence.","status":"Available"},{"name":"EnterpriseVerification","category":"Verification","description":"Verify execution, controls, side effects, and required outcomes.","status":"Available"},{"name":"EON Robotics","category":"Physical execution","description":"Apply governed execution to robots, machines, edge systems, and physical environments.","status":"Design partner"}]}