The Reference Architecture for Production AI Agents
A 15-layer vendor-neutral framework for building, running, and governing autonomous AI agents in enterprise environments.
Identity • Ownership • Authority • Policy-as-Code • Human Approval • Pre-Action PEP • Budget Control • Evaluation • Observability • Decision Receipts • Revocation
- Pre-action PDP/PEP policy evaluation
- Runtime budget reservations
- Human-in-the-loop escalation
The Category Problem
Enterprise agent deployments are currently failing not because the underlying LLM models are weak, but because they are being deployed into production without a complete control and governance architecture.
The Control Plane Solution
A production agent framework must bind model proposals with real-time pre-action policy evaluation, authority delegation, runtime budget limits, human escalation, and tamper-evident Decision Receipts.
The Vendor-Neutral Standard
Keep the models and frameworks that already work (LangChain, CrewAI, OpenAI, Anthropic, AWS). Add the 15-layer control and evidence architecture across them.
Building an agent is easy. Operating one responsibly is the stack problem.
A prototype proves that an agent can perform a task. A production architecture must prove that the agent can operate within enterprise boundaries, recover from failure, and leave evidence behind.
Needs only intelligence and basic API tool connections to demonstrate a working demo loop.
- System Prompt in codebase
- Single LLM API model key
- Basic Agent Framework loop
- Un-scoped Tool API functions
- Local / ephemeral demo interface
- No identity or owner registration
- No pre-action policy check
- No budget caps or retry limits
- No audit-grade Decision Receipts
Requires full identity, authority, pre-action policy enforcement, evidence, and operations.
Organized into 5 Cohesive Architecture Groups
Every production agent system spans these 5 distinct functional groups, bound together by the Evidence and Control Plane.
Business and behavior
Defines business objectives, permitted autonomy, and runtime orchestration framework.
Intelligence and capabilities
Models, tool capabilities, permission-aware context retrieval, and managed memory.
Identity and control
Workload identity, delegated authority, pre-action runtime policy, human approval, and budgets.
Reliability and evidence
Episode tracing, continuous evaluation, decision receipts, and audit trails.
Infrastructure
Cloud, VPC, on-premises, edge, and physical execution operations with SRE controls.
Explore Every Layer of the Enterprise Agent Stack
Click any layer card to inspect minimum production requirements, common failure modes, required interfaces, enterprise ownership, and evidence output.
Agent Applications and Workflows
"Start With the Business Objective, Not the Model"
Defines business intent, success criteria, and user interaction surfaces for autonomous workflows.
Agent Framework and Runtime
"Control How the Agent Plans, Retries, Recovers, and Delegates"
Manages step execution, memory hydration, tool execution loops, retry strategies, and sub-agent delegation.
Models and Intelligence
"Use the Right Model for the Objective, Data, Risk, Cost, and Environment"
Routes prompts and context to appropriate models based on task complexity, data sensitivity, latency, and cost rules.
Tools and Capabilities
"Define What Every Tool Can Do Before an Agent Uses It"
Schema validation, read/write classification, resource scoping, transaction limits, idempotency enforcement, and side-effect controls.
Context and Knowledge
"Give Agents the Right Context, Under the Right Permissions, at the Right Time"
Enforces permission-correct retrieval, source identity verification, freshness limits, provenance tracking, and effective-time boundaries.
Agent Memory
"Control What Agents Remember, Reuse, Share, and Forget"
Manages memory types, origin tagging, validation state, decay, expiration, deletion, and cross-agent memory contamination controls.
Agent Identity and Ownership
"Give Every Production Agent an Identity, Purpose, and Owner"
Assigns verifiable SPIFFE/OAuth workload identity, logical IDs, environmental scopes, approved purpose definitions, and named business/technical/security owners.
Authority and Delegation
"Define What Each Agent May Do—and What It May Delegate"
Enforces authority scoping across 12 dimensions: capability, resource, purpose, environment, time, amount, customer, region, risk, approval, delegation, and budget.
Policy and Runtime Enforcement
"Evaluate Policy Before Consequential Actions Occur"
Evaluates policy-as-code against current identity, authority, context, tool, model, budget, and approval state to issue Allow, Deny, Require Approval, Degrade, Throttle, Replan, Escalate, or Terminate decisions.
Human Escalation and Approval
"Put People in the Decisions That Need Them"
Routes risk-based approval requests with structured evidence objects, expected effects, reversibility options, and budget impacts to human reviewers.
Runtime Budget Governance
"Control Agent Cost While the Work Is Still Running"
Monitors spend across 11 dimensions: objective budget, model cost, tokens, tool cost, retrieval cost, compute, duration, rows scanned, retries, replanning, and delegation depth.
Agent Observability
"Observe Complete Agent Episodes, Not Isolated API Calls"
Captures full agent trajectories (objective, requester, agent identity, user identity, context, plans, model calls, tool calls, delegations, policy decisions, budget events, approvals, side-effects, outcomes).
Evaluation
"Evaluate the Entire Path From Objective to Outcome"
Measures objective interpretation, context selection, plan quality, model behavior, tool arguments, recovery efficiency, policy adherence, cost efficiency, and outcome correctness.
Audit and Decision-Grade Evidence
"Preserve Evidence That Explains What Happened and Why"
Answers 12 material audit questions: What happened? Which identity acted? Which authority applied? Which objective? Which context? Which model? Which tool? Which policy? Which approval? What runtime decision? What side-effect? Was outcome verified?
Deployment and Operations
"Run the Same Controls Across Cloud, Private, On-Prem, Edge, and Physical Systems"
Enforces environment isolation, signed deployments, version pinning, shadow mode, canary rollouts, rollback, instant kill-switches, credential rotation, and disaster recovery.
The Evidence and Control Plane in Action
Models, frameworks, tools, and data do not govern themselves. Watch how pre-action policy evaluation, budget reservations, human approvals, and cryptographic evidence bind every single agent tool call.
Agent Proposes Tool Call
Agent proposes tool invocation: execute_wire_transfer({ amount: "$5,000", recipient: "vendor_881" })
{
"episode_id": "ep_88192a",
"step": 1,
"action": "propose_action",
"decision": "PROPOSED",
"timestamp": "2026-07-22T23:38:00.000Z",
"proof_hash": "sha256:8f9a2b7c..."
}Every production agent architecture should answer these questions
Before granting autonomous agents access to enterprise data or production systems, verify if your platform can definitively answer these 14 control questions.
Which agents exist?
Who owns each agent?
Which models may it use?
Which tools may it call?
Which data may it retrieve?
Which memory may it reuse?
Which actions may it take?
Can it delegate authority?
What is its budget?
Which actions require approval?
Can the runtime stop it?
Can the organization revoke it?
Can every episode be reconstructed?
Can the outcome be verified?
Take the interactive assessment to calculate your exact control score.
Measure how close your agent architecture is to governed production
Move from local prompt experimentation to decision-grade assured operations. Select a stage to view its architectural capabilities and core risks.
Identity, ownership, permissions, and approvals.
Added Capabilities & Features:
Core Architectural Risk:
Our 7-minute assessment scores your exact maturity stage across all 15 layers.
An agent stack is not production-ready until these controls work
Use this interactive acceptance checklist during architecture reviews to verify control completeness before promoting autonomous agents into live enterprise environments.
All active and historical agents exist in a single verified Enterprise Agent Registry.
Named business and technical owners are assigned with verified contact details.
Unique non-human machine credentials (SPIFFE/mTLS) isolated per environment.
Documented purpose contract defining permitted business tasks and boundaries.
LLMs are routed through governed gateways with pinned version numbers.
APIs and MCP tools enforce strict schema parameters and read/write classification.
RAG search preserves original source user ACLs and data sensitivity rules.
Long-term memory is validated before promotion and has automated TTL decay.
Pre-action Policy Enforcement Point (PEP) evaluates Allow/Deny before tool runs.
Hard monetary, token, compute, and retry caps enforced active during execution.
Financial or irreversible actions trigger human-in-the-loop review with evidence.
OpenTelemetry spans link context, plan, model call, tool call, and outcome.
Continuous sampling evaluates trajectory correctness and policy adherence in prod.
Global kill-switch suspends agent and revokes sub-agent delegation in under 5 seconds.
Database and external API modifications produce verified side-effect logs.
Full episode trajectories can be replayed deterministically for post-mortems.
Automated state rollback recovers systems from partial execution failures.
SRE runbooks and incident response rotas assigned specifically for agent failures.
You do not need to rebuild the entire stack
Most enterprises already have valuable components. Keep the components that work. Build what differentiates you. Buy what is operationally heavy. Integrate what already exists. Standardize controls across them.
Build when capability is strategically unique and proprietary
Apply This Strategy When:
Recommended Layers for Build:
Production architecture depends on contracts between layers
Products do not become a stack merely because they are purchased together. They become a stack when their identities, policies, decisions, events, and evidence can be connected through explicit interfaces.
Every layer needs a named enterprise owner
An unowned layer becomes an uncontrolled boundary. Assigning explicit organizational responsibility ensures incident response, policy enforcement, and SLA alignment.
| Layer # | Architecture Layer | Likely Enterprise Owner | Risk of Missing Ownership |
|---|---|---|---|
| Layer 1 | Agent Applications and Workflows | Business owner and product team | Teams start with a model and tools but cannot clearly state what success or acceptable autonomy means. |
| Layer 2 | Agent Framework and Runtime | AI platform team | Infinite retry loops consuming massive API costs on broken tools. |
| Layer 3 | Models and Intelligence | Model governance and AI platform team | Data leakage by sending PII to public, non-compliant third-party models. |
| Layer 4 | Tools and Capabilities | Platform engineering and application owners | Agent calling a write endpoint with unvalidated parameters causing database corruption. |
| Layer 5 | Context and Knowledge | Data, knowledge, and security teams | Agent retrieves salary records because vector search indexed files without ACL metadata. |
| Layer 6 | Agent Memory | AI platform and data governance team | An agent hallucinates a customer discount, stores it in long-term memory, and honors it for months. |
| Layer 7 | Agent Identity and Ownership | IAM and security team | Rogue agents created by shadow IT running under developer personal credentials. |
| Layer 8 | Authority and Delegation | Security, risk, and business owners | An agent with database read credentials delegates unrestricted write commands to a child worker. |
| Layer 9 | Policy and Runtime Enforcement | Security, compliance, and architecture teams | Post-action logging alerts security 2 hours AFTER an unauthorized wire transfer occurred. |
| Layer 10 | Human Escalation and Approval | Business and risk owners | Approval spam causing human reviewers to blind-approve all requests without reading evidence. |
| Layer 11 | Runtime Budget Governance | FinOps, platform, and business owner | Surprise $50k cloud bill caused by recursive sub-agent planning loop over a weekend. |
| Layer 12 | Agent Observability | SRE and AI platform team | Security incidents cannot be investigated because logs show LLM responses but not tool parameters. |
| Layer 13 | Evaluation | AI quality and domain owners | Updating a system prompt breaks 30% of downstream tool call parameters unnoticed. |
| Layer 14 | Audit and Decision-Grade Evidence | Risk, compliance, and security team | Inability to defend an agent decision during a regulatory inquiry because raw logs were rotated out after 30 days. |
| Layer 15 | Deployment and Operations | Cloud, platform, and SRE teams | Deploying an updated prompt directly to production without canary testing breaks live customer sessions. |
What fails when a layer is missing?
Architectural gaps produce compound failure modes. Here is what happens in enterprise production when critical control layers are omitted.
"The organization cannot identify or locate every active production agent."
"Incidents have no accountable responder or defined SLA runbook."
"Raw API credentials become a substitute for permission, exposing write endpoints."
"Agents retrieve information outside original requester or purpose boundaries."
"Generated hallucinated conclusions silently become trusted future context."
"Policies describe what should happen but cannot stop what is happening."
"Agents enter expensive retry, planning, or delegation loops."
"A successful LLM HTTP 200 run is mistaken for a correct business outcome."
"The organization cannot reconstruct why an action occurred during an audit."
"Access persists through sessions, delegations, tools, and credentials after compromise."
Enterprise Hypervisor
Enterprise Hypervisor connects agent identity, authority, context, models, tools, policies, budgets, approvals, evidence, and outcomes at runtime.
Capability-First Unifying Systems
EnterpriseACP
Register agents, assign ownership, define authority, manage lifecycle, and revoke access.
Enterprise Hypervisor
Evaluate whether a specific action may occur now under current identity, policy, context, budget, and approval conditions.
Decision Hypervisor
Control high-impact decisions, decision objects, review rules, evidence requirements, and outcome conditions.
EnterpriseContextGraph
Preserve permission-correct, time-correct context, lineage, decisions, policies, and evidence.
EnterpriseContextServer
Deliver the authorized context required for the approved objective.
AgentPlugin
Define, register, mediate, and verify agent capabilities and tool operations.
LocalModels
Discover, evaluate, deploy, route, and govern models under enterprise control.
OpenModels
Package model artifacts, manifests, provenance, and reproducible distributions.
HeadlessAnalytics
Analyze complete agent episodes, evaluations, costs, interventions, failures, and evidence.
EnterpriseVerification
Verify execution, controls, side effects, and required outcomes.
EON Robotics
Apply governed execution to robots, machines, edge systems, and physical environments.
Ready to govern your production agent fleet?
Book a 1-on-1 architecture review session with a Principal Enterprise AI Architect, or evaluate your stack controls with our 20-question diagnostic.