The concern matrix

Some requirements belong to no single team: knowing who did what, protecting personal data, controlling cost. The concern matrix lists ten of them. They are the cross-cutting concerns that every layer must honour. For each one, the matrix names where the rule is owned and where a violation is actually stopped. Most failures happen in the hand-off between the two. A requirement passes from one part of the system to the next and is quietly weakened.

How to read it

A layer is one of the fourteen layers of systems a company runs and agents touch. Each layer page ends with its own row for the ten concerns, C1 to C10. This page shows them side by side. Three words carry the meaning.

• Owned means the layer defines the requirement and answers for it.
• Enforced means the place where a violation is actually stopped. That is often a different layer.
• Inherited means the layer must pass the requirement on without weakening it. Most defects live here, because a weakened requirement fails silently.

The matrix applies at every autonomy level on the autonomy contract. It tightens as autonomy rises.

foundation · matrix

Cross-cutting concerns need named homes

A concern that appears everywhere but is owned nowhere becomes a gap.

Area	Runtime	Data	Action	Records	Channels	Governance
Identity	·	·	Primary enforcement	·	·	·
Provenance	·	Attach at parse time	·	·	·	·
Evaluation	Pre-release gate	·	·	·	·	·
Cost	Per-run budget	·	·	·	·	·
Sovereignty	·	Classification route	·	·	·	·
Reversibility	·	·	·	Compensating action	·	·
Human oversight	·	·	·	·	·	Named accountability

Identity

• Action:Primary enforcement

Provenance

• Data:Attach at parse time

Evaluation

• Runtime:Pre-release gate

Cost

• Runtime:Per-run budget

Sovereignty

• Data:Classification route

Reversibility

• Records:Compensating action

Human oversight

• Governance:Named accountability

Diagram description: Heatmap concept showing identity, provenance, cost, evaluation, sovereignty, reversibility, and human oversight crossing all fourteen enterprise layers. The matrix crosses Identity, Provenance, Evaluation, Cost, Sovereignty, Reversibility, Human oversight with Runtime, Data, Action, Records, Channels, Governance. Annotated cells are Identity by Action: Primary enforcement; Provenance by Data: Attach at parse time; Evaluation by Runtime: Pre-release gate; Cost by Runtime: Per-run budget; Sovereignty by Data: Classification route; Reversibility by Records: Compensating action; Human oversight by Governance: Named accountability.

Owned and enforced

Seven rules that always hold

Seven rules came up on their own in three or more layers. So they are treated as rules that must always hold, not as recommendations.

1. A derived copy takes the strictest label of its sources. That includes chunksChunking. Splitting documents into pieces small enough for retrieval. How you split changes what the agent finds., embeddingsEmbedding. A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from., session files, tracesTrace. The step-by-step log of one agent run: what it read, what it called, and what it decided.Read the page and fine-tunedFine-tuning. Adjusting a model's internal weights with examples. Slow, hard to undo, and rarely the right first step. model weights.
2. A deletion reaches every copy, or it did not happen. When a record is deleted, so are its vectors, memories, traces, logs, eval datasets and other copies. The data-to-memory pipeline shows how.
3. Every layer falls back to a human queue. ContainmentContainment versus resolution. Containment counts conversations that never reached a person. Resolution counts problems actually solved. Target resolution. means conversations that never reach a person. It is never raised by making the human queue unavailable.
4. Logs are collected outside the agent's control. A log the agent can change is not proof.
5. The kill switch works from several points. It sits in the runtime, the gateway, the harness and the identity system. An outage in monitoring must not disable it.
6. Enforcement is fixed rules, outside the model. Rules may be written in the harness. They are enforced at the gateway or the policy decision point, as set out in enforcement outside the model.
7. Provenance travels inside the item. It is attached at parse time, when the document is first read. Provenance stored separately falls out of step when it matters.

Six open gaps

These problems have no complete published answer yet. The status is as of August 2026.

A worked example: erasing a customer at a utility

A former customer asks a utility to erase their personal data, where the law allows. The privacy rule is owned by governance, risk and sovereignty (R11). The deletion starts in the customer record system. Agent data engineering (R14) must carry it to the search index, the agents' memories and their traces. Observability and FinOps (R12) must remove the person from stored traces. If one hand-off is missed, the record is gone, but an agent can still answer questions about the customer.

Evidence and limits

The matrix comes from the fourteen layer research tracks. Each of the seven rules surfaced on its own in three or more layers. That is agreement between tracks, not a measured outcome. The gaps are dated August 2026, and some may have published answers since.

Next step

Run the agent day to day, starting with observability and FinOps.

Explore this topic

• The concerns-by-layers matrix
• All fourteen research tracks