The concern matrix

How to read it

Every layerLayer (the fourteen layers). One of fourteen parts of the enterprise estate that agents touch, from infrastructure (R01) to agent data engineering (R14). page closes with its own row for the ten cross-cutting concernsCross-cutting concern. A requirement every layer must honour, such as identity, privacy, or cost, that no single team owns end to end., C1 to C10. A layer is one of the fourteen parts of the estate that agentsAgent. Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it. touch, and a concern is a requirement every layer must honour. This page is the view across all fourteen layers. Three words carry the distinction that matters. Owned means the layer defines the requirement and holds accountability for it. Enforced means the place where a violation is actually stopped, which is frequently a different layer. Inherited means the layer must carry the property through without weakening it. Inheritance is where most defects live, because it fails silently. The register applies at every autonomy levelAutonomy level (A0 to A5). How much an agent may do without a person in the loop, from manual (A0) to governed lights-out operation (A5). Set per task, not per agent. and tightens as autonomy rises.

foundation · matrix

Cross-cutting concerns need named homes

A concern that appears everywhere but is owned nowhere becomes a gap.

Dimension	Runtime	Data	Action	Records	Channels	Governance
Identity	·	·	Primary enforcement	·	·	·
Provenance	·	Attach at parse time	·	·	·	·
Evaluation	Pre-release gate	·	·	·	·	·
Cost	Per-run budget	·	·	·	·	·
Sovereignty	·	Classification route	·	·	·	·
Reversibility	·	·	·	Compensating action	·	·
Human oversight	·	·	·	·	·	Named accountability

Identity

• Action:Primary enforcement

Provenance

• Data:Attach at parse time

Evaluation

• Runtime:Pre-release gate

Cost

• Runtime:Per-run budget

Sovereignty

• Data:Classification route

Reversibility

• Records:Compensating action

Human oversight

• Governance:Named accountability

Diagram description: Heatmap concept showing identity, provenance, cost, evaluation, sovereignty, reversibility, and human oversight crossing all fourteen enterprise layers. The matrix crosses Identity, Provenance, Evaluation, Cost, Sovereignty, Reversibility, Human oversight with Runtime, Data, Action, Records, Channels, Governance. Annotated cells are Identity by Action: Primary enforcement; Provenance by Data: Attach at parse time; Evaluation by Runtime: Pre-release gate; Cost by Runtime: Per-run budget; Sovereignty by Data: Classification route; Reversibility by Records: Compensating action; Human oversight by Governance: Named accountability.

Reviewed 2026-08-20·Sources:Concerns-by-layers matrix

Owned and enforced

In short: For each requirement, this table names who sets the rule, who stops a violation, and what goes wrong when the two are confused.

Seven invariants

In short: Seven rules came up on their own in three or more layers, so the guide treats them as fixed requirements rather than recommendations.

Each surfaced independently in three or more layers, which is why they are invariants, rules that must always hold, rather than recommendations:

1. Derived artifacts inherit the strictest classificationClassification (data). A label for how sensitive data is. Anything derived from data inherits the strictest label of its sources. of their sources. That includes chunksChunking. Splitting documents into pieces small enough for retrieval. How you split changes what the agent finds., embeddingsEmbedding. A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from., session artifacts, tracesTrace. The step-by-step log of one agent run: what it read, what it called, and what it decided., and fine-tunedFine-tuning. Adjusting a model's internal weights with examples. Slow, hard to undo, and rarely the right first step. weights.
2. Erasure cascadesErasure cascade. When a record is deleted, every copy derived from it (embeddings, memories, traces, test data) is deleted too. or it did not happen. When a record is deleted, so are its vectors, memoriesAgent memory. What an agent keeps between tasks, from the current conversation up to long-term knowledge about customers or assets. The longer it is kept, the more privacy and retention duties it carries., traces, telemetryTelemetry. The stream of measurements a system emits about itself, collected centrally., evalEval (evaluation suite). A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change. datasets, and derived artifacts.
3. Every layer degrades to a human queue, and containmentContainment versus resolution. Containment counts conversations that never reached a person. Resolution counts problems actually solved. Target resolution. (conversations that never reach a person) is never manufactured by making the queue unavailable.
4. Telemetry is collected outside the agent's control. Self-report is testimony, not evidence.
5. The kill switchKill switch. A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it. is multi-point (runtimeAgent platform. The software that runs agents: the runtime, the harness, the list of approved agents, and the rules for how they start, stop, and change., gatewayGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded., harnessHarness. The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails., identity plane), and an observabilityObservability. Being able to see what agents did, step by step, from records the agent cannot alter. outage must not blind it.
6. Enforcement is deterministicDeterministic. Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary. and outside the modelModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do.. It is held in the harness and enforced at the gateway or policy decision point (PDP)Policy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it..
7. ProvenanceProvenance. The record of where a piece of information came from, carried with it so every answer can be traced back to its source. travels inside the artifact, attached at parse time, when the document is first processed; provenance stored alongside is out of sync when it matters.

The open gaps

In short: Six problems have no complete solution anywhere yet, and the guide says so rather than pretending otherwise.

The gaps below are published as unsolved. A matrix without holes would be the least credible artifact in this guide.

The research behind this page

• The concerns-by-layers matrix
• All fourteen research tracks