The fourteen layers
One page for each of the fourteen parts of the enterprise estate that agents touch: what good looks like, how it is built, the choices made, and what the evidence supports.
The estate you already own has fourteen layers. The agent system you build across it has seven planes. Each page below covers one layer in five parts. First, the target state: the architecture to aim for. Second, the mechanisms that implement it, with their exact protocols and measured numbers. Third, the contested choices, each with a verdict. Fourth, the layer's cross-cutting concern row: the requirements every layer must honour, such as identity, privacy, and cost. Fifth, what the evidence does not support.
foundation · matrix
Fourteen estate layers, seven agent-system planes
Layers describe what the enterprise owns; planes describe how governed agent work operates across it.
R01 Infrastructure
- Execution:Runtime and model serving
R02 Data platform
- Knowledge:Governed source data
R03 Integration fabric
- Action:Gateway and tool path
R04 Systems of record
- Action:Authoritative action boundary
R05 LOB and OT
- Action:Operational actuation boundary
R06 Intelligence and learning
- Improvement:Evaluation and promotion
R07 Agent platform
- Execution:Agent runtime
- Control:Registry and runtime controls
R08 Productivity and collaboration
- Human:Human work surface
R09 Experience and channels
- Human:Customer and employee edge
R10 Security and identity
- Control:Identity and policy
R11 Governance, risk and sovereignty
- Control:Risk and sovereignty rules
- Evidence:Decision and consultation records
R12 Observability and FinOps
- Evidence:Independent traces and cost
R13 Operating model
- Human:Accountability and supervision
R14 Agent data engineering
- Knowledge:Curation and memory
- Improvement:Eval-data flywheel
The cells show primary contributions, not exclusive ownership. Every deployed workload uses all seven planes across the relevant estate layers.
Diagram description: Crosswalk matrix showing fourteen enduring enterprise layers down the rows and seven agent-system planes across the columns, with several layers contributing to multiple planes. The matrix crosses R01 Infrastructure, R02 Data platform, R03 Integration fabric, R04 Systems of record, R05 LOB and OT, R06 Intelligence and learning, R07 Agent platform, R08 Productivity and collaboration, R09 Experience and channels, R10 Security and identity, R11 Governance, risk and sovereignty, R12 Observability and FinOps, R13 Operating model, R14 Agent data engineering with Execution, Action, Knowledge, Control, Improvement, Evidence, Human. Annotated cells are R01 Infrastructure by Execution: Runtime and model serving; R02 Data platform by Knowledge: Governed source data; R03 Integration fabric by Action: Gateway and tool path; R04 Systems of record by Action: Authoritative action boundary; R05 LOB and OT by Action: Operational actuation boundary; R06 Intelligence and learning by Improvement: Evaluation and promotion; R07 Agent platform by Execution: Agent runtime; R07 Agent platform by Control: Registry and runtime controls; R08 Productivity and collaboration by Human: Human work surface; R09 Experience and channels by Human: Customer and employee edge; R10 Security and identity by Control: Identity and policy; R11 Governance, risk and sovereignty by Control: Risk and sovereignty rules; R11 Governance, risk and sovereignty by Evidence: Decision and consultation records; R12 Observability and FinOps by Evidence: Independent traces and cost; R13 Operating model by Human: Accountability and supervision; R14 Agent data engineering by Knowledge: Curation and memory; R14 Agent data engineering by Improvement: Eval-data flywheel. Important boundary: The cells show primary contributions, not exclusive ownership. Every deployed workload uses all seven planes across the relevant estate layers.
Execution and platform
- Target state in one line
- Per-session isolation, microVM sandboxes behind egress proxies for act-capable work, first-class workload identity, classification-routed serving
- Layer
- R07 Agent platform
- Target state in one line
- Buy the runtime, build the harness: explicit termination, artifacts-as-state, separate verification, registry with eval-gated promotion
Action
- Target state in one line
- A governed tool plane with one gateway as the enforcement point for identity, credentials, inspection, and audit
- Target state in one line
- Wrap, do not reinvent: agents act as the requesting user, entitlement stays in the record system
- Target state in one line
- Agents on the information path, never the control path, behind a validated presentation layer
Knowledge
- Layer
- R02 Data platform
- Target state in one line
- Grounding as a governed product: permission-aware indexes, pre-filtered retrieval, semantic contracts where determinism is required
- Target state in one line
- A curation pipeline with named ownership, provenance from parse time, governed memory writes, cascading erasure
Control and evidence
- Target state in one line
- Registered least-privileged identities and a deterministic policy decision point on every consequential action
- Target state in one line
- The registry as compliance inventory, a two-tier evidence posture, classification-routed deployment
- Target state in one line
- End-to-end traces the agent cannot forge, on a translation layer, with deterministic budget enforcement
Improvement
- Target state in one line
- Expert-owned evals, calibrated judges, promotion gated on counterexample survival with a demotion path
Human-facing surfaces
- Target state in one line
- Access identity as the universal default, presence granted per capability surface and rarely
- Target state in one line
- A separate customer-facing edge on a shared control plane, justified by legal exposure
- Target state in one line
- Supervision as a queueing system: capacity with wait time included, load budgeted as a burst rate
How the pages are built
Each page condenses one research track. The tracks, with their briefs, findings, vendor maps, and dated sources, are in the research library. Where the evidence does not support a claim, the page says so and names the refusal. The decision catalog carries every contested choice, with its verdict and the discriminator: the one test that separates the options.
The concern matrix
Ten cross-cutting concerns against fourteen layers: who owns each, who enforces it, and the six gaps with no complete answer anywhere.
Infrastructure and compute
Where agents run: each session isolated, risky work in locked-down sandboxes, every agent with its own identity, and model access metered and routed by data sensitivity.