The fourteen layers

The fourteen parts of the enterprise estate that agents touch, grouped by the job they do, with one page for each: what sits there today, what agents add, and what must be true first.

Agents do not arrive on a blank page. They sit on technology a company already runs, from its servers to the people who supervise the work. This guide splits that estate into fourteen layers you own. Every agent passes through a lifecycle you run, from registration to retirement. Each stage of that lifecycle calls on seven capabilities you add, such as a tool gateway and an audit trail. Agents touch all fourteen layers. Find the layer you run in the groups below, and read its page.

foundation · matrix

Fourteen layers you own, seven capabilities you add

The layers are what the enterprise owns; the seven capabilities are what it adds so governed agent work can run across them.

Area	Runtime	Tool gateway	Knowledge and memory	Identity and policy	Evaluation and release	Observability and audit trail	Human oversight
R01 Infrastructure	Runtime and model serving	·	·	·	·	·	·
R02 Data platform	·	·	Governed source data	·	·	·	·
R03 Integration fabric	·	Gateway and tool path	·	·	·	·	·
R04 Systems of record	·	Authoritative action boundary	·	·	·	·	·
R05 LOB and OT	·	Operational actuation boundary	·	·	·	·	·
R06 Intelligence and learning	·	·	·	·	Evaluation and promotion	·	·
R07 Agent platform	Agent runtime	·	·	Registry and runtime controls	·	·	·
R08 Productivity and collaboration	·	·	·	·	·	·	Human work surface
R09 Experience and channels	·	·	·	·	·	·	Customer and employee edge
R10 Security and identity	·	·	·	Identity and policy	·	·	·
R11 Governance, risk and sovereignty	·	·	·	Risk and sovereignty rules	·	Decision and consultation records	·
R12 Observability and FinOps	·	·	·	·	·	Independent traces and cost	·
R13 Operating model	·	·	·	·	·	·	Accountability and supervision
R14 Agent data engineering	·	·	Curation and memory	·	Eval-data flywheel	·	·

R01 Infrastructure

Runtime:Runtime and model serving

R02 Data platform

Knowledge and memory:Governed source data

R03 Integration fabric

Tool gateway:Gateway and tool path

R04 Systems of record

Tool gateway:Authoritative action boundary

R05 LOB and OT

Tool gateway:Operational actuation boundary

R06 Intelligence and learning

Evaluation and release:Evaluation and promotion

R07 Agent platform

Runtime:Agent runtime
Identity and policy:Registry and runtime controls

R08 Productivity and collaboration

Human oversight:Human work surface

R09 Experience and channels

Human oversight:Customer and employee edge

R10 Security and identity

Identity and policy:Identity and policy

R11 Governance, risk and sovereignty

Identity and policy:Risk and sovereignty rules
Observability and audit trail:Decision and consultation records

R12 Observability and FinOps

Observability and audit trail:Independent traces and cost

R13 Operating model

Human oversight:Accountability and supervision

R14 Agent data engineering

Knowledge and memory:Curation and memory
Evaluation and release:Eval-data flywheel

The cells show primary contributions, not exclusive ownership. Every deployed workload uses all seven capabilities across the relevant layers.

A layer can contribute to more than one capability; the capabilities cut across the estate rather than containing its layers.

Diagram description: Crosswalk matrix showing the fourteen enterprise layers down the rows and the seven agent platform capabilities across the columns, with several layers contributing to more than one capability. The matrix crosses R01 Infrastructure, R02 Data platform, R03 Integration fabric, R04 Systems of record, R05 LOB and OT, R06 Intelligence and learning, R07 Agent platform, R08 Productivity and collaboration, R09 Experience and channels, R10 Security and identity, R11 Governance, risk and sovereignty, R12 Observability and FinOps, R13 Operating model, R14 Agent data engineering with Runtime, Tool gateway, Knowledge and memory, Identity and policy, Evaluation and release, Observability and audit trail, Human oversight. Annotated cells are R01 Infrastructure by Runtime: Runtime and model serving; R02 Data platform by Knowledge and memory: Governed source data; R03 Integration fabric by Tool gateway: Gateway and tool path; R04 Systems of record by Tool gateway: Authoritative action boundary; R05 LOB and OT by Tool gateway: Operational actuation boundary; R06 Intelligence and learning by Evaluation and release: Evaluation and promotion; R07 Agent platform by Runtime: Agent runtime; R07 Agent platform by Identity and policy: Registry and runtime controls; R08 Productivity and collaboration by Human oversight: Human work surface; R09 Experience and channels by Human oversight: Customer and employee edge; R10 Security and identity by Identity and policy: Identity and policy; R11 Governance, risk and sovereignty by Identity and policy: Risk and sovereignty rules; R11 Governance, risk and sovereignty by Observability and audit trail: Decision and consultation records; R12 Observability and FinOps by Observability and audit trail: Independent traces and cost; R13 Operating model by Human oversight: Accountability and supervision; R14 Agent data engineering by Knowledge and memory: Curation and memory; R14 Agent data engineering by Evaluation and release: Eval-data flywheel. Important boundary: The cells show primary contributions, not exclusive ownership. Every deployed workload uses all seven capabilities across the relevant layers.

Run the agents

Layer	What good looks like
Infrastructure and compute (R01)	Each agent session is sealed off, with one guarded exit and its own identity. Model capacity is rented by default
Agent platform (R07)	Buy the runtime that runs agents. Build your own code around the model, and test every change before release

Layer: Infrastructure and compute (R01)
What good looks like: Each agent session is sealed off, with one guarded exit and its own identity. Model capacity is rented by default

Layer: Agent platform (R07)
What good looks like: Buy the runtime that runs agents. Build your own code around the model, and test every change before release

Let them act

Layer	What good looks like
Integration fabric (R03)	One tool gateway checks every agent request, supplies the credentials and keeps the record
Systems of record (R04)	Agents act as the person who asked. The business system keeps its own permission checks
Line of business and OT (R05)	Agents advise the people who run equipment. They never control it

Layer: Integration fabric (R03)
What good looks like: One tool gateway checks every agent request, supplies the credentials and keeps the record

Layer: Systems of record (R04)
What good looks like: Agents act as the person who asked. The business system keeps its own permission checks

Layer: Line of business and OT (R05)
What good looks like: Agents advise the people who run equipment. They never control it

Give them knowledge

Layer	What good looks like
Data platform (R02)	Agents find only what the person asking may open, and every answer shows its source
Agent data engineering (R14)	Data is prepared for agents with an owner and a source on every piece. Deletion reaches every copy

Layer: Data platform (R02)
What good looks like: Agents find only what the person asking may open, and every answer shows its source

Layer: Agent data engineering (R14)
What good looks like: Data is prepared for agents with an owner and a source on every piece. Deletion reaches every copy

Control and check them

Layer	What good looks like
Security and identity (R10)	Every agent has its own identity. A fixed rule outside the model checks each risky action
Governance, risk and sovereignty (R11)	A register of every agent, records kept to match the risk, and data kept where the law requires
Observability and FinOps (R12)	A trace of every step that the agent cannot alter, and a budget it cannot exceed

Layer: Security and identity (R10)
What good looks like: Every agent has its own identity. A fixed rule outside the model checks each risky action

Layer: Governance, risk and sovereignty (R11)
What good looks like: A register of every agent, records kept to match the risk, and data kept where the law requires

Layer: Observability and FinOps (R12)
What good looks like: A trace of every step that the agent cannot alter, and a budget it cannot exceed

Improve them

Layer	What good looks like
Intelligence and learning (R06)	Experts write the tests. Model judges are checked against people. A change ships only after it passes, and can be rolled back

Layer: Intelligence and learning (R06)
What good looks like: Experts write the tests. Model judges are checked against people. A change ships only after it passes, and can be rolled back

Work with people

Layer	What good looks like
Productivity and collaboration (R08)	Office agents act with their own agent identity. A user account that joins meetings and chats is granted rarely
Experience and channels (R09)	Agents that talk to customers get their own front door, because what they say carries legal weight
Operating model and supervision (R13)	Supervisor capacity is planned like a queue, counting waiting time and the busiest ten minutes

Layer: Productivity and collaboration (R08)
What good looks like: Office agents act with their own agent identity. A user account that joins meetings and chats is granted rarely

Layer: Experience and channels (R09)
What good looks like: Agents that talk to customers get their own front door, because what they say carries legal weight

Layer: Operating model and supervision (R13)
What good looks like: Supervisor capacity is planned like a queue, counting waiting time and the busiest ten minutes

How the pages are built

Every layer page follows the same order.

An opening paragraph: what the layer is, what sits in it today, and what agents need from it.
What sits in this layer today. A table shows the systems in four kinds of organisation. They are an electricity distributor, a water utility, a hospital network, and a generator or miner.
What agents add to the layer.
What must be true before an agent touches it, and where that rule is enforced.
Choices and their verdicts, each linked to the decision catalog.
The concerns this layer must honour, linked to the concern matrix. A concern is a requirement every layer must honour, such as identity, privacy or cost.
Evidence and limits: what the sources support and where they stop.
A next step, and the research behind the page with its dated sources.

The research for each layer, with findings and sources, is in the research library.

Evidence and limits

The list of fourteen layers is this guide's own. No standards body publishes one. The Cloud Security Alliance's MAESTRO model has seven layers of an agentic system (6 February 2025). That is a different list, about the agent system itself, not the enterprise around it.

The systems named in each layer table come from industry knowledge and three research briefs written on 15 October 2026. Vendor names are examples, not a market-share claim.

Next step

Read the page for the layer you run. If you are new to the guide, start with Start here, then the agent lifecycle.